stormser | 71df171a08b3bb2a81832e6861d8be05aac3d64a6b0ad804c8ae47bc3db25150

General

Target
2026-07-05_f202c5d428ca9affcce332af19733603_elex_wannacry.exe
Size 64KB
Sample260705-s5sn8adt21
SHA256 71df171a08b3bb2a81832e6861d8be05aac3d64a6b0ad804c8ae47bc3db25150
MD5 f202c5d428ca9affcce332af19733603
SHA1 4dc8399dc7cb6a61cb00b233b0d07ff77cb70e75
SHA512 69ace82e257f3f1d530d0c9e11dc982228a4b806102f6a0356044f71a443e78c01f700a322af8058864b89b254ac3e1aeb13712a949f6d24a932ddd2eb610e83
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrokz4/CFsrdn0A9lsy4:vvw9816vhKQLrokz4/wQH9lsl
TLSH
T108535C834BEE9CF2F7921131046D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c52b-3.dat	family_stormser
behavioral2/files/0x000e00000001c52c-6.dat	family_stormser
behavioral2/files/0x000f00000001c52b-13.dat	family_stormser
behavioral2/files/0x000f00000001c52c-18.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7BF0415-74CF-4171-989C-C1C991E7B802}	2026-07-05_f202c5d428ca9affcce332af19733603_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F7BF0415-74CF-4171-989C-C1C991E7B802}\stubpath = "C:\\Windows\\{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe"	2026-07-05_f202c5d428ca9affcce332af19733603_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{556CE54D-405E-4a32-9448-5DCCB2B17F0C}	{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{556CE54D-405E-4a32-9448-5DCCB2B17F0C}\stubpath = "C:\\Windows\\{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe"	{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{416860B7-4736-44cc-A551-247F69A420EC}	{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{416860B7-4736-44cc-A551-247F69A420EC}\stubpath = "C:\\Windows\\{416860B7-4736-44cc-A551-247F69A420EC}.exe"	{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FA058A5-4DB7-40e5-8C47-59749B5008D2}	{416860B7-4736-44cc-A551-247F69A420EC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3FA058A5-4DB7-40e5-8C47-59749B5008D2}\stubpath = "C:\\Windows\\{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe"	{416860B7-4736-44cc-A551-247F69A420EC}.exe

Executes dropped EXE 5 IoCs

pid	Process
4392	{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe
3208	{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe
4788	{416860B7-4736-44cc-A551-247F69A420EC}.exe
2424	{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe
1956	{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{416860B7-4736-44cc-A551-247F69A420EC}.exe	{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe
File created	C:\Windows\{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe	{416860B7-4736-44cc-A551-247F69A420EC}.exe
File created	C:\Windows\{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe	2026-07-05_f202c5d428ca9affcce332af19733603_elex_wannacry.exe
File created	C:\Windows\{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe	{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{416860B7-4736-44cc-A551-247F69A420EC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-05_f202c5d428ca9affcce332af19733603_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{1EA4B100-2EA5-4017-B97A-4B3AD98CE998}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2988	2026-07-05_f202c5d428ca9affcce332af19733603_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4392	{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe
Token: SeIncBasePriorityPrivilege	3208	{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe
Token: SeIncBasePriorityPrivilege	4788	{416860B7-4736-44cc-A551-247F69A420EC}.exe
Token: SeShutdownPrivilege	3848	explorer.exe
Token: SeCreatePagefilePrivilege	3848	explorer.exe
Token: SeShutdownPrivilege	3848	explorer.exe
Token: SeCreatePagefilePrivilege	3848	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3664	sihost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 4392	2988	2026-07-05_f202c5d428ca9affcce332af19733603_elex_wannacry.exe	88
PID 2988 wrote to memory of 6112	2988	2026-07-05_f202c5d428ca9affcce332af19733603_elex_wannacry.exe	89
PID 4392 wrote to memory of 3208	4392	{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe	90
PID 4392 wrote to memory of 1704	4392	{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe	91
PID 3208 wrote to memory of 4788	3208	{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe	92
PID 3208 wrote to memory of 2072	3208	{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe	93
PID 4788 wrote to memory of 2424	4788	{416860B7-4736-44cc-A551-247F69A420EC}.exe	94
PID 4788 wrote to memory of 1112	4788	{416860B7-4736-44cc-A551-247F69A420EC}.exe	95
PID 3664 wrote to memory of 3848	3664	sihost.exe	100
PID 3848 wrote to memory of 1956	3848	explorer.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-07-05_f202c5d428ca9affcce332af19733603_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-05_f202c5d428ca9affcce332af19733603_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Windows\{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe
  C:\Windows\{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe
    C:\Windows\{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3208
  - - C:\Windows\{416860B7-4736-44cc-A551-247F69A420EC}.exe
      C:\Windows\{416860B7-4736-44cc-A551-247F69A420EC}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4788
    - - C:\Windows\{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe
        
        C:\Windows\{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2424
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{41686~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1112
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{556CE~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:2072
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{F7BF0~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:6112

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3848
- - C:\Windows\{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe
    "C:\Windows\{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe

Path C:\Windows\{3FA058A5-4DB7-40e5-8C47-59749B5008D2}.exe
Size 64KB
SHA256 5841ba5b790f01956158ad4dc5070807b65021b3864c1f701d77e4d968b90ce1
MD5 bcf6b9e6d0e5388638f072494127689f
SHA1 33399d5b561bd9c2d9a7b2b8561e6ad7c8bb02b1
SHA512 540d8316c73e592117532f5d93d2521823dcddcbdc5bc10f680a278c06dd2ced5090b4ee125673ba0e689c171dd7a5cead8c4cdd80b3b69d69f4798d5da87f39
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroN4/CFsrdn0A9lsy4:vvw9816vhKQLroN4/wQH9lsl
TLSH
T1E0535C834BEE98F2F7D20131046D8AB99277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{416860B7-4736-44cc-A551-247F69A420EC}.exe

Path C:\Windows\{416860B7-4736-44cc-A551-247F69A420EC}.exe
Size 64KB
SHA256 ac110aabbccc840f02e4178e5ff5ff03e749538510987b402f4ba0997a3821e4
MD5 79ed0e68c086efa6727dee7fc7ef1781
SHA1 28f08ad8ef65dfd0f5dc80b289cd8570cfdda187
SHA512 de0abb9487c9d2cec2f9b7932561d8858332f18d05c75c56ae673030a65afe33e37bfcb5f14623e8f405e5db6e50d77936d51f6ca77c3f6cb1390d7f97eed212
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrov4/CFsrdn0A9lsy4:vvw9816vhKQLrov4/wQH9lsl
TLSH
T181535C834BEE98F2F7D21131046D8A798277ADC4961EBEAF7F50CE54007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe

Path C:\Windows\{556CE54D-405E-4a32-9448-5DCCB2B17F0C}.exe
Size 64KB
SHA256 c4cab521740c6a9a4a7ce6f85246de023e66ccc214e7923b87821ed88ee06138
MD5 510b81e9e971f6bf2db84582018a1607
SHA1 54b86150873fe3d415e2307861cce57576f33704
SHA512 11897677f8790f6e1bcefb9523d879f22ae0c944e1f62ba8a3589a4409f873510f580e3630a8e180eacbe9d497235f740159e795d60808cd194e38f774a71b5e
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLrog4/CFsrdn0A9lsy4:vvw9816vhKQLrog4/wQH9lsl
TLSH
T103535C834BEE98F2F7D20131046D8AB98277ADC4961EBEAF7F50CE55007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe

Path C:\Windows\{F7BF0415-74CF-4171-989C-C1C991E7B802}.exe
Size 64KB
SHA256 d2f82019b789a393412eea0ea80bfa288ea20c1b1393769a2ea888612eaeb1ea
MD5 d5422c73bb3c4647c08307d1a80610c3
SHA1 fa6464a274c6b9a5b6017450048c2b32f6362141
SHA512 e0a6d9eaccce465595f56bc094fbee05e218dfce9662905132d5945fbdbcea8e322195209b52b7bfa0c268002c39e33c8e45657b1b3ee32b5e09d32f36858a82
SSDEEP 384:vbLwOs8AHsc4sMfwhKQLroJ4/CFsrdn0A9lsy4:vvw9816vhKQLroJ4/wQH9lsl
TLSH
T125535C834BEE98F2F7D20131046D8AB98277ADC4961EBEAF7F50CE55007B191D83A14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads