stormser | bc5cc8e3d8fa44920ca59eed1fa28dca8ef99aea25e79f455b3fdc11f1ecb7d7

General

Target
2026-07-06_fe0c44ae2005e5083f1a1778b208816b_elex_wannacry.exe
Size 90KB
Sample260706-vwtahah131
SHA256 bc5cc8e3d8fa44920ca59eed1fa28dca8ef99aea25e79f455b3fdc11f1ecb7d7
MD5 fe0c44ae2005e5083f1a1778b208816b
SHA1 574cf18699d86cda3683be4dbf3418484241f8e4
SHA512 36d73381c7c4c0b10f6feb9610475a0fa6f29bf832ce45be96259e76061ca263b975e5b5f00162a1ceffe6aa1c9bdfafff261c5ee8d61abedb23fb41864e933e
SSDEEP 768:Qvw9816vhKQLroy4/wQRNrfrunMxVFA3b7glws:YEGh0oyl2unMxVS3Hgz
TLSH
T16B93C53D5DDA103BE2B7D6B585F126E3FE66B98336091D0E46D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c561-3.dat	family_stormser
behavioral2/files/0x000e00000001c562-6.dat	family_stormser
behavioral2/files/0x000f00000001c561-13.dat	family_stormser
behavioral2/files/0x000f00000001c562-18.dat	family_stormser
behavioral2/files/0x001200000001c563-22.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}	2026-07-06_fe0c44ae2005e5083f1a1778b208816b_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}\stubpath = "C:\\Windows\\{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe"	2026-07-06_fe0c44ae2005e5083f1a1778b208816b_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41F7E557-0DA6-4d23-9956-E27E913BD4C6}\stubpath = "C:\\Windows\\{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe"	{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{560B6CBC-E35E-45b8-9706-5585A82E493F}	{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{560B6CBC-E35E-45b8-9706-5585A82E493F}\stubpath = "C:\\Windows\\{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe"	{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}	{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}\stubpath = "C:\\Windows\\{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe"	{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4C01FF6-2DD7-4c1a-A970-643738E75335}	{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{41F7E557-0DA6-4d23-9956-E27E913BD4C6}	{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E4C01FF6-2DD7-4c1a-A970-643738E75335}\stubpath = "C:\\Windows\\{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe"	{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe

Executes dropped EXE 6 IoCs

pid	Process
2476	{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe
3096	{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe
4356	{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe
1820	{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe
2884	{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe
8	{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe	{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe
File created	C:\Windows\{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe	2026-07-06_fe0c44ae2005e5083f1a1778b208816b_elex_wannacry.exe
File created	C:\Windows\{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe	{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe
File created	C:\Windows\{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe	{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe
File created	C:\Windows\{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe	{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_fe0c44ae2005e5083f1a1778b208816b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3865087520-2734723108-1233268525-1000\{EA201C8C-D2C2-4991-93EB-068562A0D4C7}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 9 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5068	2026-07-06_fe0c44ae2005e5083f1a1778b208816b_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2476	{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe
Token: SeIncBasePriorityPrivilege	3096	{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe
Token: SeIncBasePriorityPrivilege	4356	{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe
Token: SeIncBasePriorityPrivilege	1820	{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe
Token: SeShutdownPrivilege	2980	explorer.exe
Token: SeCreatePagefilePrivilege	2980	explorer.exe
Token: SeShutdownPrivilege	2980	explorer.exe
Token: SeCreatePagefilePrivilege	2980	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3000	sihost.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2476	5068	2026-07-06_fe0c44ae2005e5083f1a1778b208816b_elex_wannacry.exe	89
PID 5068 wrote to memory of 3988	5068	2026-07-06_fe0c44ae2005e5083f1a1778b208816b_elex_wannacry.exe	90
PID 2476 wrote to memory of 3096	2476	{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe	91
PID 2476 wrote to memory of 1392	2476	{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe	92
PID 3096 wrote to memory of 4356	3096	{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe	93
PID 3096 wrote to memory of 3744	3096	{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe	94
PID 4356 wrote to memory of 1820	4356	{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe	95
PID 4356 wrote to memory of 2692	4356	{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe	96
PID 1820 wrote to memory of 2884	1820	{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe	101
PID 1820 wrote to memory of 5892	1820	{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe	102
PID 3000 wrote to memory of 2980	3000	sihost.exe	103
PID 2980 wrote to memory of 8	2980	explorer.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-07-06_fe0c44ae2005e5083f1a1778b208816b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_fe0c44ae2005e5083f1a1778b208816b_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Windows\{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe
  C:\Windows\{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2476
- - C:\Windows\{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe
    C:\Windows\{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe
      C:\Windows\{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4356
    - - C:\Windows\{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe
        
        C:\Windows\{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1820
      - C:\Windows\{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe
        
        C:\Windows\{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2884
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{85794~1.EXE > nul
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{560B6~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2692
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{41F7E~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:3744
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{252A7~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1392
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3988

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe
    "C:\Windows\{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe

Path C:\Windows\{252A73E6-06A3-43bb-AD26-9FF2D9CAA1B4}.exe
Size 90KB
SHA256 ccc79b8fe92de7bbe201042251206345735fff74ccdd7cada5da5a95c035b678
MD5 4e4418eeba3cbe8fc504f11bc9c74b63
SHA1 17b57c9f0275bac56d4dd8d624ac14485b1ea94f
SHA512 202fe9ed180fd4c4d93d49e3b3d08d741343df76037feb8ca4ba1922562da735f85e69a1432f76eb009542904d1b3851b00e43d4f5d55a9aa016f62b0220f7ab
SSDEEP 768:Qvw9816vhKQLro14/wQRNrfrunMxVFA3b7glws:YEGh0o1l2unMxVS3Hgz
TLSH
T1A993C53D5DDA103BE2B7D6B585F126E3FE66B98335091D0E46D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe

Path C:\Windows\{41F7E557-0DA6-4d23-9956-E27E913BD4C6}.exe
Size 90KB
SHA256 40560e15e43fffb4b4f8e7fe8e9645584a842113a0ab69f251048772d9790a0d
MD5 907a9ff150500ba31c85a4bd03e50f31
SHA1 8998f4ae45fc7d0a916813268875516a5e18634f
SHA512 b6143c517b7ae1812cd4a223b030f33e1a28364a526eeaf1f419db7fd79e2531c93ee2b2bc202ec78a5d45980e015165da3a279871aaa69b8e035ec6f00b9ca9
SSDEEP 768:Qvw9816vhKQLrog4/wQRNrfrunMxVFA3b7glws:YEGh0ogl2unMxVS3Hgz
TLSH
T1EC93C53D5DDA103BE2B7D6B585F126E3FE66B98339091D0E46D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe

Path C:\Windows\{560B6CBC-E35E-45b8-9706-5585A82E493F}.exe
Size 90KB
SHA256 7abbabfc0f69a91a1872312153322e65cf4a54fdd48ee14674784d5baf6d927e
MD5 99082ae9899985b59b0af65c102ab13d
SHA1 bfaeac0cc5bd71e8d731738c05266cf03d8297e9
SHA512 b05b45d3b991cf8e1cf9963b11ffd994dc543606753c73cd9921dbeca7ee8730cf9586b5ee4d68546a6675d833ddfd6d4712e4c4e6f06540ac1ef87848c71253
SSDEEP 768:Qvw9816vhKQLroH4/wQRNrfrunMxVFA3b7glws:YEGh0oHl2unMxVS3Hgz
TLSH
T16893C53D5DDA103BE2B7D6B585F126E3FE66B98336091D0E46D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe

Path C:\Windows\{85794B9A-C85D-4647-B64D-9E5BBDB7B5A7}.exe
Size 90KB
SHA256 ff6d351c7970f2518aef91b0c32c8f0f8ed81de2b114784fdac595c74de51601
MD5 cadcc3c4410411cba877a0c5bc058db9
SHA1 b41d357040bab96827b51ceafa3a13aeab884fc4
SHA512 37927f7e3145af69ee452b606cca5c888c06fa8c0c252ee2368f15d6896f250f9fb2ed513c165a207529ced72706e51505d80dfc2a298f61163fbfd299f72d69
SSDEEP 768:Qvw9816vhKQLron4/wQRNrfrunMxVFA3b7glws:YEGh0onl2unMxVS3Hgz
TLSH
T1FA93C53D5DDA103BE2B7D6B585F126E3FE66B98339091D0E46D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe

Path C:\Windows\{E4C01FF6-2DD7-4c1a-A970-643738E75335}.exe
Size 90KB
SHA256 8bc2381e192161e5a1e560343688ffc1545d26fcca3b947c87b9f56a99417dec
MD5 f1ed80481d68484ffb7046c85a96265c
SHA1 f56d79ea0dd32fce7048f770d7d42e1a430e8cdf
SHA512 907af916bbdb10ac2ec26c884cca8821c424683f2bfd3529741d7c3379a2fb03a93d9d30c44d6921239f1cc6ce8339af41567eab4e682401f5443d15568a0562
SSDEEP 768:Qvw9816vhKQLrof4/wQRNrfrunMxVFA3b7glws:YEGh0ofl2unMxVS3Hgz
TLSH
T15093B53D5DDA1037E2B7D6B585F126E3FE66B9833A091D0E46D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads