stormser | b4de0c08df45d4a6ba30f44943f7d43620dcae1055b1c3f6a8187e2b1074ecfc

General

Target
2026-07-06_75af2918fbc54b2a422ebc4ad2315736_elex_wannacry.exe
Size 89KB
Sample260707-dftsnagv9v
SHA256 b4de0c08df45d4a6ba30f44943f7d43620dcae1055b1c3f6a8187e2b1074ecfc
MD5 75af2918fbc54b2a422ebc4ad2315736
SHA1 857c66b31659f6aa7b87bbf0e246efb204e3feca
SHA512 c3d6bfe867b38043b89ec20f032983d4403158109a697bbec3f2b6ce80e07c25c8489ad5754bd8c9f79a6e84cce56fc791ae21f1d171a97b12e592fd83cd705b
SSDEEP 768:Qvw9816vhKQLrow4/wQRNrfrunMxVFA3b7gls:YEGh0owl2unMxVS3HgO
TLSH
T1EB93A33D5DDA103BE277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c529-3.dat	family_stormser
behavioral2/files/0x000e00000001c52a-6.dat	family_stormser
behavioral2/files/0x000f00000001c529-13.dat	family_stormser
behavioral2/files/0x000f00000001c52a-18.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1916806A-63A4-4b82-9947-6AD550E60269}	{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1916806A-63A4-4b82-9947-6AD550E60269}\stubpath = "C:\\Windows\\{1916806A-63A4-4b82-9947-6AD550E60269}.exe"	{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}	{1916806A-63A4-4b82-9947-6AD550E60269}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}\stubpath = "C:\\Windows\\{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe"	{1916806A-63A4-4b82-9947-6AD550E60269}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0403CD4-9CA0-4849-926D-CF9F92473A9E}	{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D0403CD4-9CA0-4849-926D-CF9F92473A9E}\stubpath = "C:\\Windows\\{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe"	{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F48E2E3-D854-40e2-8633-92C730879DE8}	2026-07-06_75af2918fbc54b2a422ebc4ad2315736_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7F48E2E3-D854-40e2-8633-92C730879DE8}\stubpath = "C:\\Windows\\{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe"	2026-07-06_75af2918fbc54b2a422ebc4ad2315736_elex_wannacry.exe

Executes dropped EXE 5 IoCs

pid	Process
4284	{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe
3560	{1916806A-63A4-4b82-9947-6AD550E60269}.exe
3788	{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe
4112	{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe
2076	{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe	{1916806A-63A4-4b82-9947-6AD550E60269}.exe
File created	C:\Windows\{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe	{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe
File created	C:\Windows\{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe	2026-07-06_75af2918fbc54b2a422ebc4ad2315736_elex_wannacry.exe
File created	C:\Windows\{1916806A-63A4-4b82-9947-6AD550E60269}.exe	{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_75af2918fbc54b2a422ebc4ad2315736_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1916806A-63A4-4b82-9947-6AD550E60269}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1590476978-4004838454-3790292847-1000\{52B49877-7075-4572-914D-F4334FCD011B}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2496	2026-07-06_75af2918fbc54b2a422ebc4ad2315736_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4284	{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe
Token: SeIncBasePriorityPrivilege	3560	{1916806A-63A4-4b82-9947-6AD550E60269}.exe
Token: SeIncBasePriorityPrivilege	3788	{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe
Token: SeShutdownPrivilege	5912	explorer.exe
Token: SeCreatePagefilePrivilege	5912	explorer.exe
Token: SeShutdownPrivilege	5912	explorer.exe
Token: SeCreatePagefilePrivilege	5912	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5240	sihost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4284	2496	2026-07-06_75af2918fbc54b2a422ebc4ad2315736_elex_wannacry.exe	87
PID 2496 wrote to memory of 5588	2496	2026-07-06_75af2918fbc54b2a422ebc4ad2315736_elex_wannacry.exe	88
PID 4284 wrote to memory of 3560	4284	{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe	89
PID 4284 wrote to memory of 4504	4284	{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe	90
PID 3560 wrote to memory of 3788	3560	{1916806A-63A4-4b82-9947-6AD550E60269}.exe	91
PID 3560 wrote to memory of 4488	3560	{1916806A-63A4-4b82-9947-6AD550E60269}.exe	92
PID 3788 wrote to memory of 4112	3788	{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe	93
PID 3788 wrote to memory of 980	3788	{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe	94
PID 5240 wrote to memory of 5912	5240	sihost.exe	99
PID 5912 wrote to memory of 2076	5912	explorer.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-06_75af2918fbc54b2a422ebc4ad2315736_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_75af2918fbc54b2a422ebc4ad2315736_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe
  C:\Windows\{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\{1916806A-63A4-4b82-9947-6AD550E60269}.exe
    C:\Windows\{1916806A-63A4-4b82-9947-6AD550E60269}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3560
  - - C:\Windows\{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe
      C:\Windows\{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3788
    - - C:\Windows\{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe
        
        C:\Windows\{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4112
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{50901~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:980
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{19168~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4488
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{7F48E~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5588

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5240
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5912
- - C:\Windows\{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe
    "C:\Windows\{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1916806A-63A4-4b82-9947-6AD550E60269}.exe

Path C:\Windows\{1916806A-63A4-4b82-9947-6AD550E60269}.exe
Size 89KB
SHA256 71272bfa5418b6d602838339a8b3ae772613a08a6d403316d99cb7f0de9133ea
MD5 a09e0874f71c0dca26ab8a2ba529dd9a
SHA1 493125d25a5d4df6759b41a78655ace30c69a51e
SHA512 5fa6eb432e70b59990356d6a06d6e6919aa6219d49add3dc83330c38d09e675d29740e6172e9637c03a026c45bbed06207319be24d71ba5ed9e751212a529481
SSDEEP 768:Qvw9816vhKQLro5AL4/wQRNrfrunMxVFA3b7gls:YEGh0o5ALl2unMxVS3HgO
TLSH
T18F93A33D9DDA103BE277D6B585F126E3FE66B983350A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe

Path C:\Windows\{509018E9-AD64-4f2e-BFC8-817A6EE7DE50}.exe
Size 89KB
SHA256 23653b87cb53a536e40c439046cb237c08166640b28bfe722bf5eebd9a709964
MD5 fb438ca10e8421a9b9c25a1c089fc5a0
SHA1 777889e891f8053b0b93521ecc0b5bd0f5db0a59
SHA512 403359e775f04da8a6a103da3449a2c8f411997598fe05d7f97a94e214245c7ca64e677d5c3a99d4497614002452b4dc38eb48f3cc81fda7d920bce6e71ba4d3
SSDEEP 768:Qvw9816vhKQLroy4/wQRNrfrunMxVFA3b7gls:YEGh0oyl2unMxVS3HgO
TLSH
T1DF93A33D9DDA103BE277D6B585F126E3FE66B983350A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe

Path C:\Windows\{7F48E2E3-D854-40e2-8633-92C730879DE8}.exe
Size 89KB
SHA256 17e01033c73b71c6ff214df8bda868c16f75e23b30b45dfa93262db96c345e6b
MD5 eebf864209bb96ead85f29d0f25b2df0
SHA1 f59fcefa3dfa3eabd3a4dab05c917656fadc0267
SHA512 fca6b3d09260ac9dd29afe8e0151130f69b092d334d65d879f44e68c4852db8f6a3b8e118ab699823c552029952031584beee728813d2b5e1096710994be47f4
SSDEEP 768:Qvw9816vhKQLrox4/wQRNrfrunMxVFA3b7gls:YEGh0oxl2unMxVS3HgO
TLSH
T14793A33D9DDA1037E277D6B585F126E3FE66B983360A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe

Path C:\Windows\{D0403CD4-9CA0-4849-926D-CF9F92473A9E}.exe
Size 89KB
SHA256 9651d5c859a2096d2d27acfd1ae2354f8d430501cc5683ae8b954a9630306000
MD5 1a7cb159711c580877fca91206b574fc
SHA1 d19612f7010e95d723128a33cf6d2f1d21318db6
SHA512 bf364efdfed95542b21bb21835cee7e0831c5569615608be0057b8e07c9ae4d7db20e8aeb93ae96276388f15cd384eb2d6d6923e6f2e484c4da71d77c673ec2f
SSDEEP 768:Qvw9816vhKQLrov4/wQRNrfrunMxVFA3b7gls:YEGh0ovl2unMxVS3HgO
TLSH
T18893A33D5DDA1037E277D6B585F126E3FE66B9833A0A1D0E469343428D23B53AD8AC1C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads