stormser | e547cd6d95354658cbc8e3aa2e07b34d7a1964dbac01350fb1723ae262eaec3a

General

Target
2026-07-08_9a508460c58a2b83f4c88da32d774afb_elex_wannacry.exe
Size 372KB
Sample260708-vwrfxaev81
SHA256 e547cd6d95354658cbc8e3aa2e07b34d7a1964dbac01350fb1723ae262eaec3a
MD5 9a508460c58a2b83f4c88da32d774afb
SHA1 f65b7cf5aaf64f9aef67e6c46ffb3be5c80e4e3f
SHA512 aefe001953ce055fb49845fd0fc5bbfffa3615225e2d40811dbf8f39cf7b524e3e75d812eb65b9b66a0beeb04b89e0bb89c9fc6f4dff7367823a5df17a38e1d0
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroDx4/CFsrdx:Gvw9816vhKQLroDx4/wQT
TLSH
T1D48408835BDE9CF2FB91113009798AB9927B9AC4910EBEDFBF90CD250037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 2 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c579-3.dat	family_stormser
behavioral2/files/0x000d00000001c57a-6.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51CA798B-D243-4c46-AFE6-3A88FEBD610A}\stubpath = "C:\\Windows\\{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe"	{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}	2026-07-08_9a508460c58a2b83f4c88da32d774afb_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}\stubpath = "C:\\Windows\\{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe"	2026-07-08_9a508460c58a2b83f4c88da32d774afb_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{51CA798B-D243-4c46-AFE6-3A88FEBD610A}	{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe

Executes dropped EXE 3 IoCs

pid	Process
5528	{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe
1512	{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe
4236	{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe	2026-07-08_9a508460c58a2b83f4c88da32d774afb_elex_wannacry.exe
File created	C:\Windows\{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe	{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_9a508460c58a2b83f4c88da32d774afb_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-515251955-468707340-1782030364-1000\{F143B468-718D-4346-A874-B789D41C80E2}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1204	2026-07-08_9a508460c58a2b83f4c88da32d774afb_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	5528	{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe
Token: SeShutdownPrivilege	2132	explorer.exe
Token: SeCreatePagefilePrivilege	2132	explorer.exe
Token: SeShutdownPrivilege	2132	explorer.exe
Token: SeCreatePagefilePrivilege	2132	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3996	sihost.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1204 wrote to memory of 5528	1204	2026-07-08_9a508460c58a2b83f4c88da32d774afb_elex_wannacry.exe	88
PID 1204 wrote to memory of 2512	1204	2026-07-08_9a508460c58a2b83f4c88da32d774afb_elex_wannacry.exe	89
PID 5528 wrote to memory of 1512	5528	{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe	90
PID 5528 wrote to memory of 1408	5528	{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe	91
PID 3996 wrote to memory of 2132	3996	sihost.exe	97
PID 2132 wrote to memory of 4236	2132	explorer.exe	98

C:\Users\Admin\AppData\Local\Temp\2026-07-08_9a508460c58a2b83f4c88da32d774afb_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_9a508460c58a2b83f4c88da32d774afb_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1204
- C:\Windows\{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe
  C:\Windows\{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe
    C:\Windows\{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1512
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CA0EE~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2512

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe
    "C:\Windows\{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe

Path C:\Windows\{51CA798B-D243-4c46-AFE6-3A88FEBD610A}.exe
Size 372KB
SHA256 e22c8deb88d9bd03842568f7ace75ddc141ad3304bb4df968ea0db6a4f89130a
MD5 84edc2679e02f4c1625ba031e1bac5a3
SHA1 4a13c56bfd79cd7b11445efd7b589eac4c0c5795
SHA512 22767af7ec3073764043f731262e314125d68e808f8389e0c27086d57a1e8169c003416869faaa5a9a70d43d36f630fbaae5e2182df4d9d5d2979adacf6da936
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLro6Px4/CFsrdx:Gvw9816vhKQLro6Px4/wQT
TLSH
T1678409835BDA9CF2FB91113009798AB5927B9AC4910EBEDF7F90CD250037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe

Path C:\Windows\{CA0EE61E-1AB6-4502-B51B-09D09CEB7642}.exe
Size 372KB
SHA256 4386f129d0fbbdb8e9fd5de94ee8ccd1321e762e8ecb82e16ca6ef7a18ae4f9d
MD5 bdbbf31c5aff25ca247ae69ef5f7c5a1
SHA1 2de38638a31cc6d6ea9ec411c3fadec9fbc912c0
SHA512 26d80ea45b4345eb7ed265d85b5f7dd1b1307f0d377f2f47c68988c627d334652927f5ebd3f893ac148ddd526716dca5ce2a9e2bbe44b3c602f9b5e927a7dc4a
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroRx4/CFsrdx:Gvw9816vhKQLroRx4/wQT
TLSH
T14C8408835BDE9CF2FB91117009798AB9927B9AC4910EBEDFBF90CD150037252D93A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads