stormser | 6bbcf78699cc1fec37552b9d4c748bb1b3387a654ccbcae2d224d37d3553b5de

General

Target
2026-07-08_6488fc4ed5ed1cd39be7a5391c31dd7e_elex_wannacry.exe
Size 79KB
Sample260708-wdvahsdy3r
SHA256 6bbcf78699cc1fec37552b9d4c748bb1b3387a654ccbcae2d224d37d3553b5de
MD5 6488fc4ed5ed1cd39be7a5391c31dd7e
SHA1 2161aeba889b5eb1a3f30b2b8301f4fecf5e6c24
SHA512 c48489f0d7223369534cba6e79e73793434fa034f9a8b70360cac6c47505df75cc1569dadc028e724602c57bbd98a9c26ab315743867f3c2e3b56a7cce91f1d0
SSDEEP 768:4vw9816vhKQLroX4/wQzXOQ69zbjlAAX5e9zx:wEGh0oXlGizbR9Xwzx
TLSH
T108834BD38EAC4483FDE6697012B8DAB77C3E97C61504B99B6B91FD5408A33C1EB2411E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c450-3.dat	family_stormser
behavioral2/files/0x000e00000001c45c-6.dat	family_stormser
behavioral2/files/0x000f00000001c450-12.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{452A0430-D17C-4f13-B229-754BBA48A32C}\stubpath = "C:\\Windows\\{452A0430-D17C-4f13-B229-754BBA48A32C}.exe"	{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1425CE08-DDEB-400c-AD12-974F4F25A53C}	2026-07-08_6488fc4ed5ed1cd39be7a5391c31dd7e_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1425CE08-DDEB-400c-AD12-974F4F25A53C}\stubpath = "C:\\Windows\\{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe"	2026-07-08_6488fc4ed5ed1cd39be7a5391c31dd7e_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}	{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}\stubpath = "C:\\Windows\\{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe"	{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{452A0430-D17C-4f13-B229-754BBA48A32C}	{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe

Executes dropped EXE 4 IoCs

pid	Process
3564	{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe
2000	{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe
1404	{452A0430-D17C-4f13-B229-754BBA48A32C}.exe
5916	{452A0430-D17C-4f13-B229-754BBA48A32C}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{452A0430-D17C-4f13-B229-754BBA48A32C}.exe	{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe
File created	C:\Windows\{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe	2026-07-08_6488fc4ed5ed1cd39be7a5391c31dd7e_elex_wannacry.exe
File created	C:\Windows\{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe	{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_6488fc4ed5ed1cd39be7a5391c31dd7e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{452A0430-D17C-4f13-B229-754BBA48A32C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{452A0430-D17C-4f13-B229-754BBA48A32C}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1581435544-3586420778-2104125077-1000\{DF21C36E-8EBA-4DD2-BDF3-9344B2FD7695}	explorer.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	5216	2026-07-08_6488fc4ed5ed1cd39be7a5391c31dd7e_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3564	{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe
Token: SeIncBasePriorityPrivilege	2000	{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe
Token: SeShutdownPrivilege	5336	explorer.exe
Token: SeCreatePagefilePrivilege	5336	explorer.exe
Token: SeShutdownPrivilege	5336	explorer.exe
Token: SeCreatePagefilePrivilege	5336	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5908	sihost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5216 wrote to memory of 3564	5216	2026-07-08_6488fc4ed5ed1cd39be7a5391c31dd7e_elex_wannacry.exe	88
PID 5216 wrote to memory of 996	5216	2026-07-08_6488fc4ed5ed1cd39be7a5391c31dd7e_elex_wannacry.exe	89
PID 3564 wrote to memory of 2000	3564	{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe	90
PID 3564 wrote to memory of 3960	3564	{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe	91
PID 2000 wrote to memory of 1404	2000	{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe	92
PID 2000 wrote to memory of 1680	2000	{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe	93
PID 5908 wrote to memory of 5336	5908	sihost.exe	98
PID 5336 wrote to memory of 5916	5336	explorer.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-07-08_6488fc4ed5ed1cd39be7a5391c31dd7e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_6488fc4ed5ed1cd39be7a5391c31dd7e_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5216
- C:\Windows\{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe
  C:\Windows\{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Windows\{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe
    C:\Windows\{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2000
  - - C:\Windows\{452A0430-D17C-4f13-B229-754BBA48A32C}.exe
      C:\Windows\{452A0430-D17C-4f13-B229-754BBA48A32C}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1404
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8BCAE~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1680
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{1425C~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:996

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\{452A0430-D17C-4f13-B229-754BBA48A32C}.exe
    "C:\Windows\{452A0430-D17C-4f13-B229-754BBA48A32C}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe

Path C:\Windows\{1425CE08-DDEB-400c-AD12-974F4F25A53C}.exe
Size 79KB
SHA256 3a312ff2a19f3dafdbf7e4a3dc00ec52cb90caeef57c12ac95d8c241a8962ff4
MD5 bc94f658291fb94f381a7ddd37f6c16b
SHA1 d83d139915f4d1660b2cf7bded186c841238d197
SHA512 c6f41a86aec08c9d59470d111afcb2890a0681a3840c35f87b262df47110bfd4aff567611f9a86e12be1043b343574b13c988ce492ee780654a13acae419eaf6
SSDEEP 768:4vw9816vhKQLroD4/wQzXOQ69zbjlAAX5e9zx:wEGh0oDlGizbR9Xwzx
TLSH
T117834BD38EAC4483FDE6697012B8D9B77C3E97C61504B99B6B91FD5408A33C1EB2411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{452A0430-D17C-4f13-B229-754BBA48A32C}.exe

Path C:\Windows\{452A0430-D17C-4f13-B229-754BBA48A32C}.exe
Size 79KB
SHA256 0d1b92c22645db7f89a0796ff870326533d9b8dbd4e4059e289a86696f5ad917
MD5 923751f11f7aba467e453d7c491830b6
SHA1 9ebb9a9a4c6d07dc5d3c5059259cbd72bd425156
SHA512 6fd499680110d7c21a41eb7a6d81c8e961c56350af59abe174471c4283b6aa60aa4b9f7f3ef1958c62446a35974c1717934876fd02ffafbf299696297824e5f0
SSDEEP 768:4vw9816vhKQLroz4/wQzXOQ69zbjlAAX5e9zx:wEGh0ozlGizbR9Xwzx
TLSH
T126834BD38EAC4483FDE6697012B8D9B77C3E97C61604B99B6B91FD5408A33C1EB2411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe

Path C:\Windows\{8BCAEAB7-1611-45ac-80C9-EE1BBC71CADC}.exe
Size 79KB
SHA256 09372865617b12d1be6ead1bf676e8940d8eb23d6526172c048d3ee115ebf4fc
MD5 e8215fadd938840b7b40fc3f91dbbd72
SHA1 a903a8e2600a938556d47ba450709dc9c15941ff
SHA512 f41312d8504cd14edd2db8e6c7337ee8d43bf2f8e72398f11e4b6a967744b6178d2cb22df67917b6e36e1d0252e3b389b036daffda67fcb0f9f75f1616bb8ce4
SSDEEP 768:4vw9816vhKQLroe4/wQzXOQ69zbjlAAX5e9zx:wEGh0oelGizbR9Xwzx
TLSH
T1FF834BD38EAC4483FDE6697012A8D9B77C3E97C6150479AB6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads