stormser | fe4110d56c01deb6954712e641b740385e093da271da0fb2e3f20663500e27b8

General

Target
2026-07-08_37ac2372912cb57aa317d79ee1076302_elex_wannacry.exe
Size 90KB
Sample260708-wvs4saev7n
SHA256 fe4110d56c01deb6954712e641b740385e093da271da0fb2e3f20663500e27b8
MD5 37ac2372912cb57aa317d79ee1076302
SHA1 c55e24b447ca0398ab76982dfde1fd8446e06fd2
SHA512 0c254a67bbf806f7c32c0463c2edc1a3d737a339dc549568244b3246f23a19f9f15923aa2f21810e03ee44563956fa0bca7237c36d5c777f0d79eebbe2381ef0
SSDEEP 768:Qvw9816vhKQLroj4/wQRNrfrunMxVFA3b7glw6:YEGh0ojl2unMxVS3Hgl
TLSH
T15693C53D5EDA103BE2B7D6B585F125E3FE66B98336091D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral2/files/0x001b00000001c2a3-3.dat	family_stormser
behavioral2/files/0x000e00000001c48f-6.dat	family_stormser
behavioral2/files/0x000e00000001c492-13.dat	family_stormser
behavioral2/files/0x000f00000001c48f-18.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D30BA75-4637-45ce-8487-009FE8026295}\stubpath = "C:\\Windows\\{8D30BA75-4637-45ce-8487-009FE8026295}.exe"	2026-07-08_37ac2372912cb57aa317d79ee1076302_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1089592-1AF5-4152-A30A-D90BBEAA8255}	{8D30BA75-4637-45ce-8487-009FE8026295}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D1089592-1AF5-4152-A30A-D90BBEAA8255}\stubpath = "C:\\Windows\\{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe"	{8D30BA75-4637-45ce-8487-009FE8026295}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76E6D3C4-642B-44ae-9516-501130DD74F9}	{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76E6D3C4-642B-44ae-9516-501130DD74F9}\stubpath = "C:\\Windows\\{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe"	{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EF23840-111D-42ec-B942-E319B06D84AD}	{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{1EF23840-111D-42ec-B942-E319B06D84AD}\stubpath = "C:\\Windows\\{1EF23840-111D-42ec-B942-E319B06D84AD}.exe"	{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8D30BA75-4637-45ce-8487-009FE8026295}	2026-07-08_37ac2372912cb57aa317d79ee1076302_elex_wannacry.exe

Executes dropped EXE 5 IoCs

pid	Process
2644	{8D30BA75-4637-45ce-8487-009FE8026295}.exe
1824	{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe
5608	{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe
2316	{1EF23840-111D-42ec-B942-E319B06D84AD}.exe
3672	{1EF23840-111D-42ec-B942-E319B06D84AD}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe	{8D30BA75-4637-45ce-8487-009FE8026295}.exe
File created	C:\Windows\{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe	{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe
File created	C:\Windows\{1EF23840-111D-42ec-B942-E319B06D84AD}.exe	{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe
File created	C:\Windows\{8D30BA75-4637-45ce-8487-009FE8026295}.exe	2026-07-08_37ac2372912cb57aa317d79ee1076302_elex_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1EF23840-111D-42ec-B942-E319B06D84AD}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8D30BA75-4637-45ce-8487-009FE8026295}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_37ac2372912cb57aa317d79ee1076302_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{1EF23840-111D-42ec-B942-E319B06D84AD}.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2626306573-1585762579-411806764-1000\{8FCE1D61-3C8F-4F4D-8508-D1B3BFA1BD30}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3812	2026-07-08_37ac2372912cb57aa317d79ee1076302_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2644	{8D30BA75-4637-45ce-8487-009FE8026295}.exe
Token: SeIncBasePriorityPrivilege	1824	{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe
Token: SeIncBasePriorityPrivilege	5608	{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe
Token: SeShutdownPrivilege	412	explorer.exe
Token: SeCreatePagefilePrivilege	412	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5800	sihost.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3812 wrote to memory of 2644	3812	2026-07-08_37ac2372912cb57aa317d79ee1076302_elex_wannacry.exe	88
PID 3812 wrote to memory of 624	3812	2026-07-08_37ac2372912cb57aa317d79ee1076302_elex_wannacry.exe	89
PID 2644 wrote to memory of 1824	2644	{8D30BA75-4637-45ce-8487-009FE8026295}.exe	90
PID 2644 wrote to memory of 1904	2644	{8D30BA75-4637-45ce-8487-009FE8026295}.exe	91
PID 1824 wrote to memory of 5608	1824	{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe	93
PID 1824 wrote to memory of 4656	1824	{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe	94
PID 5608 wrote to memory of 2316	5608	{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe	95
PID 5608 wrote to memory of 2348	5608	{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe	96
PID 5800 wrote to memory of 412	5800	sihost.exe	101
PID 412 wrote to memory of 3672	412	explorer.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-07-08_37ac2372912cb57aa317d79ee1076302_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_37ac2372912cb57aa317d79ee1076302_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3812
- C:\Windows\{8D30BA75-4637-45ce-8487-009FE8026295}.exe
  C:\Windows\{8D30BA75-4637-45ce-8487-009FE8026295}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2644
- - C:\Windows\{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe
    C:\Windows\{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1824
  - - C:\Windows\{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe
      C:\Windows\{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:5608
    - - C:\Windows\{1EF23840-111D-42ec-B942-E319B06D84AD}.exe
        
        C:\Windows\{1EF23840-111D-42ec-B942-E319B06D84AD}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2316
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{76E6D~1.EXE > nul
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2348
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{D1089~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:4656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{8D30B~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:624

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Windows\{1EF23840-111D-42ec-B942-E319B06D84AD}.exe
    "C:\Windows\{1EF23840-111D-42ec-B942-E319B06D84AD}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{1EF23840-111D-42ec-B942-E319B06D84AD}.exe

Path C:\Windows\{1EF23840-111D-42ec-B942-E319B06D84AD}.exe
Size 90KB
SHA256 298da3a5a2fb7e4b8fe8cbc78d2a50c974d68c843c706ad8fd5dc978732c26af
MD5 e0fa30e655b2fb0dd34041d07cc32267
SHA1 12ca25b2f277639618a84f8704c1ce376a274e00
SHA512 6063c85d4e514d6ce90d9617ca0cd09488a84ef68d983ee9177d9e6c548612a1cbc18b7351d9ff29700521e42fc5411ab3db2a526c35f3737c8a7bec0e487824
SSDEEP 768:Qvw9816vhKQLroK4/wQRNrfrunMxVFA3b7glw6:YEGh0oKl2unMxVS3Hgl
TLSH
T10593D53D5DDA103BE2B7D6B585F125E3FE66B98336091D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe

Path C:\Windows\{76E6D3C4-642B-44ae-9516-501130DD74F9}.exe
Size 90KB
SHA256 27638eceaaecbe2e62fedd13fbbdc8a186bdb2b247a27482cb61b1fe6c909a06
MD5 8d0275e3f2f737765175399643e379bd
SHA1 9e68ac2014fc45f3e7b37e4ff98feda5b340f43b
SHA512 1e789c12ce711098093c308a4e7d05bd730f871363c28ae8722fec621c0100213dcac4e9dfb1d4cf1d6092fd163078f1cc9fa1a626eb7959edd8a523461e9d07
SSDEEP 768:Qvw9816vhKQLro9L4/wQRNrfrunMxVFA3b7glw6:YEGh0o9Ll2unMxVS3Hgl
TLSH
T1AF93C53D5DDA103BE2B7D6B585F126E3FE66B9833A095D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{8D30BA75-4637-45ce-8487-009FE8026295}.exe

Path C:\Windows\{8D30BA75-4637-45ce-8487-009FE8026295}.exe
Size 90KB
SHA256 55962e0600fc05dd2a977b36db465a61f1039038ebbc37cda066c9e962af49f0
MD5 bd60bc065344f87fc0b14599bad30ec2
SHA1 8d9cf9cad38a9731c9d37908324540bbe1a83027
SHA512 884383ea41803389478cb27107f61e67f6f6033373b635eef40b7e02f5bb0f1686fccb936dcd4fbdd15bdd0518ca23e200cb86999cc8c5a69051820bc846af2a
SSDEEP 768:Qvw9816vhKQLro+4/wQRNrfrunMxVFA3b7glw6:YEGh0o+l2unMxVS3Hgl
TLSH
T18993C53D5DDA103BE2B7D6B585F126E3FE66B98336095D0E05D243428C23B53AD86C1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe

Path C:\Windows\{D1089592-1AF5-4152-A30A-D90BBEAA8255}.exe
Size 90KB
SHA256 704e2b5786f2b229efb550b8db8e6543adcc18b92e7622b914b8b6a2ae01bbd4
MD5 b1ef20acc40f77c18140dba50e5867f6
SHA1 1101807a9b690b4b5068aaa47d50faa9e92413d5
SHA512 72ad679a83faa2ff3155d57ca3ec8e7e574ed21b9bc0f51a2868bb4badad00c91ade5d007888628a6e6ad6fe94793415fd4c65c0f3c3bb964b2ddf7f1a5f59e1
SSDEEP 768:Qvw9816vhKQLroq4/wQRNrfrunMxVFA3b7glw6:YEGh0oql2unMxVS3Hgl
TLSH
T1E193C53D5DDA103BE2B7D6B585F126E7FE66B98336091D0E05D243428C23B53AD8AC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads