stormser | 2d7f6fee4160c05537192534f5cac21cc94fd5410c7b5691f165f535ef1a2dbb

General

Target
2026-07-09_31323213635af021a6e184b1ee026945_elex_wannacry.exe
Size 372KB
Sample260709-wcs13aez5k
SHA256 2d7f6fee4160c05537192534f5cac21cc94fd5410c7b5691f165f535ef1a2dbb
MD5 31323213635af021a6e184b1ee026945
SHA1 8dd449350bb6072f13befb1e7a81ebc2f1cba329
SHA512 393b1093c5cb7460894a9cb27c7b37ab3dc1b7095d4c58cdc6ebef88b0b6b30738f8873f6684fbee5af28b45318ed173b30d9abccf771cda35ee31e1ea4ed70c
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrolx4/CFsrdb:Gvw9816vhKQLrolx4/wQR
TLSH
T18C8408835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD550037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c4ad-3.dat	family_stormser
behavioral2/files/0x000e00000001c4ae-6.dat	family_stormser
behavioral2/files/0x000e00000001c4b0-13.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}	2026-07-09_31323213635af021a6e184b1ee026945_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}\stubpath = "C:\\Windows\\{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe"	2026-07-09_31323213635af021a6e184b1ee026945_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}	{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}\stubpath = "C:\\Windows\\{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe"	{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}	{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}\stubpath = "C:\\Windows\\{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe"	{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe

Executes dropped EXE 4 IoCs

pid	Process
1372	{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe
3284	{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe
2744	{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe
2436	{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe	2026-07-09_31323213635af021a6e184b1ee026945_elex_wannacry.exe
File created	C:\Windows\{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe	{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe
File created	C:\Windows\{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe	{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_31323213635af021a6e184b1ee026945_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2699128254-3633964024-152949075-1000\{15B1C395-4836-4968-997D-54C24FA6C5D1}	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4808	2026-07-09_31323213635af021a6e184b1ee026945_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	1372	{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe
Token: SeIncBasePriorityPrivilege	3284	{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe
Token: SeShutdownPrivilege	5740	explorer.exe
Token: SeCreatePagefilePrivilege	5740	explorer.exe
Token: SeShutdownPrivilege	5740	explorer.exe
Token: SeCreatePagefilePrivilege	5740	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	sihost.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 1372	4808	2026-07-09_31323213635af021a6e184b1ee026945_elex_wannacry.exe	88
PID 4808 wrote to memory of 1052	4808	2026-07-09_31323213635af021a6e184b1ee026945_elex_wannacry.exe	89
PID 1372 wrote to memory of 3284	1372	{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe	90
PID 1372 wrote to memory of 4448	1372	{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe	91
PID 3284 wrote to memory of 2744	3284	{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe	93
PID 3284 wrote to memory of 1204	3284	{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe	94
PID 2668 wrote to memory of 5740	2668	sihost.exe	99
PID 5740 wrote to memory of 2436	5740	explorer.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-09_31323213635af021a6e184b1ee026945_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_31323213635af021a6e184b1ee026945_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe
  C:\Windows\{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe
    C:\Windows\{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Windows\{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe
      C:\Windows\{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:2744
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{EC63F~1.EXE > nul
      4⤵
      System Location Discovery: System Language Discovery
      PID:1204
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{EE40D~1.EXE > nul
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4448
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1052

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Windows\explorer.exe
  explorer.exe /LOADSAVEDWINDOWS
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5740
- - C:\Windows\{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe
    "C:\Windows\{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe

Path C:\Windows\{DF541C6B-2C25-4b01-8CE4-13428CCB8AE7}.exe
Size 372KB
SHA256 a18a7bdfd8a4435ea79f4fb1477b6d1430228609864291b77602578ff7ecd7f4
MD5 fcb2b58a84cb09513d6f4e53c931e223
SHA1 17735cf2fff914dbfb4f7eb077e9beef18382c01
SHA512 476ff727dacbf7844041c62caecd05cd3514d18300203640a37f7f45fa33bafdefaf4d88301076d107fa063bb0d449f973e80408bb5e2fedf2015bd414868644
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrosx4/CFsrdb:Gvw9816vhKQLrosx4/wQR
TLSH
T1BC8419835BDE9CF2FB91113009798AB9927B9AC4910EBEDFBF90CD250037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe

Path C:\Windows\{EC63FC24-0AC2-493b-8CE7-A199E67C8BEB}.exe
Size 372KB
SHA256 8c277b4eabd31854c70c7b23acc7d51093faf6ad77eb51c16000221a8b12bf16
MD5 c459274a0fc2fae106e8fc67add0e4cf
SHA1 d0e64991f3bda8a0103fb7ef19ccf5685e5744e2
SHA512 02860bfa9d406722f4497e52f4100deff268462e2f30307833dd97bbb96bd99d5b8e3fb45b23e93252c4d3e678527a24d39845421e82ec610a502ccb6130d9ac
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroAx4/CFsrdb:Gvw9816vhKQLroAx4/wQR
TLSH
T1638408835BDE9CF2FB91113009798AB9927B9AD4914EBEDFBF90CD150037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe

Path C:\Windows\{EE40D84C-C3CC-4c4b-ABDF-280D6EA398DC}.exe
Size 372KB
SHA256 2d8a55a1c97ffa1949e2bd233fd5e86ec60a4bf184071837911e4c861ee591b1
MD5 c6540e63de3f8df777d5f27090c0b4ac
SHA1 238a88c767e162fff247c810c3a41d3c82f78fa5
SHA512 1067d8b8315d6d400e9ce7e31a5114461eb12bac8cce20dde07e54a6383de6c502a3d529100fac01420179a7abc9be6683206e6bacb3fa9ecb837f1efc671411
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroFx4/CFsrdb:Gvw9816vhKQLroFx4/wQR
TLSH
T1AC8419835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD250037252D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads