stormser | f52e206d2ac0513b98860e95d62e149c3915248285738697219c48c0f728c203

General

Target
2026-07-20_e4b83321cfac0dc4e6c52a2c4e71ef16_elex_wannacry.exe
Size 79KB
Sample260720-rd1ebaev4x
SHA256 f52e206d2ac0513b98860e95d62e149c3915248285738697219c48c0f728c203
MD5 e4b83321cfac0dc4e6c52a2c4e71ef16
SHA1 4986485b91fd0165d87a13d8326609efea7a9600
SHA512 bf477327149dd54d4231877646bcbd61a0e089d7efaef603672ded9bceffe7b71cbe42b978e70dc857079ffd3298b628a938e1dcb4e9efa64d0edd0f2fc9aba8
SSDEEP 768:4vw9816vhKQLrok4/wQpWMZ3XOQ69zbjlAAX5e9zJ:wEGh0okloWMZ3izbR9XwzJ
TLSH
T155834BC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024574-2.dat	family_stormser
behavioral1/files/0x0008000000024566-6.dat	family_stormser
behavioral1/files/0x000800000002457c-8.dat	family_stormser
behavioral1/files/0x0009000000024566-14.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 4 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024574-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024566-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000800000002457c-8.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0009000000024566-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}	{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}\stubpath = "C:\\Windows\\{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe"	{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}	{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}\stubpath = "C:\\Windows\\{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe"	{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5683BE76-A864-4052-88C1-2F946E2DE3B2}	{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{5683BE76-A864-4052-88C1-2F946E2DE3B2}\stubpath = "C:\\Windows\\{5683BE76-A864-4052-88C1-2F946E2DE3B2}.exe"	{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}	2026-07-20_e4b83321cfac0dc4e6c52a2c4e71ef16_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}\stubpath = "C:\\Windows\\{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe"	2026-07-20_e4b83321cfac0dc4e6c52a2c4e71ef16_elex_wannacry.exe

Executes dropped EXE 4 IoCs

pid	Process
2764	{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe
3428	{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe
4248	{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe
3204	{5683BE76-A864-4052-88C1-2F946E2DE3B2}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe	2026-07-20_e4b83321cfac0dc4e6c52a2c4e71ef16_elex_wannacry.exe
File created	C:\Windows\{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe	{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe
File created	C:\Windows\{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe	{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe
File created	C:\Windows\{5683BE76-A864-4052-88C1-2F946E2DE3B2}.exe	{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4816	cmd.exe
3968	cmd.exe
2312	cmd.exe
2432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_e4b83321cfac0dc4e6c52a2c4e71ef16_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{5683BE76-A864-4052-88C1-2F946E2DE3B2}.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2544	2026-07-20_e4b83321cfac0dc4e6c52a2c4e71ef16_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2764	{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe
Token: SeIncBasePriorityPrivilege	3428	{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe
Token: SeIncBasePriorityPrivilege	4248	{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 2764	2544	2026-07-20_e4b83321cfac0dc4e6c52a2c4e71ef16_elex_wannacry.exe	91
PID 2544 wrote to memory of 3968	2544	2026-07-20_e4b83321cfac0dc4e6c52a2c4e71ef16_elex_wannacry.exe	92
PID 2764 wrote to memory of 3428	2764	{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe	93
PID 2764 wrote to memory of 2312	2764	{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe	94
PID 3428 wrote to memory of 4248	3428	{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe	97
PID 3428 wrote to memory of 2432	3428	{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe	98
PID 4248 wrote to memory of 3204	4248	{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe	99
PID 4248 wrote to memory of 4816	4248	{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-20_e4b83321cfac0dc4e6c52a2c4e71ef16_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_e4b83321cfac0dc4e6c52a2c4e71ef16_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Windows\{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe
  C:\Windows\{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe
    C:\Windows\{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3428
  - - C:\Windows\{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe
      C:\Windows\{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4248
    - - C:\Windows\{5683BE76-A864-4052-88C1-2F946E2DE3B2}.exe
        
        C:\Windows\{5683BE76-A864-4052-88C1-2F946E2DE3B2}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3204
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A4935~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4816
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{03931~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2432
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CC3A9~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe

Path C:\Windows\{0393185C-AA4D-41e3-B5FD-D2443FEB2A39}.exe
Size 79KB
SHA256 9b84888b653aa143f97685462107742b55712af21a868ac4691eae38a61f7227
MD5 0c0df82d4175a9b961a29808ddfba8dd
SHA1 6a26b9cd8b16fa6aae31dca6dd6c4bbb0a70be5d
SHA512 fcaa6a71b5f921b74868545911386818507903b75bbf0d2c7b249895327a68e38401475faed1ccade9e987f256526e947920b1e752f998f4fb5a3f41d486ee60
SSDEEP 768:4vw9816vhKQLroI4/wQpWMZ3XOQ69zbjlAAX5e9zJ:wEGh0oIloWMZ3izbR9XwzJ
TLSH
T1FD834CC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5683BE76-A864-4052-88C1-2F946E2DE3B2}.exe

Path C:\Windows\{5683BE76-A864-4052-88C1-2F946E2DE3B2}.exe
Size 79KB
SHA256 1a632197dffbd30ad85ee75f85c3ae5a4a23e4d05eb94a85e1eb9b54dfa1efa5
MD5 4908a88caaf15959a41b1e3b2b5e4cfb
SHA1 c5b75f326334d6b3e35fd5f0abc38dffeeeddd52
SHA512 0742d46a1819ca552be73eaaf2ef29bb7782936b41671ff8cf2a76ae34ef1f4dfede849d8228dbd4a2619e5a6832f97d5cfe56fdb33693c2272c220d94b0a141
SSDEEP 768:4vw9816vhKQLroZ4/wQpWMZ3XOQ69zbjlAAX5e9zJ:wEGh0oZloWMZ3izbR9XwzJ
TLSH
T1D3833BC38E6C6483FE96297012A8DABB7D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe

Path C:\Windows\{A4935D8E-3B2F-4530-B40B-2BFE1A56C878}.exe
Size 79KB
SHA256 37df46988ea56b645d39aec0655c331e3f0da338b2a870c08fdbd03809ecf508
MD5 d4dd7afdcfc4acb18deeff962e2787a1
SHA1 daa1c43ede5e85fed50e7835a734480e54286bec
SHA512 21baf9710bdc66db53e6e3411fb9bc5e36e510cf4dc9b306590662b92cbfeaf7ea5806fb95e48ea95fbdfdc26b601a9aa2082a624b23e73f338cc30e665f7f63
SSDEEP 768:4vw9816vhKQLroP4/wQpWMZ3XOQ69zbjlAAX5e9zJ:wEGh0oPloWMZ3izbR9XwzJ
TLSH
T137834BC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe

Path C:\Windows\{CC3A9684-A66B-4d1c-AF22-E9CAEA8DB259}.exe
Size 79KB
SHA256 30ada607615339b4b74926b210a713a1cfa9bcb2e49d9a7dbb6d88cb3b44fc8f
MD5 d6418e7d3f39395f17b9ac870b0a6cf8
SHA1 10eaa6d69581e5115bdcbbc8f17709f93bdf66be
SHA512 07698d835f122ac5b96ebba4584584f37f34e6f340cef038d4797437ae2619fa4409b0d4c0cd77b063b022ab3c93491beeed622bf6a5956d8b6655188f154642
SSDEEP 768:4vw9816vhKQLroK4/wQpWMZ3XOQ69zbjlAAX5e9zJ:wEGh0oKloWMZ3izbR9XwzJ
TLSH
T1FF834CC38E6C6483FE96297012A8DAB77D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads