stormser | 47128a1f10a4d13a5030fda07e3533a9c6e82c6186ae54b15250709b1e8d7ac1

General

Target
2026-07-30_5c9caa2e6c7c0ef88114af3fe3060908_elex_wannacry.exe
Size 79KB
Sample260730-sy8f4a1clc
SHA256 47128a1f10a4d13a5030fda07e3533a9c6e82c6186ae54b15250709b1e8d7ac1
MD5 5c9caa2e6c7c0ef88114af3fe3060908
SHA1 f7bf61d4f37536e21a0eb71a6742b192fa2de4d7
SHA512 0827f0757cb21a04114f0e4819796b98679c1d5c1aa796f36517eb32bf59125773440707a35f17825d06e92f33f6a4490f01a1582245efcbc9767a140fa93476
SSDEEP 768:4vw9816vhKQLrod4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0odloWMZ3izbR9Xwzz
TLSH
T107834CC38E6C6483FED6297012A8DAA77D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral1/files/0x000300000001e699-2.dat	family_stormser
behavioral1/files/0x000300000001e69b-6.dat	family_stormser
behavioral1/files/0x0008000000024602-8.dat	family_stormser
behavioral1/files/0x0003000000016909-14.dat	family_stormser
behavioral1/files/0x0007000000024610-19.dat	family_stormser

Detects Windows executables referencing non-Windows User-Agents 5 IoCs

resource	yara_rule
behavioral1/files/0x000300000001e699-2.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x000300000001e69b-6.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0008000000024602-8.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0003000000016909-14.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA
behavioral1/files/0x0007000000024610-19.dat	INDICATOR_SUSPICIOUS_EXE_NoneWindowsUA

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}\stubpath = "C:\\Windows\\{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe"	{80323144-A462-42b3-BC85-89113A12D93A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}	{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}\stubpath = "C:\\Windows\\{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe"	{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83C75A99-5628-40c7-A430-D9AC735797F8}	{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{83C75A99-5628-40c7-A430-D9AC735797F8}\stubpath = "C:\\Windows\\{83C75A99-5628-40c7-A430-D9AC735797F8}.exe"	{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76F0B12F-64B9-49e2-BFAF-BBB8CEA76ECE}	{83C75A99-5628-40c7-A430-D9AC735797F8}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76F0B12F-64B9-49e2-BFAF-BBB8CEA76ECE}\stubpath = "C:\\Windows\\{76F0B12F-64B9-49e2-BFAF-BBB8CEA76ECE}.exe"	{83C75A99-5628-40c7-A430-D9AC735797F8}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80323144-A462-42b3-BC85-89113A12D93A}	2026-07-30_5c9caa2e6c7c0ef88114af3fe3060908_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{80323144-A462-42b3-BC85-89113A12D93A}\stubpath = "C:\\Windows\\{80323144-A462-42b3-BC85-89113A12D93A}.exe"	2026-07-30_5c9caa2e6c7c0ef88114af3fe3060908_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}	{80323144-A462-42b3-BC85-89113A12D93A}.exe

Executes dropped EXE 5 IoCs

pid	Process
3452	{80323144-A462-42b3-BC85-89113A12D93A}.exe
976	{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe
3476	{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe
2316	{83C75A99-5628-40c7-A430-D9AC735797F8}.exe
4608	{76F0B12F-64B9-49e2-BFAF-BBB8CEA76ECE}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{83C75A99-5628-40c7-A430-D9AC735797F8}.exe	{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe
File created	C:\Windows\{76F0B12F-64B9-49e2-BFAF-BBB8CEA76ECE}.exe	{83C75A99-5628-40c7-A430-D9AC735797F8}.exe
File created	C:\Windows\{80323144-A462-42b3-BC85-89113A12D93A}.exe	2026-07-30_5c9caa2e6c7c0ef88114af3fe3060908_elex_wannacry.exe
File created	C:\Windows\{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe	{80323144-A462-42b3-BC85-89113A12D93A}.exe
File created	C:\Windows\{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe	{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4336	cmd.exe
884	cmd.exe
1656	cmd.exe
2612	cmd.exe
2740	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{83C75A99-5628-40c7-A430-D9AC735797F8}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{76F0B12F-64B9-49e2-BFAF-BBB8CEA76ECE}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_5c9caa2e6c7c0ef88114af3fe3060908_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{80323144-A462-42b3-BC85-89113A12D93A}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3440	2026-07-30_5c9caa2e6c7c0ef88114af3fe3060908_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3452	{80323144-A462-42b3-BC85-89113A12D93A}.exe
Token: SeIncBasePriorityPrivilege	976	{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe
Token: SeIncBasePriorityPrivilege	3476	{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe
Token: SeIncBasePriorityPrivilege	2316	{83C75A99-5628-40c7-A430-D9AC735797F8}.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 3452	3440	2026-07-30_5c9caa2e6c7c0ef88114af3fe3060908_elex_wannacry.exe	86
PID 3440 wrote to memory of 4336	3440	2026-07-30_5c9caa2e6c7c0ef88114af3fe3060908_elex_wannacry.exe	87
PID 3452 wrote to memory of 976	3452	{80323144-A462-42b3-BC85-89113A12D93A}.exe	88
PID 3452 wrote to memory of 884	3452	{80323144-A462-42b3-BC85-89113A12D93A}.exe	89
PID 976 wrote to memory of 3476	976	{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe	92
PID 976 wrote to memory of 1656	976	{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe	93
PID 3476 wrote to memory of 2316	3476	{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe	94
PID 3476 wrote to memory of 2612	3476	{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe	95
PID 2316 wrote to memory of 4608	2316	{83C75A99-5628-40c7-A430-D9AC735797F8}.exe	102
PID 2316 wrote to memory of 2740	2316	{83C75A99-5628-40c7-A430-D9AC735797F8}.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-07-30_5c9caa2e6c7c0ef88114af3fe3060908_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_5c9caa2e6c7c0ef88114af3fe3060908_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Windows\{80323144-A462-42b3-BC85-89113A12D93A}.exe
  C:\Windows\{80323144-A462-42b3-BC85-89113A12D93A}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3452
- - C:\Windows\{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe
    C:\Windows\{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:976
  - - C:\Windows\{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe
      C:\Windows\{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3476
    - - C:\Windows\{83C75A99-5628-40c7-A430-D9AC735797F8}.exe
        
        C:\Windows\{83C75A99-5628-40c7-A430-D9AC735797F8}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2316
      - C:\Windows\{76F0B12F-64B9-49e2-BFAF-BBB8CEA76ECE}.exe
        
        C:\Windows\{76F0B12F-64B9-49e2-BFAF-BBB8CEA76ECE}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4608
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{83C75~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2740
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{7E995~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{05B5F~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1656
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{80323~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe

Path C:\Windows\{05B5FB30-A91E-4da0-A49B-EB89534F6AB9}.exe
Size 79KB
SHA256 b92edb262153774d066d9074a08cda02fdbec2c4c82b897c4a2520a26fa994f4
MD5 a0bf00eb3fe5b5ade66b3a3d611d1c7a
SHA1 93867919c614fab76e1e8b14c7e403cd5dd3d419
SHA512 2e48b8b8b534791d273bd9564ea6ef74842f8d96266f20c4d347697c6704bcf37011ae81ce1280e8be8b2b4d190b979ad64ab2de0227d25e536c77ebb2237ff5
SSDEEP 768:4vw9816vhKQLrob4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0obloWMZ3izbR9Xwzz
TLSH
T17F834BC38E6C6483FED6297012A8DAAB7D3E97C65544B9976F90FC5408A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{76F0B12F-64B9-49e2-BFAF-BBB8CEA76ECE}.exe

Path C:\Windows\{76F0B12F-64B9-49e2-BFAF-BBB8CEA76ECE}.exe
Size 79KB
SHA256 441351b13b304908d9ac10ac761d9ae6844193c43bf1d0f801870532f890ddc6
MD5 526801cfc7258ba33fc8fe9779ee7fa2
SHA1 9a9679af39a42dacb48470b849cba898c4635839
SHA512 ba47fb232ad8d97cf21462c9347e33f850c1364582b2cd17e5332d00b391722ed96025ddd1b564994c5cf99c5fa40b982912440fae26b442794fac862078dd6f
SSDEEP 768:4vw9816vhKQLrow4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0owloWMZ3izbR9Xwzz
TLSH
T195834CC38E6C6483FED6297012A8DAA77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe

Path C:\Windows\{7E9954B4-9BF7-4f89-BB3A-D3829938BE4E}.exe
Size 79KB
SHA256 582bf51edd53ff7cb590e401c6541b5bcfbc734afe002a52e0311ac88f71664e
MD5 6dee2c588f27fc11f722e177a3f85353
SHA1 4a2ad88c244407933e4627daf2fb82d32bdbe31a
SHA512 3134fda92de563500d17bdfce79ce2a2b429469d8f39e359b728985ee011d74114d641f075b5b65a2a5ad01e21172b380dda9ae0c625032b962739856e81174c
SSDEEP 768:4vw9816vhKQLror4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0orloWMZ3izbR9Xwzz
TLSH
T181834BC38E6C6483FED6297012A8DAA77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{80323144-A462-42b3-BC85-89113A12D93A}.exe

Path C:\Windows\{80323144-A462-42b3-BC85-89113A12D93A}.exe
Size 79KB
SHA256 50937eb015142e6b47f312cf35e6c2b408ff4bfd2b03268ca4010174f43a4034
MD5 19f0f2f8ebfff943d16e2f54b952f4af
SHA1 fb9adcda5e9de78dcba067f8300e257e77b57caf
SHA512 3d638321da7384ad35c1a5dc053e8002f92a3a8d5ed43031169a67e94399dd49bb853d9c7de686caea520c36568f0b6010bc5cf328c5722244d790546eb2f497
SSDEEP 768:4vw9816vhKQLro94/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0o9loWMZ3izbR9Xwzz
TLSH
T19E834BC38E6C6483FED6297012A8DAA77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{83C75A99-5628-40c7-A430-D9AC735797F8}.exe

Path C:\Windows\{83C75A99-5628-40c7-A430-D9AC735797F8}.exe
Size 79KB
SHA256 df5808b4667ead12816b11353ddabe57d148ca81bd995fa9d9026c9545e3722b
MD5 78190fec4cc19bd5bcd1ebdd55784b08
SHA1 6a621f1efd21367a776fc5a246410c232630956e
SHA512 2723226e95b73fc9c87eacbd9318a008c3da1cf8db0dd87bbf14fcca061f8ff8573fc5d0ebdac00157ad7fdea80301f128ea4126fad282162ca61e029f7d14b0
SSDEEP 768:4vw9816vhKQLro+4/wQpWMZ3XOQ69zbjlAAX5e9zz:wEGh0o+loWMZ3izbR9Xwzz
TLSH
T1C9834BC38E6C6483FED6297012A8DAA77D3E97C65544B9976F90FC5808A33C1EB3811D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads