stormser | 6d0b693b3b33714186be5a5a791f301b17e6937d089e16ca512c75f3fde13aa0

General

Target
2026-07-31_8886ffab061507842f8186a9843f455d_elex_wannacry.exe
Size 168KB
Sample260731-gce2wavekd
SHA256 6d0b693b3b33714186be5a5a791f301b17e6937d089e16ca512c75f3fde13aa0
MD5 8886ffab061507842f8186a9843f455d
SHA1 44a6878a5433bb90bd2553ed155cbd1b8f34f923
SHA512 1012af032475adbf1d736a4a1a2cea3fe6feef6843877275ef0872c912e186b419e1fde740a054a49f62f28a6796d6d74fc41acf7ebc04f0eb34876d43c01dfc
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw24/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro24/CFsrd
TLSH
T183F31A834BDE58F3FB81113008798AB9927B9AD4961DBEEF7F90CD250077292D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 2 IoCs

resource	yara_rule
behavioral1/files/0x000700000002447f-2.dat	family_stormser
behavioral1/files/0x0007000000024480-6.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C44EA61C-DC5D-4458-A273-6EB82FD504A1}	2026-07-31_8886ffab061507842f8186a9843f455d_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{C44EA61C-DC5D-4458-A273-6EB82FD504A1}\stubpath = "C:\\Windows\\{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe"	2026-07-31_8886ffab061507842f8186a9843f455d_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DCEB277-BC36-4284-BE49-8DD141B91060}	{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6DCEB277-BC36-4284-BE49-8DD141B91060}\stubpath = "C:\\Windows\\{6DCEB277-BC36-4284-BE49-8DD141B91060}.exe"	{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe

Executes dropped EXE 2 IoCs

pid	Process
4008	{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe
2316	{6DCEB277-BC36-4284-BE49-8DD141B91060}.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe	2026-07-31_8886ffab061507842f8186a9843f455d_elex_wannacry.exe
File created	C:\Windows\{6DCEB277-BC36-4284-BE49-8DD141B91060}.exe	{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3900	cmd.exe
3956	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6DCEB277-BC36-4284-BE49-8DD141B91060}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_8886ffab061507842f8186a9843f455d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2960	2026-07-31_8886ffab061507842f8186a9843f455d_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4008	{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 4008	2960	2026-07-31_8886ffab061507842f8186a9843f455d_elex_wannacry.exe	97
PID 2960 wrote to memory of 3900	2960	2026-07-31_8886ffab061507842f8186a9843f455d_elex_wannacry.exe	98
PID 4008 wrote to memory of 2316	4008	{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe	99
PID 4008 wrote to memory of 3956	4008	{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-07-31_8886ffab061507842f8186a9843f455d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_8886ffab061507842f8186a9843f455d_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Windows\{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe
  C:\Windows\{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\{6DCEB277-BC36-4284-BE49-8DD141B91060}.exe
    C:\Windows\{6DCEB277-BC36-4284-BE49-8DD141B91060}.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2316
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{C44EA~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3956
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{6DCEB277-BC36-4284-BE49-8DD141B91060}.exe

Path C:\Windows\{6DCEB277-BC36-4284-BE49-8DD141B91060}.exe
Size 168KB
SHA256 05c11511ce496b7f02a7d3023eddaf2c6d4ec2f269642fb5069f6ea6449eb7c5
MD5 c9d63f9ff72c3a25e1cb1fd0988eae55
SHA1 f31c947b8cfd6978a4f10230452c8e199d2ce1d1
SHA512 dbc656316ca24a51a71ae8b523f9f85b08de9dfcb062c87330d348ef8427b32fc1b8976738a8b66d7e27750bc1b9de7d2136128b3fc8b1df0c4b4c8536dff77b
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwr4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLror4/CFsrd
TLSH
T131F319834BDE58F3FB81113008798AB9927B9AD4961DBEEF7F90CD250077291D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe

Path C:\Windows\{C44EA61C-DC5D-4458-A273-6EB82FD504A1}.exe
Size 168KB
SHA256 38dd531f00fb743aa411db846ec4be2bc24abe65746787d1e8bd05905b033b0c
MD5 f0cd3cd5a67739e62429da025ffad374
SHA1 602888e9d8ee513a9a3be0f06721bd1772d5e66a
SHA512 9b0d0fd4585dd8dde4199996b333f0a1eeebb1456240c2f99157c28828633784f00de96f011783386663f0986a192542cabf704bf8436d5bfed5e44d76e96563
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwq4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroq4/CFsrd
TLSH
T13FF319834BDE58F3FB81113008798AB9927B9AD4961EBEEF7F90CD250077252D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads