stormser | 13e0d03283fb0586c0960763f05a752cb431fcd8a6e73072b3e009ee0a58477c

General

Target
2026-08-08_8b4219083eacf819c651584d3a7fd320_elex_wannacry.exe
Size 79KB
Sample260808-krn5waxset
SHA256 13e0d03283fb0586c0960763f05a752cb431fcd8a6e73072b3e009ee0a58477c
MD5 8b4219083eacf819c651584d3a7fd320
SHA1 9ff01a94cb708b3f92080871723d158908dfdbd8
SHA512 336814a8cdfb0caf6eaf91c093d985e2a4adc38187ca50bbdf141351090c684142637155726820956dc6c9ac9c0af220f22409e9efaf90ba6635907e7399b69c
SSDEEP 768:4vw9816vhKQLro44/wQzXOQ69zbjlAAX5e9zz:wEGh0o4lGizbR9Xwzz
TLSH
T1A3835CD38EAC4483FDE6697012B8D9A77C3E97C61604B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 4 IoCs

resource	yara_rule
behavioral1/files/0x00030000000006d1-2.dat	family_stormser
behavioral1/files/0x00060000000167ed-6.dat	family_stormser
behavioral1/files/0x000200000001e76e-8.dat	family_stormser
behavioral1/files/0x00090000000167ed-14.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 8 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}	2026-08-08_8b4219083eacf819c651584d3a7fd320_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}\stubpath = "C:\\Windows\\{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe"	2026-08-08_8b4219083eacf819c651584d3a7fd320_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43043C76-C528-41dd-AA14-5902899D237C}	{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{43043C76-C528-41dd-AA14-5902899D237C}\stubpath = "C:\\Windows\\{43043C76-C528-41dd-AA14-5902899D237C}.exe"	{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}	{43043C76-C528-41dd-AA14-5902899D237C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}\stubpath = "C:\\Windows\\{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe"	{43043C76-C528-41dd-AA14-5902899D237C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CF47EBB-F50A-4547-AE2B-185FA6414658}	{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6CF47EBB-F50A-4547-AE2B-185FA6414658}\stubpath = "C:\\Windows\\{6CF47EBB-F50A-4547-AE2B-185FA6414658}.exe"	{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe

Executes dropped EXE 4 IoCs

pid	Process
5064	{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe
212	{43043C76-C528-41dd-AA14-5902899D237C}.exe
3876	{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe
3012	{6CF47EBB-F50A-4547-AE2B-185FA6414658}.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe	2026-08-08_8b4219083eacf819c651584d3a7fd320_elex_wannacry.exe
File created	C:\Windows\{43043C76-C528-41dd-AA14-5902899D237C}.exe	{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe
File created	C:\Windows\{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe	{43043C76-C528-41dd-AA14-5902899D237C}.exe
File created	C:\Windows\{6CF47EBB-F50A-4547-AE2B-185FA6414658}.exe	{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4532	cmd.exe
32	cmd.exe
940	cmd.exe
4832	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_8b4219083eacf819c651584d3a7fd320_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{43043C76-C528-41dd-AA14-5902899D237C}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6CF47EBB-F50A-4547-AE2B-185FA6414658}.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2396	2026-08-08_8b4219083eacf819c651584d3a7fd320_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	5064	{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe
Token: SeIncBasePriorityPrivilege	212	{43043C76-C528-41dd-AA14-5902899D237C}.exe
Token: SeIncBasePriorityPrivilege	3876	{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 5064	2396	2026-08-08_8b4219083eacf819c651584d3a7fd320_elex_wannacry.exe	91
PID 2396 wrote to memory of 4532	2396	2026-08-08_8b4219083eacf819c651584d3a7fd320_elex_wannacry.exe	92
PID 5064 wrote to memory of 212	5064	{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe	98
PID 5064 wrote to memory of 32	5064	{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe	99
PID 212 wrote to memory of 3876	212	{43043C76-C528-41dd-AA14-5902899D237C}.exe	105
PID 212 wrote to memory of 940	212	{43043C76-C528-41dd-AA14-5902899D237C}.exe	106
PID 3876 wrote to memory of 3012	3876	{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe	108
PID 3876 wrote to memory of 4832	3876	{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-08_8b4219083eacf819c651584d3a7fd320_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_8b4219083eacf819c651584d3a7fd320_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe
  C:\Windows\{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5064
- - C:\Windows\{43043C76-C528-41dd-AA14-5902899D237C}.exe
    C:\Windows\{43043C76-C528-41dd-AA14-5902899D237C}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Windows\{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe
      C:\Windows\{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3876
    - - C:\Windows\{6CF47EBB-F50A-4547-AE2B-185FA6414658}.exe
        
        C:\Windows\{6CF47EBB-F50A-4547-AE2B-185FA6414658}.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3012
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CF525~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4832
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{43043~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:940
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{D90D6~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:32
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{43043C76-C528-41dd-AA14-5902899D237C}.exe

Path C:\Windows\{43043C76-C528-41dd-AA14-5902899D237C}.exe
Size 79KB
SHA256 3f166042303f4fb3b9867297ec081abf3b27442f9d4639c54eb816cee510dab1
MD5 a45c00c835e9092a0b3b0308c2b594f3
SHA1 2b489d322fad785933a13b7ddd1abcb2592ab563
SHA512 bfa70f713f917bf7ed076bc547d7f6baebef41214a8389109b02ca14068fe476eaffe3ac88d5b412d2d29485dfe339bdbb14ba131eff43809b69ce1577328efe
SSDEEP 768:4vw9816vhKQLro54/wQzXOQ69zbjlAAX5e9zz:wEGh0o5lGizbR9Xwzz
TLSH
T1AA835CD38EAC4483FDE6697012B8D9A77C3E97C61504B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6CF47EBB-F50A-4547-AE2B-185FA6414658}.exe

Path C:\Windows\{6CF47EBB-F50A-4547-AE2B-185FA6414658}.exe
Size 79KB
SHA256 e79bd768b4298620af90f34cb494795a71301faf35d6d54bb78cded00feb65c0
MD5 e990e76d7e8e2b71dbb0b45390905d37
SHA1 c52c3f19570329af172771a4aaf67b337ae49fd8
SHA512 f6019883741d7936bb3c4cfac49f185d996d617ed7575ee0aee6da77b5c489dee570f5a25c2919b84951d145644034263d91bf40d7655092e418f5a6bf43f9ce
SSDEEP 768:4vw9816vhKQLroQ4/wQzXOQ69zbjlAAX5e9zz:wEGh0oQlGizbR9Xwzz
TLSH
T163835CD38EAC4483FDE6697012B8D9A77C3E97C61504B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe

Path C:\Windows\{CF525C14-5EA3-4fd3-A1A7-A25EDE2E03AB}.exe
Size 79KB
SHA256 1cb76e6d681770d5614b83dacca407e3d2f342ef822c2da4ccf3bbc4505cc341
MD5 b97ccfd53d1b71deacbb2f9fedc72a51
SHA1 7707d8fbd9cc846e0a3a7fc40d3b3d08bea3dcdf
SHA512 753a532aae61b9cca35b248898774fdcf6d4d60bfcb6fe8ccbb46d3ab7eb0354a943a9bc2289963dab0bc184e710739ca45ef03224ebb30ccda65d4f4daa435a
SSDEEP 768:4vw9816vhKQLroR4/wQzXOQ69zbjlAAX5e9zz:wEGh0oRlGizbR9Xwzz
TLSH
T1D8835CD38EAC4483FDE6697012B8D9A77C3E97C61604B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe

Path C:\Windows\{D90D67C4-7674-48dc-BD00-9A516EDCD9FA}.exe
Size 79KB
SHA256 d4002b4cc6c2141c62afa24d239433f6c4bd45699dec37392d7450b5d7918e40
MD5 8fff80bec004de7ccfe9b723037a0212
SHA1 be544023c84d5b171e06051e018be9aa959d6c18
SHA512 4c6418a35556ceb73c9c20eeb28b225be4931a1e213f9bdef0451d231acc752a343dc96eae31b52d2b052f4f69ab18ab5c20ddec63dafbae304a38bd772bef52
SSDEEP 768:4vw9816vhKQLroS4/wQzXOQ69zbjlAAX5e9zz:wEGh0oSlGizbR9Xwzz
TLSH
T10C835CD38EAC4483FDD6697012B8D9A77C3E97C61504B99B6B91FD5408A33C1EB3411E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads