stormser | c40ac9cbd798ea2195e7e28c8a792235ad36996f43212c671882f940e8edb225

General

Target
2026-08-09_5dfd17b04353554984f5bd9d2e4062a6_elex_wannacry.exe
Size 60KB
Sample260809-k5sp8avbld
SHA256 c40ac9cbd798ea2195e7e28c8a792235ad36996f43212c671882f940e8edb225
MD5 5dfd17b04353554984f5bd9d2e4062a6
SHA1 a52e17dfd8ef6a2a51fd44f6bd0fbd82df72150f
SHA512 132f7d2cb5f84ac8111571b2756a37f268e22a99a28030bf841a9f91557bf09a1aceb3b14b88de6059cfeff3779813c632972fa3e070590eefb432ac7a112f58
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw8Y04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroK4/CFsrd
TLSH
T1CC5308834BDE9CF2F791113108798AB9927B99D4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral1/files/0x000400000001da74-2.dat	family_stormser
behavioral1/files/0x000b00000001db0e-6.dat	family_stormser
behavioral1/files/0x001400000001db5f-10.dat	family_stormser
behavioral1/files/0x000500000001e694-14.dat	family_stormser
behavioral1/files/0x000300000001e0be-18.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}	2026-08-09_5dfd17b04353554984f5bd9d2e4062a6_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}\stubpath = "C:\\Windows\\{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe"	{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58CB5A44-7982-469e-9E84-6B5294B436D7}\stubpath = "C:\\Windows\\{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe"	{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}	{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}\stubpath = "C:\\Windows\\{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe"	{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{798221C5-CB09-4596-BA8B-74CF4482B15B}	{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{798221C5-CB09-4596-BA8B-74CF4482B15B}\stubpath = "C:\\Windows\\{798221C5-CB09-4596-BA8B-74CF4482B15B}.exe"	{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}\stubpath = "C:\\Windows\\{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe"	2026-08-09_5dfd17b04353554984f5bd9d2e4062a6_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}	{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{58CB5A44-7982-469e-9E84-6B5294B436D7}	{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe

Executes dropped EXE 5 IoCs

pid	Process
2652	{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe
4220	{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe
964	{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe
4512	{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe
4356	{798221C5-CB09-4596-BA8B-74CF4482B15B}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe	2026-08-09_5dfd17b04353554984f5bd9d2e4062a6_elex_wannacry.exe
File created	C:\Windows\{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe	{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe
File created	C:\Windows\{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe	{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe
File created	C:\Windows\{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe	{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe
File created	C:\Windows\{798221C5-CB09-4596-BA8B-74CF4482B15B}.exe	{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4944	cmd.exe
2184	cmd.exe
3852	cmd.exe
2272	cmd.exe
3444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{798221C5-CB09-4596-BA8B-74CF4482B15B}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_5dfd17b04353554984f5bd9d2e4062a6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4772	2026-08-09_5dfd17b04353554984f5bd9d2e4062a6_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2652	{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe
Token: SeIncBasePriorityPrivilege	4220	{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe
Token: SeIncBasePriorityPrivilege	964	{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe
Token: SeIncBasePriorityPrivilege	4512	{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2652	4772	2026-08-09_5dfd17b04353554984f5bd9d2e4062a6_elex_wannacry.exe	95
PID 4772 wrote to memory of 4944	4772	2026-08-09_5dfd17b04353554984f5bd9d2e4062a6_elex_wannacry.exe	96
PID 2652 wrote to memory of 4220	2652	{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe	100
PID 2652 wrote to memory of 2184	2652	{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe	101
PID 4220 wrote to memory of 964	4220	{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe	103
PID 4220 wrote to memory of 3852	4220	{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe	104
PID 964 wrote to memory of 4512	964	{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe	106
PID 964 wrote to memory of 2272	964	{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe	107
PID 4512 wrote to memory of 4356	4512	{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe	108
PID 4512 wrote to memory of 3444	4512	{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-09_5dfd17b04353554984f5bd9d2e4062a6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_5dfd17b04353554984f5bd9d2e4062a6_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe
  C:\Windows\{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe
    C:\Windows\{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4220
  - - C:\Windows\{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe
      C:\Windows\{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:964
    - - C:\Windows\{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe
        
        C:\Windows\{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4512
      - C:\Windows\{798221C5-CB09-4596-BA8B-74CF4482B15B}.exe
        
        C:\Windows\{798221C5-CB09-4596-BA8B-74CF4482B15B}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:4356
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{98A2F~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3444
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{58CB5~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2272
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{DAE13~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3852
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{45E04~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe

Path C:\Windows\{45E046A5-077A-4c08-9DBD-DFFF9D5A15DA}.exe
Size 60KB
SHA256 a21954d80d5da4f22361264611d6dbab4e20a602407799dcdb98708f61bd717c
MD5 4060f58b05fe3b52724193b044c4cf25
SHA1 a465756dc9ca0d49ee4811d1679d81b24e0124bd
SHA512 755ad5a4ca1b004fd17aefcd38352d160fa8134b6379e4dbe75e9c0a439a8c6dbd9ae7de90b2861f1cf7536abb7fc0d007adcc609ec4dad3f8a59c623dd223b5
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwfY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroR4/CFsrd
TLSH
T1165309834BDE5CF2F791117108798AB9927B99C4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe

Path C:\Windows\{58CB5A44-7982-469e-9E84-6B5294B436D7}.exe
Size 60KB
SHA256 794ed7a22dc4fcbc738a8e91b52fa995b132ade6e1f4fc8cfb5f2a24eed03d01
MD5 4eaf1ad2cda8e4add7d34fe3cb279e03
SHA1 2df0ab74b59215be4f9a934beb7924b8e53e5d7a
SHA512 0892a60387812dc530a8f690c1163297f67dffbc96e0c6af364edb643ea6312bda5b929c26556e2177998be5849a829633792b1acacbf2d8ffe4f95e5b646556
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwKY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrog4/CFsrd
TLSH
T1455308834BEE5CF2F791117108798AB9927B9AC4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{798221C5-CB09-4596-BA8B-74CF4482B15B}.exe

Path C:\Windows\{798221C5-CB09-4596-BA8B-74CF4482B15B}.exe
Size 60KB
SHA256 b698c2549dbd1e53d29ef689adcd091bf30ff574802c89ab9849ddae55018f83
MD5 c031ed1e558863bb759b1f660b61997e
SHA1 f05fd3c5f75e21b1c87e58fcc245f8568d2903ce
SHA512 f0d1d01cb57d3c277f07228b12bee3efec21131cf54ad4e4d80f3f974da1c1545c0d7dcbd1f4a044ec7e03451ab9d48ff5746f1588d27f6120953c1b4fe91dc9
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw4nY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro4Z4/CFsrd
TLSH
T16A5309834BDE5CF2F791113108798AB9927BA9C4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe

Path C:\Windows\{98A2F645-A0DF-4cbb-99EF-3C2101A9F823}.exe
Size 60KB
SHA256 df7adbadfb8b3368e159bca89532a9fee56685d1b701025063de68511705d083
MD5 0f274b0f52508f5ccd3009d2e99010b4
SHA1 49c4eeb3e1ea3abe6e6fcff89dc39d65b06eb726
SHA512 2167b07e49de6c78be26a47cbf45d18eb2342c908ae6c8550abd713717d797b54741a7c94edab167fa931381420b53cb4499fa32b05f64dcc8f5bfeb74ab0280
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwLY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrot4/CFsrd
TLSH
T1755309834BEE9CF2F791117108794AB9927B99C4950EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe

Path C:\Windows\{DAE13BA1-3409-4f7b-AF12-00E21E5CB2CA}.exe
Size 60KB
SHA256 ef23cf5acc39f578c85bc4a90e7bbc0badece66f7111aaacab5d9f386e24d90c
MD5 a8e518da670ecd2a704e56a3de1a8330
SHA1 e329c2e2782b8c608bb9121d07f81eed6d3e9a46
SHA512 828d1c1b5faca9383a969a99419bdf073328f1e71500e1bbc49f577921db1a8ec344f977f43e4710e086bf507e535fd96b3c3c6eba179f9234838a2213aafcfb
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw1WY04/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro1c4/CFsrd
TLSH
T1A75308834BDE5CF2F791123108798AB9927B99C4910EBEDFBF90CD154037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads