stormser | 889c83d8476f79adbeeb6e53cc78efc1c0a5652db60e6ca9e9c4a3bee9da162c

General

Target
2026-08-14_06bfc6782d9dc2abc091ecae776b7b7d_elex_wannacry.exe
Size 59KB
Sample260814-capfbasfld
SHA256 889c83d8476f79adbeeb6e53cc78efc1c0a5652db60e6ca9e9c4a3bee9da162c
MD5 06bfc6782d9dc2abc091ecae776b7b7d
SHA1 53b6b6f168da5e385a445b97d233bd9fbcc217c7
SHA512 fb1b4e870dba3eec67f4e9ad5040798db7c84c617e21575ebcc3ec26640e9945b3139786ac1658093ad8361d726c4f9d6fc12d13088947321e6ad7bbd369ea8d
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwbyY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLrobI4/CFsrd
TLSH
T11543F8834BEE5CF2F791117108798AB9927B99D4950EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral1/files/0x000700000002443e-2.dat	family_stormser
behavioral1/files/0x000700000002443f-6.dat	family_stormser
behavioral1/files/0x0007000000024454-8.dat	family_stormser
behavioral1/files/0x000800000002443f-14.dat	family_stormser
behavioral1/files/0x000f000000024455-19.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0895B724-3A16-45d4-9739-AEF366C40A1F}	{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{629BC892-51FC-46f7-A9E9-C757540B02A5}	{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD61B234-0C0B-4777-B0FC-F76BD41AC3E2}	{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81A2F853-EA8C-447e-BB67-49EA84D3E08B}\stubpath = "C:\\Windows\\{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe"	2026-08-14_06bfc6782d9dc2abc091ecae776b7b7d_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4BD43F1-C49E-47ac-8947-D910EA0EF297}	{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0895B724-3A16-45d4-9739-AEF366C40A1F}\stubpath = "C:\\Windows\\{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe"	{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{629BC892-51FC-46f7-A9E9-C757540B02A5}\stubpath = "C:\\Windows\\{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe"	{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{FD61B234-0C0B-4777-B0FC-F76BD41AC3E2}\stubpath = "C:\\Windows\\{FD61B234-0C0B-4777-B0FC-F76BD41AC3E2}.exe"	{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{81A2F853-EA8C-447e-BB67-49EA84D3E08B}	2026-08-14_06bfc6782d9dc2abc091ecae776b7b7d_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B4BD43F1-C49E-47ac-8947-D910EA0EF297}\stubpath = "C:\\Windows\\{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe"	{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe

Executes dropped EXE 5 IoCs

pid	Process
4216	{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe
4620	{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe
1716	{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe
1048	{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe
3252	{FD61B234-0C0B-4777-B0FC-F76BD41AC3E2}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe	{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe
File created	C:\Windows\{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe	{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe
File created	C:\Windows\{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe	{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe
File created	C:\Windows\{FD61B234-0C0B-4777-B0FC-F76BD41AC3E2}.exe	{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe
File created	C:\Windows\{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe	2026-08-14_06bfc6782d9dc2abc091ecae776b7b7d_elex_wannacry.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4636	cmd.exe
4556	cmd.exe
1972	cmd.exe
756	cmd.exe
2684	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_06bfc6782d9dc2abc091ecae776b7b7d_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{FD61B234-0C0B-4777-B0FC-F76BD41AC3E2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4776	2026-08-14_06bfc6782d9dc2abc091ecae776b7b7d_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4216	{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe
Token: SeIncBasePriorityPrivilege	4620	{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe
Token: SeIncBasePriorityPrivilege	1716	{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe
Token: SeIncBasePriorityPrivilege	1048	{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4776 wrote to memory of 4216	4776	2026-08-14_06bfc6782d9dc2abc091ecae776b7b7d_elex_wannacry.exe	90
PID 4776 wrote to memory of 4636	4776	2026-08-14_06bfc6782d9dc2abc091ecae776b7b7d_elex_wannacry.exe	91
PID 4216 wrote to memory of 4620	4216	{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe	96
PID 4216 wrote to memory of 4556	4216	{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe	97
PID 4620 wrote to memory of 1716	4620	{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe	105
PID 4620 wrote to memory of 1972	4620	{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe	106
PID 1716 wrote to memory of 1048	1716	{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe	107
PID 1716 wrote to memory of 756	1716	{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe	108
PID 1048 wrote to memory of 3252	1048	{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe	109
PID 1048 wrote to memory of 2684	1048	{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-14_06bfc6782d9dc2abc091ecae776b7b7d_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_06bfc6782d9dc2abc091ecae776b7b7d_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776
- C:\Windows\{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe
  C:\Windows\{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4216
- - C:\Windows\{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe
    C:\Windows\{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe
      C:\Windows\{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1716
    - - C:\Windows\{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe
        
        C:\Windows\{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1048
      - C:\Windows\{FD61B234-0C0B-4777-B0FC-F76BD41AC3E2}.exe
        
        C:\Windows\{FD61B234-0C0B-4777-B0FC-F76BD41AC3E2}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3252
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{629BC~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:2684
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{0895B~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:756
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{B4BD4~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:1972
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{81A2F~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe

Path C:\Windows\{0895B724-3A16-45d4-9739-AEF366C40A1F}.exe
Size 59KB
SHA256 d1d69b220aa6c962e685bf426c0119a03d8d9bf39c9fb527677e12161448d7f4
MD5 44abd6ffd6210d1782f7bffe5d1ce72e
SHA1 e210a7c0f46dc0162dfdeaaadc3bc6b6c7c7726f
SHA512 9a4096bf3b13194b0f436cbb4312b1b5e6d021957eb254f4cfeddb295bd8362a7c776dc33298d4bf01ebb7bc6f3b3e3cd92f8811913ba355ff07993d1cedb57e
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw9Y04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLrov4/CFsrd
TLSH
T1004309834BEE5CF2F791123108794AB9927B99D4910EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe

Path C:\Windows\{629BC892-51FC-46f7-A9E9-C757540B02A5}.exe
Size 59KB
SHA256 5ad9ba9b00dd577355cb06f53aba5017f601e71cf05f0a2ddb81183f1f570c34
MD5 6070e6069f0e9015b842c76f8b248773
SHA1 0e4470040b287ac8cd4e62140399c1f8380a4cba
SHA512 72376580a54898e661112818211231ddef3576d58da7a48edc600008e4b1d1227a1e9aae14ccda33f16df130c6e033f9c3164a542d3d109f34555bfec19a9662
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwEY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLroy4/CFsrd
TLSH
T14743F8834BEE5CF2F7911271087D8AB9927B99D4950EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe

Path C:\Windows\{81A2F853-EA8C-447e-BB67-49EA84D3E08B}.exe
Size 59KB
SHA256 6223bf5a0d17e3d1beb6399443604859795d7aa7c1714f2a1792a092287328d7
MD5 dbff00520e213f81bc87ff5c0f14d8f8
SHA1 c3c08aa0d7490b99d2a7803df54341ed301fcbdb
SHA512 b4fe1719cdce5ed4e0b9f9f7e8db763ec2039ebbab35e7c39ddf83b9ce45f8a635443866329ab0ce2ee93403ab6dca8c587fad03b6471ed2941a9dfbe111cd1f
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwXY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLrop4/CFsrd
TLSH
T16F4308834BEE5CF2F791127108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe

Path C:\Windows\{B4BD43F1-C49E-47ac-8947-D910EA0EF297}.exe
Size 59KB
SHA256 83ba8ae2ca950b982fafce994a6b662ea9c0cff2ed2bada15da3b45eb851553d
MD5 4b83078218c635afe33495c7fd751601
SHA1 94b0eeb470c12a9383e5af29a63a0d0aa1fa489d
SHA512 f0fc9a73e468bc427351686e42cbe310e30f61d1b1c49f16eaf86064d398c816e716f60b66d572140f5585e03daae2b1e0ca50c5b2c963697bdad3e5fe080b11
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwpY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLrob4/CFsrd
TLSH
T1524309834BEE9CF2F791117108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{FD61B234-0C0B-4777-B0FC-F76BD41AC3E2}.exe

Path C:\Windows\{FD61B234-0C0B-4777-B0FC-F76BD41AC3E2}.exe
Size 59KB
SHA256 05d71115b099117e7d0ba59710f2141dcd90f5588af4592892a66e14e1e92334
MD5 ee8dced5277277b07a91bd69b4a8f6e9
SHA1 6f86e2fa09b3175281c228537876c292b852c8c0
SHA512 e106713f934dc21c1d45d1e0e866b4c2048f231ba0b2f178f2a3c3eeff764f0ddcfd86d987eac2d13bdbbce0c4f8044af3d9b180245170fa2faad40f92a979d2
SSDEEP 192:vbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwHY04/CFxyNhoy5t:vbLwOs8AHsc4sMfwhKQLro54/CFsrd
TLSH
T19F4307834BEE9CF2F791117108798BB9927B99D4910EBEDFBB90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads