stormser | c613d2b3032b619f9c5e8244531c178b4dd497634ee73e5297fc784543421c5e

General

Target
2026-08-16_2f5e478a6bc2dd8c44be6c4a80a58077_elex_wannacry.exe
Size 60KB
Sample260816-w1zthsvbme
SHA256 c613d2b3032b619f9c5e8244531c178b4dd497634ee73e5297fc784543421c5e
MD5 2f5e478a6bc2dd8c44be6c4a80a58077
SHA1 7f51f05d559429045982e3b192befc49f367e2c6
SHA512 f2c12ba0ec01dc288674fc100c4f1300fc2dd1c0cfc4d3b1d48a446302d6d39583f272191daea2306b5a046788b8b65bc0f96a97ea8894788c2a8e24fdea6c12
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwrY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroN4/CFsrd
TLSH
T14053F9834BDE9CF2F791123108794AB9927B9AD4910EBE9FBF90CD540037692E53E14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral1/files/0x000300000001e698-2.dat	family_stormser
behavioral1/files/0x000300000001e6da-6.dat	family_stormser
behavioral1/files/0x000b0000000242c8-8.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}\stubpath = "C:\\Windows\\{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe"	2026-08-16_2f5e478a6bc2dd8c44be6c4a80a58077_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}	{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}\stubpath = "C:\\Windows\\{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe"	{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3B5BB7E-9DD1-4926-A475-3BF7491AE3F3}	{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B3B5BB7E-9DD1-4926-A475-3BF7491AE3F3}\stubpath = "C:\\Windows\\{B3B5BB7E-9DD1-4926-A475-3BF7491AE3F3}.exe"	{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}	2026-08-16_2f5e478a6bc2dd8c44be6c4a80a58077_elex_wannacry.exe

Executes dropped EXE 3 IoCs

pid	Process
2536	{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe
2408	{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe
4456	{B3B5BB7E-9DD1-4926-A475-3BF7491AE3F3}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{B3B5BB7E-9DD1-4926-A475-3BF7491AE3F3}.exe	{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe
File created	C:\Windows\{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe	2026-08-16_2f5e478a6bc2dd8c44be6c4a80a58077_elex_wannacry.exe
File created	C:\Windows\{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe	{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4828	cmd.exe
3476	cmd.exe
872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{B3B5BB7E-9DD1-4926-A475-3BF7491AE3F3}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_2f5e478a6bc2dd8c44be6c4a80a58077_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4336	2026-08-16_2f5e478a6bc2dd8c44be6c4a80a58077_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2536	{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe
Token: SeIncBasePriorityPrivilege	2408	{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 2536	4336	2026-08-16_2f5e478a6bc2dd8c44be6c4a80a58077_elex_wannacry.exe	86
PID 4336 wrote to memory of 872	4336	2026-08-16_2f5e478a6bc2dd8c44be6c4a80a58077_elex_wannacry.exe	87
PID 2536 wrote to memory of 2408	2536	{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe	88
PID 2536 wrote to memory of 4828	2536	{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe	89
PID 2408 wrote to memory of 4456	2408	{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe	92
PID 2408 wrote to memory of 3476	2408	{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe	93

C:\Users\Admin\AppData\Local\Temp\2026-08-16_2f5e478a6bc2dd8c44be6c4a80a58077_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_2f5e478a6bc2dd8c44be6c4a80a58077_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Windows\{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe
  C:\Windows\{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2536
- - C:\Windows\{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe
    C:\Windows\{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2408
  - - C:\Windows\{B3B5BB7E-9DD1-4926-A475-3BF7491AE3F3}.exe
      C:\Windows\{B3B5BB7E-9DD1-4926-A475-3BF7491AE3F3}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:4456
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{8AE76~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:3476
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{CFC54~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe

Path C:\Windows\{8AE765DE-7004-415a-B5B8-F51D5C70C4D1}.exe
Size 60KB
SHA256 7721d82845d47e47303b852f7bfbd1d7d56f85802790b0279697955d8dc98de9
MD5 037af5bddaa21f733027e107f035e071
SHA1 08f10f3fa7b9e7a721b86e0c4d70f517140b819b
SHA512 ceba84b501c23d88c09858f6d996d547dbe3b44d761b55772eecade7edb6e42e5f862a1320ce0cc72aec5408a47acfb4af98026bdde6df546af9b014cef671a8
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwxY04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroD4/CFsrd
TLSH
T1515309834BDE5CF2F795123108794AB9927B9AC4910EBE9FBF90CD540037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{B3B5BB7E-9DD1-4926-A475-3BF7491AE3F3}.exe

Path C:\Windows\{B3B5BB7E-9DD1-4926-A475-3BF7491AE3F3}.exe
Size 60KB
SHA256 fcdf141baad10cce573db5b34b6e7e0555a12499c0be847f4efe3b3c53a840a0
MD5 c7dacd2bd67cf08f82205f8b0578fe16
SHA1 4064b0d2d5ab5cad9b67fd8b65fe540268298df7
SHA512 0a37f3cb93492433ba8a6107caac6c6259f71b3621df877621b473a2fdcbee4d17b9b94c4335e8beec8fbb5d6bf8e000b01650df9a715c1242b8906922083fe7
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw0Y04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroC4/CFsrd
TLSH
T14B5309834BDE9CF2F795123108794AB9927B9AC4910EBE9FBF90CD540037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe

Path C:\Windows\{CFC54412-2D6F-45c4-ADCD-F91C58E61CD0}.exe
Size 60KB
SHA256 fea6d381fd96917a846d0fcdf82cf6ce5d94546bf0df17e6d7de6537ff8c74f6
MD5 1d66395b518627e5c3c20d6dfd920a61
SHA1 29d25b4265549add394d545746a95776986ddc5c
SHA512 6c1b8ab43fae800beb4ece5b46fdd0ba678f5f3a636e01937bd09e110263592c89ec382d4dc58449e4c48a3867e43b871cfc38c9a92406a862cfa4272fa00675
SSDEEP 192:XbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqw3Y04/CFxyNhoy5t:XbLwOs8AHsc4sMfwhKQLroJ4/CFsrd
TLSH
T148530A834BDE5CF2F795123108794AB9927B99D4910EBE9FBF90CE540037692E53E10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads