stormser | b87a96df571efd3943e5264f2e6184f637788ee6c5345fa1841df333fdfb9f9d

General

Target
2026-09-05_5bfbe2acf5948fca0bafcd60c558b4f6_elex_wannacry.exe
Size 59KB
Sample260907-z2fc2sbd93
SHA256 b87a96df571efd3943e5264f2e6184f637788ee6c5345fa1841df333fdfb9f9d
MD5 5bfbe2acf5948fca0bafcd60c558b4f6
SHA1 808221b3e2846778f313f606447066137604dbeb
SHA512 d5a896311e55b1774d5e5999308ab2cbfce18fc7bdc30aa35442329493a7b50dc474665eb7dad98a82bc780553d179c5cef651188812422bd228409382cdaaaa
SSDEEP 192:MbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwJY04/CFxyNhoy5t:MbLwOs8AHsc4sMfwhKQLro74/CFsrd
TLSH
T1D543F8834BDE5CF2F791117108798AB9927B99D4950EBEDFBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 2 IoCs

resource	yara_rule
behavioral1/files/0x001300000001686a-2.dat	family_stormser
behavioral1/files/0x001f00000001b401-6.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{762469C6-E607-4011-91D9-17E516AB3F48}	2026-09-05_5bfbe2acf5948fca0bafcd60c558b4f6_elex_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{762469C6-E607-4011-91D9-17E516AB3F48}\stubpath = "C:\\Windows\\{762469C6-E607-4011-91D9-17E516AB3F48}.exe"	2026-09-05_5bfbe2acf5948fca0bafcd60c558b4f6_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97792AB1-AAA1-45c0-8BBD-16853A64CFC0}	{762469C6-E607-4011-91D9-17E516AB3F48}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{97792AB1-AAA1-45c0-8BBD-16853A64CFC0}\stubpath = "C:\\Windows\\{97792AB1-AAA1-45c0-8BBD-16853A64CFC0}.exe"	{762469C6-E607-4011-91D9-17E516AB3F48}.exe

Executes dropped EXE 2 IoCs

pid	Process
2220	{762469C6-E607-4011-91D9-17E516AB3F48}.exe
2308	{97792AB1-AAA1-45c0-8BBD-16853A64CFC0}.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\{762469C6-E607-4011-91D9-17E516AB3F48}.exe	2026-09-05_5bfbe2acf5948fca0bafcd60c558b4f6_elex_wannacry.exe
File created	C:\Windows\{97792AB1-AAA1-45c0-8BBD-16853A64CFC0}.exe	{762469C6-E607-4011-91D9-17E516AB3F48}.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3928	cmd.exe
4040	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{762469C6-E607-4011-91D9-17E516AB3F48}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{97792AB1-AAA1-45c0-8BBD-16853A64CFC0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_5bfbe2acf5948fca0bafcd60c558b4f6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2784	2026-09-05_5bfbe2acf5948fca0bafcd60c558b4f6_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	2220	{762469C6-E607-4011-91D9-17E516AB3F48}.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 2220	2784	2026-09-05_5bfbe2acf5948fca0bafcd60c558b4f6_elex_wannacry.exe	89
PID 2784 wrote to memory of 3928	2784	2026-09-05_5bfbe2acf5948fca0bafcd60c558b4f6_elex_wannacry.exe	90
PID 2220 wrote to memory of 2308	2220	{762469C6-E607-4011-91D9-17E516AB3F48}.exe	91
PID 2220 wrote to memory of 4040	2220	{762469C6-E607-4011-91D9-17E516AB3F48}.exe	92

C:\Users\Admin\AppData\Local\Temp\2026-09-05_5bfbe2acf5948fca0bafcd60c558b4f6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_5bfbe2acf5948fca0bafcd60c558b4f6_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Windows\{762469C6-E607-4011-91D9-17E516AB3F48}.exe
  C:\Windows\{762469C6-E607-4011-91D9-17E516AB3F48}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Windows\{97792AB1-AAA1-45c0-8BBD-16853A64CFC0}.exe
    C:\Windows\{97792AB1-AAA1-45c0-8BBD-16853A64CFC0}.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{76246~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-0~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{762469C6-E607-4011-91D9-17E516AB3F48}.exe

Path C:\Windows\{762469C6-E607-4011-91D9-17E516AB3F48}.exe
Size 59KB
SHA256 889065095f895deb6df0ce4c452ebca7067b9988875059b318dd25e9aef594a9
MD5 9a160b605ac4c99b89539209c9f83c8c
SHA1 8b7aa0421d48b967581d8ea92300c9d3fdff115a
SHA512 a6402e4a9aad6ae293225cd9ec70ed6a46b0b1fb05b178abe271cae187002af4fd5c2a1c27e67b4c8557f6b2a2f506ebba59db4514c2c9cb42e49e538e390189
SSDEEP 192:MbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwRY04/CFxyNhoy5t:MbLwOs8AHsc4sMfwhKQLroj4/CFsrd
TLSH
T18E43F7834BEE5CF2F7911131087D8AB9927B99D4950EBE9FBF90CD550037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{97792AB1-AAA1-45c0-8BBD-16853A64CFC0}.exe

Path C:\Windows\{97792AB1-AAA1-45c0-8BBD-16853A64CFC0}.exe
Size 59KB
SHA256 e81b07f4f2b21e5cc35690043558343755906a9451d414e96311a1f19c4d6100
MD5 0b120bed2a8a21aff832da1bdb44706d
SHA1 5bbb28b7f16e52ef2ed6ff99d3303bc4e966aac8
SHA512 70a6f42f7507acdb4eadb1bd9421e0e2113ef758319b74424a1d03ed9273665887dd1551b5de515ae601be75756050c2f383400b7c3db3420bff4af9acd5b385
SSDEEP 192:MbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwEY04/CFxyNhoy5t:MbLwOs8AHsc4sMfwhKQLroy4/CFsrd
TLSH
T19643F7835BEE9CF2F791113108798AB9927B99D4950EBE9FBF90CD150037292E53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads