stormser | fd67ff90ccc0059c65fbf2648db774d4fb245f7c22ecd7c24ed089e2b35d4e39

General

Target
2026-10-30_b669b16d94d162ef50a767498774964b_elex_wannacry.exe
Size 168KB
Sample261030-xls8vsfc92
SHA256 fd67ff90ccc0059c65fbf2648db774d4fb245f7c22ecd7c24ed089e2b35d4e39
MD5 b669b16d94d162ef50a767498774964b
SHA1 08d2d273b7a2b0807f7daeb9d1cfbb5cf2d7e8f0
SHA512 69f33369c32e2cda3c2c5ddbecb381211abe78c1365ebd5d66f5e4cf9e0e5caf092f2737fe9ca01971765c2420181c3829835f3de927c945c82c72ce9045d1bb
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwgUr4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrotr4/CFsrd
TLSH
T13DF319834BDE5CF3FB91113008798AB9927B99D4960EBEEF7B90CD250077292D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 5 IoCs

resource	yara_rule
behavioral1/files/0x000f0000000244a8-2.dat	family_stormser
behavioral1/files/0x0018000000024401-5.dat	family_stormser
behavioral1/files/0x00080000000244b0-10.dat	family_stormser
behavioral1/files/0x0019000000024401-15.dat	family_stormser
behavioral1/files/0x00040000000006d9-18.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 10 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1CACE40-20EB-476e-B403-0A97072ECB31}	{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6ABB5D50-A0C4-4b30-BDF8-A84B927A33B0}\stubpath = "C:\\Windows\\{6ABB5D50-A0C4-4b30-BDF8-A84B927A33B0}.exe"	{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50630F14-7B0E-46dc-A18C-802D964F63A2}	2026-10-30_b669b16d94d162ef50a767498774964b_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0C0118A-C23E-47ac-9B60-A447C767C6AA}	{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{E0C0118A-C23E-47ac-9B60-A447C767C6AA}\stubpath = "C:\\Windows\\{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe"	{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1CACE40-20EB-476e-B403-0A97072ECB31}\stubpath = "C:\\Windows\\{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe"	{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6ABB5D50-A0C4-4b30-BDF8-A84B927A33B0}	{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{50630F14-7B0E-46dc-A18C-802D964F63A2}\stubpath = "C:\\Windows\\{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe"	2026-10-30_b669b16d94d162ef50a767498774964b_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}	{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}\stubpath = "C:\\Windows\\{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe"	{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe

Executes dropped EXE 5 IoCs

pid	Process
4864	{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe
3892	{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe
208	{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe
4636	{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe
3852	{6ABB5D50-A0C4-4b30-BDF8-A84B927A33B0}.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe	2026-10-30_b669b16d94d162ef50a767498774964b_elex_wannacry.exe
File created	C:\Windows\{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe	{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe
File created	C:\Windows\{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe	{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe
File created	C:\Windows\{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe	{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe
File created	C:\Windows\{6ABB5D50-A0C4-4b30-BDF8-A84B927A33B0}.exe	{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3464	cmd.exe
3368	cmd.exe
212	cmd.exe
4480	cmd.exe
3160	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-30_b669b16d94d162ef50a767498774964b_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{6ABB5D50-A0C4-4b30-BDF8-A84B927A33B0}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4208	2026-10-30_b669b16d94d162ef50a767498774964b_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	4864	{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe
Token: SeIncBasePriorityPrivilege	3892	{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe
Token: SeIncBasePriorityPrivilege	208	{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe
Token: SeIncBasePriorityPrivilege	4636	{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 4864	4208	2026-10-30_b669b16d94d162ef50a767498774964b_elex_wannacry.exe	93
PID 4208 wrote to memory of 3464	4208	2026-10-30_b669b16d94d162ef50a767498774964b_elex_wannacry.exe	94
PID 4864 wrote to memory of 3892	4864	{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe	95
PID 4864 wrote to memory of 3368	4864	{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe	96
PID 3892 wrote to memory of 208	3892	{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe	100
PID 3892 wrote to memory of 212	3892	{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe	101
PID 208 wrote to memory of 4636	208	{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe	102
PID 208 wrote to memory of 4480	208	{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe	103
PID 4636 wrote to memory of 3852	4636	{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe	104
PID 4636 wrote to memory of 3160	4636	{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-10-30_b669b16d94d162ef50a767498774964b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_b669b16d94d162ef50a767498774964b_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Windows\{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe
  C:\Windows\{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Windows\{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe
    C:\Windows\{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe
      C:\Windows\{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe
      4⤵
      Boot or Logon Autostart Execution: Active Setup
      Executes dropped EXE
      Drops file in Windows directory
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:208
    - - C:\Windows\{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe
        
        C:\Windows\{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe
        5⤵
        Boot or Logon Autostart Execution: Active Setup
        Executes dropped EXE
        Drops file in Windows directory
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4636
      - C:\Windows\{6ABB5D50-A0C4-4b30-BDF8-A84B927A33B0}.exe
        
        C:\Windows\{6ABB5D50-A0C4-4b30-BDF8-A84B927A33B0}.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3852
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A1CAC~1.EXE > nul
        6⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:3160
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{E0C01~1.EXE > nul
        5⤵
        Executes a command shell one-liner
        System Location Discovery: System Language Discovery
        
        PID:4480
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{F0F6F~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:212
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{50630~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe

Path C:\Windows\{50630F14-7B0E-46dc-A18C-802D964F63A2}.exe
Size 168KB
SHA256 462eff003719046f42682e2243a8a9585e7cac2705a0340e7ef71e0bcc480bfc
MD5 d33cb9879e5db0fca223c15468d8234d
SHA1 b7e897b7ceee405eb0b364e123329cb905770c3e
SHA512 182150fcfc5797ed2265389ed5e0e36a34864074a07d7f900fb19c6aff334a838d924a50c98b2f86822ddc01dc7f4d9a555a31f70df242de5184fd3a7f744e06
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwcUr4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroBr4/CFsrd
TLSH
T1DAF309834BDE5CF3FB91113008798AB9927B99D4960EBEEF7B90CD250077292D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{6ABB5D50-A0C4-4b30-BDF8-A84B927A33B0}.exe

Path C:\Windows\{6ABB5D50-A0C4-4b30-BDF8-A84B927A33B0}.exe
Size 168KB
SHA256 acc6e96244851e08e06361b03cd1ecf980dc4d69c0d20c2d95dd58df849e0f99
MD5 42835acf4878d5db07dc98a2df4da81a
SHA1 599af55e80a164df5a070a022cf353b081d37126
SHA512 72ad03495f599fd063315411dec7e1862295244c228a77496ac1f0b04db820718cb150fa839c16575f8cfd25f3e659cb53e09facfee6505dd184332081fc82ee
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwIUr4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroFr4/CFsrd
TLSH
T1C6F309834BDE5CF3FB911130087D8AB9927B99D4960EBEEF6B90CD250077291D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe

Path C:\Windows\{A1CACE40-20EB-476e-B403-0A97072ECB31}.exe
Size 168KB
SHA256 980a3766e7d6c8b3306ceb79f1c0237982298118934331d1a366de7f5afd0cd1
MD5 bc04ba9dfe80c9ac1c33c015c57e7711
SHA1 0e235b2de7846cd8b6f6810f413ccebbf9a9c111
SHA512 a0d3f50562853bfad9f94b32e2a4f6d300c0946182df19b6f8eb803c2413cfff338bf608e9ef66285048014e9ac51c33673e154c9581e2ecbf53fe4b6a608af3
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwsUr4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLroRr4/CFsrd
TLSH
T19CF309834BDE5CF3FB91113008798AB9927B99D4960EBEEF6F90CD250077291D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe

Path C:\Windows\{E0C0118A-C23E-47ac-9B60-A447C767C6AA}.exe
Size 168KB
SHA256 58d8792e4664c0c86eb3eae867a2364658599bef9f75e6fa1efda5e4e574ad1f
MD5 5a236df42d121f9fd5b56d19cc9598d4
SHA1 27b39c66e41e55fe3ee82340d14b446a4df314e0
SHA512 586a4d52456732034742ebd9e3e24c2e841da5c940dd93fd8c11d2d90a8c889c8cf95ce186922091ff11b722ce61d0733ec31c1b5ec56e7c25e3eff56f0ffc74
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwCUr4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLro/r4/CFsrd
TLSH
T144F329834BDE5CF3F791113008798AB9927B99D4960EBEEF7B90CD250077292D43A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe

Path C:\Windows\{F0F6F124-BEAA-4357-AEA1-7D6D06FA4CA0}.exe
Size 168KB
SHA256 930f1dbfc005954d92330ed430d5f7efc6fb2ec7a07888aa761e95602cfc34f2
MD5 a9f0f39e8fd74237f8467281ac22e049
SHA1 1191f5195c20781d31f9c903ad70ab8fc9066997
SHA512 60396c6331195c1c9a47f9359148fe2aa6010ed9c6704cc49add04291c88212fbb10a3816ff0bc569b991dd938cd74cd65d177cb0e83fde12bd1a6cd09c6b776
SSDEEP 192:pbOzawOs81elJHsc45CcRZOgtShcWaOT2QLrCqwLUr4/CFxyNhoy5t:pbLwOs8AHsc4sMfwhKQLrowr4/CFsrd
TLSH
T171F318834BDE5CF3FB911130087D8AB9927B99D4960EBEEF6B90CD250077292D53A50B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads