stormser | f699a12fab3e9166482822d1ccf1e925ed794d05891fb6321d696db98de9da33

General

Target
2026-11-02_f4856baaa6cf9ed0dce2d5dcb4c22874_elex_wannacry.exe
Size 372KB
Sample261102-wsfexad17n
SHA256 f699a12fab3e9166482822d1ccf1e925ed794d05891fb6321d696db98de9da33
MD5 f4856baaa6cf9ed0dce2d5dcb4c22874
SHA1 24032685e4e6f80ba7803afdee0a83dc26283663
SHA512 32c83327664146b68ace96b88e37bcb2903765f75233436d2798e018211017719fa4231f16b38d212a6a78bdf1e3f326dd2c90b957d56b5c62c923032aa3cb42
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrozEx4/CFsrdb:Gvw9816vhKQLrozEx4/wQR
TLSH
T1058418835BDE9CF2FB91113109798AB9927B9AC4914EBEDFBF90CD150037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution stormser persistence worm

Malware Config

Signatures

Family: Stormser, StormDDoS, StormAttack, Stormer
Stormser aka StormDDoS, StormAttack, and Stormer is a Windows worm written in C++.
worm stormser

Detects Stormser aka Storm DDoS and StormAttack 3 IoCs

resource	yara_rule
behavioral1/files/0x0007000000024452-2.dat	family_stormser
behavioral1/files/0x0007000000024453-5.dat	family_stormser
behavioral1/files/0x000800000002445b-10.dat	family_stormser

Boot or Logon Autostart Execution: Active Setup 2 TTPs 6 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}\stubpath = "C:\\Windows\\{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe"	2026-11-02_f4856baaa6cf9ed0dce2d5dcb4c22874_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE8EB9B5-5529-40ce-94C0-2BD002B67463}	{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CE8EB9B5-5529-40ce-94C0-2BD002B67463}\stubpath = "C:\\Windows\\{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe"	{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0941FAF5-B36D-4283-928A-896A381371F6}	{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{0941FAF5-B36D-4283-928A-896A381371F6}\stubpath = "C:\\Windows\\{0941FAF5-B36D-4283-928A-896A381371F6}.exe"	{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}	2026-11-02_f4856baaa6cf9ed0dce2d5dcb4c22874_elex_wannacry.exe

Executes dropped EXE 3 IoCs

pid	Process
3792	{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe
4568	{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe
3252	{0941FAF5-B36D-4283-928A-896A381371F6}.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\{0941FAF5-B36D-4283-928A-896A381371F6}.exe	{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe
File created	C:\Windows\{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe	2026-11-02_f4856baaa6cf9ed0dce2d5dcb4c22874_elex_wannacry.exe
File created	C:\Windows\{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe	{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2580	cmd.exe
2104	cmd.exe
2632	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{0941FAF5-B36D-4283-928A-896A381371F6}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-02_f4856baaa6cf9ed0dce2d5dcb4c22874_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2232	2026-11-02_f4856baaa6cf9ed0dce2d5dcb4c22874_elex_wannacry.exe
Token: SeIncBasePriorityPrivilege	3792	{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe
Token: SeIncBasePriorityPrivilege	4568	{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 3792	2232	2026-11-02_f4856baaa6cf9ed0dce2d5dcb4c22874_elex_wannacry.exe	95
PID 2232 wrote to memory of 2580	2232	2026-11-02_f4856baaa6cf9ed0dce2d5dcb4c22874_elex_wannacry.exe	96
PID 3792 wrote to memory of 4568	3792	{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe	97
PID 3792 wrote to memory of 2104	3792	{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe	98
PID 4568 wrote to memory of 3252	4568	{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe	101
PID 4568 wrote to memory of 2632	4568	{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-11-02_f4856baaa6cf9ed0dce2d5dcb4c22874_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-02_f4856baaa6cf9ed0dce2d5dcb4c22874_elex_wannacry.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe
  C:\Windows\{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3792
- - C:\Windows\{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe
    C:\Windows\{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - Executes dropped EXE
    - Drops file in Windows directory
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4568
  - - C:\Windows\{0941FAF5-B36D-4283-928A-896A381371F6}.exe
      C:\Windows\{0941FAF5-B36D-4283-928A-896A381371F6}.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3252
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{CE8EB~1.EXE > nul
      4⤵
      Executes a command shell one-liner
      System Location Discovery: System Language Discovery
      PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{61117~1.EXE > nul
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2026-1~1.EXE > nul
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

{0941FAF5-B36D-4283-928A-896A381371F6}.exe

Path C:\Windows\{0941FAF5-B36D-4283-928A-896A381371F6}.exe
Size 372KB
SHA256 6dfca9bfa0b66e28e84c7e264860fd0c0f0820f69cb5d66359243ad102dc558a
MD5 09c6a7522472d9822d27f18b58945ddd
SHA1 ac210efb081a083c55ebd161a280ea852f82cb55
SHA512 01363f92de91cdcf6c991d7ee4aad732180bb0c360898d6a4eccf1141af5b3f93cc52bfce538e76157502c7303e618f384bfbed42dcf453c575c8e8fc7b44c8a
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLroIx4/CFsrdb:Gvw9816vhKQLroIx4/wQR
TLSH
T11C8409835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD550037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe

Path C:\Windows\{611178A9-B009-4fd4-89ED-C40CCBCB1ED1}.exe
Size 372KB
SHA256 9b3b5a60ec94308d28a9ece769249ca4ce19e3857ae6136900f06e0dcfc44c5f
MD5 ff4e35516aa626ad8704dd408a1275da
SHA1 51221024959ef3198bc1d6dad00b118239a0217d
SHA512 65f8dec5b7597952ade33ad33a0d314b9220b3fc4f8290fed55d889a2c22311ae5958ab40a0f6744efc60ecf1593a7a45627d8f3e1cbfe283f5b92e1f04c00f9
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLrorx4/CFsrdb:Gvw9816vhKQLrorx4/wQR
TLSH
T1098408835BDE9CF2FB91113009798AB9927B9AC4914EBEDFBF90CD150037292D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe

Path C:\Windows\{CE8EB9B5-5529-40ce-94C0-2BD002B67463}.exe
Size 372KB
SHA256 c4ab29155d53205adb39ab7fcade9c2357323cd0e1a71727965e5b0bdf645643
MD5 0b66ec7cbf79ca4c603510fdcbdd2c79
SHA1 bdf17be77bd21e36ace868ab91e22a8e2d4620c0
SHA512 11de247641d6c8ee3c951c14673f22c93136eb791d5c6f11275b7ce11d35f158979b1b3699f41adeaac9ef94829007f141f46259c85710737bcb902bea69fd98
SSDEEP 384:K7bLwOs8AHsc4sMfwhKQLronx4/CFsrdb:Gvw9816vhKQLronx4/wQR
TLSH
T1368409835BDE9CF2FB91117009798AB9927B99C4914EBEDFBF90CD250037251D53A10B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads