Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
15/04/2026, 10:04
General
- Target 2026-04-15_e6d2b411bdf5db05119eabbab0c28bb8_elex_wannacry.exe
- Size 532KB
- Sample260415-l37l2aev4y
- SHA256 6975b7d3ad6abe915941ec46d8b2066067d432f151d718ffc2a9f10773057e0a
Malware Config
Signatures
- Drops file in Drivers directory 4 IoCs
- Deletes itself 1 IoCs
- Executes dropped EXE 64 IoCs
- Adds Run key to start application 2 TTPs 12 IoCs
- Drops file in System32 directory 55 IoCs
- Drops file in Windows directory 64 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 4 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-15_e6d2b411bdf5db05119eabbab0c28bb8_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-15_e6d2b411bdf5db05119eabbab0c28bb8_elex_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\system\ihakhtcc.exe"C:\windows\system\ihakhtcc.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-15_e6d2b411bdf5db05119eabbab0c28bb8_elex_wannacry.exe"2⤵
- Drops file in Drivers directory
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-15_e6d2b411bdf5db05119eabbab0c28bb8_elex_wannacry.exe"2⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"3⤵
-
-
-
C:\windows\vkku.exe"C:\windows\vkku.exe" "C:\Users\Admin\AppData\Local\Temp\2026-04-15_e6d2b411bdf5db05119eabbab0c28bb8_elex_wannacry.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
\??\c:\windows\system\ihakhtcc.exec:\windows\system\ihakhtcc.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
\??\c:\windows\vkku.exec:\windows\vkku.exe1⤵
- Drops file in Drivers directory
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- Executes dropped EXE
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
-
C:\windows\SysWOW64\mptbbjkn.exe"C:\windows\system32\mptbbjkn.exe"2⤵
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-04-15_e6d2b411bdf5db05119eabbab0c28bb8_elex_wannacry.exeihakhtcc.exe_
mptbbjkn.exe
memory/8-342-0x0000000000BA0000-0x0000000000C5B000-memory.dmp
memory/392-225-0x00000000009E0000-0x0000000000A9B000-memory.dmp
memory/468-268-0x00000000008D0000-0x000000000098B000-memory.dmp
memory/668-301-0x00000000008C0000-0x000000000097B000-memory.dmp
memory/720-280-0x0000000000900000-0x00000000009BB000-memory.dmp
memory/1036-339-0x0000000000A40000-0x0000000000AFB000-memory.dmp
memory/1104-286-0x00000000009E0000-0x0000000000A9B000-memory.dmp
memory/1208-314-0x00000000008D0000-0x000000000098B000-memory.dmp
memory/1384-234-0x00000000006E0000-0x000000000079B000-memory.dmp
memory/1448-296-0x0000000000960000-0x0000000000A1B000-memory.dmp
memory/1624-306-0x0000000000A70000-0x0000000000B2B000-memory.dmp
memory/1740-222-0x00000000008A0000-0x000000000095B000-memory.dmp
memory/1816-226-0x00000000008D0000-0x000000000098B000-memory.dmp
memory/1840-229-0x00000000009E0000-0x0000000000A9B000-memory.dmp
memory/1896-329-0x00000000008B0000-0x000000000096B000-memory.dmp
memory/2016-205-0x0000000000B50000-0x0000000000C0B000-memory.dmp
memory/2036-231-0x00000000008B0000-0x000000000096B000-memory.dmp
memory/2372-239-0x00000000008C0000-0x000000000097B000-memory.dmp
memory/2432-227-0x00000000008A0000-0x000000000095B000-memory.dmp
memory/2440-295-0x00000000008F0000-0x00000000009AB000-memory.dmp
memory/2500-240-0x00000000009E0000-0x0000000000A9B000-memory.dmp
memory/2528-281-0x00000000009F0000-0x0000000000AAB000-memory.dmp
memory/2692-265-0x00000000008B0000-0x000000000096B000-memory.dmp
memory/2752-233-0x0000000000A10000-0x0000000000ACB000-memory.dmp
memory/2788-328-0x00000000008B0000-0x000000000096B000-memory.dmp
memory/2800-341-0x0000000000950000-0x0000000000A0B000-memory.dmp
memory/2884-313-0x00000000008C0000-0x000000000097B000-memory.dmp
memory/2904-308-0x00000000006B0000-0x000000000076B000-memory.dmp
memory/3040-211-0x0000000000930000-0x00000000009EB000-memory.dmp
memory/3064-213-0x0000000000920000-0x00000000009DB000-memory.dmp
memory/3104-278-0x00000000009E0000-0x0000000000A9B000-memory.dmp
memory/3148-266-0x00000000009F0000-0x0000000000AAB000-memory.dmp
memory/3340-224-0x0000000000A10000-0x0000000000ACB000-memory.dmp
memory/3432-312-0x00000000008A0000-0x000000000095B000-memory.dmp
memory/3600-322-0x0000000000920000-0x00000000009DB000-memory.dmp
memory/3700-216-0x00000000008F0000-0x00000000009AB000-memory.dmp
memory/3712-246-0x00000000008E0000-0x000000000099B000-memory.dmp
memory/3732-242-0x0000000000930000-0x00000000009EB000-memory.dmp
memory/3756-274-0x0000000000A10000-0x0000000000ACB000-memory.dmp
memory/3828-208-0x0000000000910000-0x00000000009CB000-memory.dmp
memory/3976-251-0x00000000009E0000-0x0000000000A9B000-memory.dmp
memory/4052-237-0x00000000008A0000-0x000000000095B000-memory.dmp
memory/4092-287-0x00000000008A0000-0x000000000095B000-memory.dmp
memory/4224-254-0x00000000009E0000-0x0000000000A9B000-memory.dmp
memory/4256-275-0x00000000008B0000-0x000000000096B000-memory.dmp
memory/4272-323-0x00000000008B0000-0x000000000096B000-memory.dmp
memory/4348-334-0x00000000008C0000-0x000000000097B000-memory.dmp
memory/4368-219-0x00000000008A0000-0x000000000095B000-memory.dmp
memory/4404-302-0x0000000000920000-0x00000000009DB000-memory.dmp
memory/4416-300-0x00000000006B0000-0x000000000076B000-memory.dmp
memory/4428-262-0x00000000008B0000-0x000000000096B000-memory.dmp
memory/4536-245-0x00000000006B0000-0x000000000076B000-memory.dmp
memory/4600-218-0x0000000000A20000-0x0000000000ADB000-memory.dmp
memory/4628-212-0x00000000008B0000-0x000000000096B000-memory.dmp
memory/4712-332-0x00000000008F0000-0x00000000009AB000-memory.dmp
memory/4732-291-0x0000000000A10000-0x0000000000ACB000-memory.dmp
memory/4780-327-0x00000000008C0000-0x000000000097B000-memory.dmp
memory/4800-255-0x0000000000920000-0x00000000009DB000-memory.dmp
memory/4832-307-0x00000000008E0000-0x000000000099B000-memory.dmp
memory/4852-321-0x00000000009E0000-0x0000000000A9B000-memory.dmp
memory/4860-333-0x00000000008B0000-0x000000000096B000-memory.dmp
memory/4936-258-0x0000000000910000-0x00000000009CB000-memory.dmp
memory/4948-284-0x0000000000920000-0x00000000009DB000-memory.dmp
memory/5048-260-0x0000000000A10000-0x0000000000ACB000-memory.dmp