Analysis
- max time kernel
149s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/04/2026, 06:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe
- Size 52KB
- Sample260425-hpf1daat2x
- SHA256 b5b4c9cf6cf9dcc7967d13410323dcc25e1faae50d328aee5e5976ed098c1344
- MD5 93c57c21adbaf5cfa25b85137404c628
- SHA1 44dbe65783dddf85933c79c373ad04021a8ea067
- SHA512 5bd9aa4cf5701b5c9c1c62dcc78003e67b1de904beac1dad6fe15bb1db145cb01106b923fb64cabfbe14470bcd8548e66fd3d67edca3671452b122aee3057c85
- SSDEEP 768:FlQ4hrvaEGU4aikqykezg2XpfYMdjYioRooPCl5:fLhE1Dezg2ZfYM0oug5
- TLSH T1E3337D13B9ED05B3DD508AB124BB4B3B6B3BF9120250114BAF08DD9E7DB21849D3236B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\W: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\K: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\O: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\X: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\E: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\I: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\N: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\P: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Q: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\S: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\U: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\V: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\H: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\J: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\L: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\M: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\R: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Y: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Z: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\G: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\DOSKEY.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GETMAC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MRINFO.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RASPHONE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DXDIAG.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GAMEPANEL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CLEANMGR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DISM\DISMHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TPMTOOL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WERMGR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CERTREQ.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CIPHER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COMP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DCOMCNFG.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NETSH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCCONF.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESCOMPUTERNAME.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTBROKER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COM\COMREPL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FINGER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PKGMGR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SDCHANGE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TZUTIL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIPRVSE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINRSHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPERF.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHWINAPP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\OPENFILES.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMINFO.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MMGASERVER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\OPOSHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BACKGROUNDTRANSFERHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DPNSVR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICLI.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICPL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LOGAGENT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSAUACHELPER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BTHUDTASK.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMUWPLAUNCHER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TASKLIST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TSTHEME.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\W32TM.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWS.MEDIA.BACKGROUNDPLAYBACK.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WWAHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EXPLORER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCPROP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REAGENTC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RESMON.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SHRPUBW.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CMSTP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ROUTE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TYPEPERF.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_ISV.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BOOTCFG.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DFRGUI.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DWWIN.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GPRESULT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\BHO\IE_TO_EDGE_STUB.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\132.0.2957.140\BHO\IE_TO_EDGE_STUB.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEINSTAL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\RMIREGISTRY.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\TNAMESERV.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\COMMON.SHOWHELP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\FILECOMPARE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GETHELP_10.1706.13331.0_X64__8WEKYB3D8BBWE\GETHELP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\MSEDGE_PROXY.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\INSTALL\{92C4B1EE-A2C2-4A93-966B-B76B164E4A86}\MICROSOFTEDGE_X64_139.0.3405.125.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KINIT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVACPL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAW.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JJS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\DEFAULT-BROWSER-AGENT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\MSEDGE_PWA_LAUNCHER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\CHROME_PWA_LAUNCHER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS NT\ACCESSORIES\WORDPAD.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\ELEVATION_SERVICE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KEYTOOL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KTAB.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\POLICYTOOL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPRPH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSTICKYNOTES_3.6.73.0_X64__8WEKYB3D8BBWE\MICROSOFT.NOTES.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEINSTAL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAFXPACKAGER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX40.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.HEIFIMAGEEXTENSION_1.0.22742.0_X64__8WEKYB3D8BBWE\CODECPACKS.HEIF.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROLAYOUTRECOGNIZER\ACROLAYOUTRECOGNIZER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.147.37\MICROSOFTEDGEUPDATESETUP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OFFICECLICKTORUN.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\UNPACK200.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\LYNCICON.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OUTICON.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEBACKGROUNDHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXGAMEOVERLAY_1.46.11001.0_X64__8WEKYB3D8BBWE\GAMEBAR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.ZUNEVIDEO_10.19071.19011.0_X64__8WEKYB3D8BBWE\VIDEO.UI.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\ELEVATED_TRACING_SERVICE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JJS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\XJC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVACPL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\OFFICE16\OSPPREARM.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\132.0.2957.140\ELEVATION_SERVICE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\132.0.2957.140\MSEDGE_PWA_LAUNCHER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPRPH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\ORBD.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\DW\DW20.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX86\MICROSOFT SHARED\EQUATION\EQNEDT32.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\ELEVATION_SERVICE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROBROKER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPLAYER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFTWINDOWS-UNDOCKEDDEVKIT.APPXMAIN_31BF3856AD364E35_10.0.19041.488_NONE_7201E1DC944D1765\R\UNDOCKEDDEVKIT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-W..TNET-MUA-HOSTSERVER_31BF3856AD364E35_10.0.19041.746_NONE_B93DCE693A9C6DB9\WINRTNETMUAHOSTSERVER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LOCKAPPHOST_31BF3856AD364E35_10.0.19041.746_NONE_D99FD60BC1FDE773\F\LOCKAPPHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-THUMBEXTHOST_31BF3856AD364E35_10.0.19041.746_NONE_CE6643A69C39F80A\F\THUMBNAILEXTRACTIONHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-A..L-SYSTEMUWPLAUNCHER_31BF3856AD364E35_10.0.19041.1_NONE_C55149B3997FF9CD\SYSTEMUWPLAUNCHER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_10.0.19041.1266_NONE_802F96A5044B0FBE\WMPCONFIG.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFTWINDOWSSYSTEMRESTORE-TASKS_31BF3856AD364E35_10.0.19041.84_NONE_2C3254D57443E050\R\SRTASKS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..BIOMETRICS-TRUSTLET_31BF3856AD364E35_10.0.19041.1_NONE_FB337FA99FB8BC2F\BIOISO.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_10.0.19041.1_NONE_9AA166E99861C2BC\TSKILL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-FSUTIL_31BF3856AD364E35_10.0.19041.1_NONE_8CA9CC4EC3AAE4A7\FSUTIL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-A..CATION-CREDUIBROKER_31BF3856AD364E35_10.0.19041.746_NONE_4C95CF26B3AA5907\F\CREDENTIALUIBROKER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-D..OMMANDLINE-DSDBUTIL_31BF3856AD364E35_10.0.19041.844_NONE_C171E0BE75E709DE\F\DSDBUTIL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.STARTMENUEXPERIENCEHOST_CW5N1H2TXYEWY\STARTMENUEXPERIENCEHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CAPTUREPICKER.APPXMAIN_31BF3856AD364E35_10.0.19041.423_NONE_12CA604B48F8D3FB\CAPTUREPICKER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-INSTALLER-EXECUTABLE_31BF3856AD364E35_10.0.19041.1_NONE_FF72825025776920\MSIEXEC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MULTIPOINT-LOGCOLLECTOR_31BF3856AD364E35_10.0.19041.1_NONE_56138D203A7FC4CF\LOGCOLLECTOR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-EDP-NOTIFY_31BF3856AD364E35_10.0.19041.1_NONE_E112F07513949221\EDPNOTIFY.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..-EXPERIENCE-APPHELP_31BF3856AD364E35_10.0.19041.928_NONE_6012C8CABF808FF7\R\PCAUI.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-PROMPT_31BF3856AD364E35_10.0.19041.1_NONE_A6007AA58351AD08\FVEPROMPT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..VIRONMENT-OS-LOADER_31BF3856AD364E35_10.0.19041.1266_NONE_CFEC8DB821D83671\WINLOAD.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ERRORREPORTINGFAULTS_31BF3856AD364E35_10.0.19041.1081_NONE_E4E5027BF1E82209\WERFAULT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHELL-PREVIEWHOST_31BF3856AD364E35_10.0.19041.746_NONE_2136AFEF5FADEAA4\PREVHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-SENSECLIENT-SERVICE_31BF3856AD364E35_10.0.19041.1288_NONE_1CEC63974464878F\SENSECE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ILASM.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ATBROKER_31BF3856AD364E35_10.0.19041.1023_NONE_4478665ED379A3FC\ATBROKER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..DARYAUTHFACTOR-TASK_31BF3856AD364E35_10.0.19041.746_NONE_A9FF72B1A43FD663\DEVICECREDENTIALDEPLOYMENT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-CLOUDNOTIFICATIONS_31BF3856AD364E35_10.0.19041.1_NONE_524D53B764FB40E1\CLOUDNOTIFICATIONS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RPC-PING_31BF3856AD364E35_10.0.19041.1_NONE_5DFFC5E61476CC4E\RPCPING.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SETHC_31BF3856AD364E35_10.0.19041.746_NONE_4B0E3418084B5511\F\SETHC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MULTIMEDIA-RRINSTALLER_31BF3856AD364E35_10.0.19041.746_NONE_FB3BA1752084C5CF\RRINSTALLER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-L..NSTALLER-COMHANDLER_31BF3856AD364E35_10.0.19041.746_NONE_FF3F6C27E956149F\F\LANGUAGECOMPONENTSINSTALLERCOMHANDLER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.19041.264_NONE_8BD2F5FC0C992E06\SEARCHINDEXER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..IONINGSECUREPROCESS_31BF3856AD364E35_10.0.19041.1_NONE_4CC7187CBF1EF970\PSP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TASKKILL_31BF3856AD364E35_10.0.19041.1_NONE_DB6F0C88FB6E127A\TASKKILL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-MANAGEMENTCONSOLE_31BF3856AD364E35_10.0.19041.906_NONE_65F82BA919C64B11\INETMGR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PROVISIONING-CORE_31BF3856AD364E35_10.0.19041.153_NONE_95BA73D08E5F739C\R\PROVTOOL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SPEECHCOMMON-ONECORE_31BF3856AD364E35_10.0.19041.264_NONE_5B8F61A9B1063622\SPEECHMODELDOWNLOAD.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTEMRESTORE-MAIN_31BF3856AD364E35_10.0.19041.84_NONE_3E82ED1FE15C67DB\RSTRUI.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_OPENSSH-COMMON-COMPONENTS-ONECORE_31BF3856AD364E35_10.0.19041.964_NONE_9A882AF90EA09CC3\R\SSH-AGENT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONVERT_31BF3856AD364E35_10.0.19041.1_NONE_52C6583F47AFBA7A\CONVERT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..FRAMEWORKS-USERMODE_31BF3856AD364E35_10.0.19041.1_NONE_53029E0F94A11C6D\WUDFCOMPANIONHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-GAMING-XBOX..E-SERVICE-COMPONENT_31BF3856AD364E35_10.0.19041.789_NONE_3136B8D712DA0334\F\XBLGAMESAVETASK.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-A..ENCE-INFRASTRUCTURE_31BF3856AD364E35_10.0.19041.928_NONE_BD769D14DFD7D29D\R\SDBINST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-STORAGE-DIAGNOSTICS_31BF3856AD364E35_10.0.19041.1_NONE_34F70C73DC049744\STORDIAG.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ENCE-INFRASTRUCTURE_31BF3856AD364E35_10.0.19041.928_NONE_B321F2C2AB7710A2\R\SDBINST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..S-DATAUSAGEHANDLERS_31BF3856AD364E35_10.0.19041.153_NONE_DBDEEC75CDD2A4D1\DATAUSAGELIVETILETASK.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..SKTOP.APPXMAIN.ROOT_31BF3856AD364E35_10.0.19041.1266_NONE_3E00D223332897B8\SEARCHAPP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-COMPONENT_31BF3856AD364E35_10.0.19041.1237_NONE_A6EF3A2E62766C5C\F\AUDIT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS.NETWORKING.VPN.NETHOST_31BF3856AD364E35_10.0.19041.1_NONE_836CD009A39B05C6\NETHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_WP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..AGEMENT-COREDPUSSVR_31BF3856AD364E35_10.0.19041.746_NONE_7946FB11BF19DC87\F\COREDPUSSVR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETWORKUX-LEGACYUX_31BF3856AD364E35_10.0.19041.1_NONE_D374A4C62C9F2643\LEGACYNETUXHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RESTARTMANAGER_31BF3856AD364E35_10.0.19041.1_NONE_3626754EC37C229B\RMCLIENT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINLOGON_31BF3856AD364E35_10.0.19041.1_NONE_25B40E9A744F0270\WINLOGON.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-EVENTCOLLECTOR_31BF3856AD364E35_10.0.19041.1_NONE_BB535ABD48713DFF\WECUTIL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-O..ONALFEATURES-FONDUE_31BF3856AD364E35_10.0.19041.1_NONE_09FAC50A5FE3AEC5\FONDUE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.19041.1_NONE_23025624C75C162F\OOBELDR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BIOENROLLMENT.APPXMAIN_31BF3856AD364E35_10.0.19041.844_NONE_DE5D9FE254D9F8C4\BIOENROLLMENTHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CIPHER_31BF3856AD364E35_10.0.19041.1_NONE_63078CDE447629B6\CIPHER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..ETEXPLORER-OPTIONAL_31BF3856AD364E35_11.0.19041.1_NONE_8298E4B5B7FD2C26\IEXPLORE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..ESSAGINGCORESERVICE_31BF3856AD364E35_10.0.19041.1_NONE_98FAD53F878BC04C\MQSVC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..CLIENT-UI-WSCOLLECT_31BF3856AD364E35_10.0.19041.1_NONE_BFA47510D0E31E28\WSCOLLECT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-U..ETRY-CLIENT-WOWONLY_31BF3856AD364E35_10.0.19041.1_NONE_4C7DA197E5837576\DTDUMP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\INSTALLUTIL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1824 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe 1824 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1824
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1