Analysis
- max time kernel
149s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
25/04/2026, 06:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe
- Size 52KB
- Sample260425-hpf1daat2x
- SHA256 b5b4c9cf6cf9dcc7967d13410323dcc25e1faae50d328aee5e5976ed098c1344
- MD5 93c57c21adbaf5cfa25b85137404c628
- SHA1 44dbe65783dddf85933c79c373ad04021a8ea067
- SHA512 5bd9aa4cf5701b5c9c1c62dcc78003e67b1de904beac1dad6fe15bb1db145cb01106b923fb64cabfbe14470bcd8548e66fd3d67edca3671452b122aee3057c85
- SSDEEP 768:FlQ4hrvaEGU4aikqykezg2XpfYMdjYioRooPCl5:fLhE1Dezg2ZfYM0oug5
- TLSH T1E3337D13B9ED05B3DD508AB124BB4B3B6B3BF9120250114BAF08DD9E7DB21849D3236B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\G: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\I: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\K: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\L: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\U: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\V: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\X: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Y: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\M: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\O: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\S: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\E: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\H: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\N: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\P: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\W: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Z: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\J: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Q: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\R: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\T: 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\CAMERASETTINGSUIHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CERTREQ.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RASERVER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CHKNTFS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CIPHER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MOUNTVOL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SETUPUGC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TCPSVCS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WEXTRACT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\AUDITPOL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DEVICEPAIRINGWIZARD.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ISOBURN.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSDT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NET.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSAPROXY.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TYPEPERF.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DRIVERQUERY.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYNCHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CLEANMGR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PICKERHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SHUTDOWN.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESCOMPUTERNAME.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\VERIFIERGUI.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DFRGUI.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPUEXC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSIEXEC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MUIUNATTEND.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SECINIT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTRAY.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\USER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GPSCRIPT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NDADMIN.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCAD32.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TSWPFWRP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\INPUTSWITCHTOASTHANDLER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICLI.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSINFO32.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TAR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTBROKER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RESMON.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHPROTOCOLHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\UNLODCTR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WERMGR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINRS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ATTRIB.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BTHUDTASK.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MFPMP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PROQUOTA.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWS.MEDIA.BACKGROUNDPLAYBACK.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DISM.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EXPLORER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\STORDIAG.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COMPACT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NETPLWIZ.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\OPOSHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WSMANHTTPCONFIG.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RRINSTALLER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.TODOS_0.33.33351.0_X64__8WEKYB3D8BBWE\TODO.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSCOMMUNICATIONSAPPS_16005.12827.20400.0_X64__8WEKYB3D8BBWE\HXOUTLOOK.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\EULA.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\PLUG_INS\PI_BROKERS\64BITMAPIBROKER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\1.3.195.65\MICROSOFTEDGEUPDATECOMREGISTERSHELL64.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\NATIVE2ASCII.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOIA.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ONENOTE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTOFFICEHUB_18.2104.12721.0_X64__8WEKYB3D8BBWE\LOCALBRIDGE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSSTORE_12104.1001.1.0_X64__8WEKYB3D8BBWE\WINSTORE.APP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOXIDENTITYPROVIDER_12.50.6001.0_X64__8WEKYB3D8BBWE\XBOXIDP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ARH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\XJC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA-RMI.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\WORDICON.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\SPREADSHEETCOMPARE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\1.3.195.65\MICROSOFTEDGEUPDATE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.WINDOWSFEEDBACKHUB_1.2103.1172.0_X64__8WEKYB3D8BBWE\PILOTSHUBAPP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\COOKIE_EXPORTER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\132.0.2957.140\BHO\IE_TO_EDGE_STUB.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\TABTIP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\UNPACK200.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JP2LAUNCHER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SDXHELPER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\XLICONS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\DBCICONS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\INSTALLER\CHRMSTP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTACK.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JABSWITCH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSTICKYNOTES_4.0.2.0_X64__8WEKYB3D8BBWE\STICKYNOTESSTUB.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.PEOPLE_10.1909.12456.0_X64__8WEKYB3D8BBWE\PEOPLEAPP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.143.57\MICROSOFTEDGECOMREGISTERSHELLARM64.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WAB.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JMAP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\DW\DWTRIG20.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\DATABASECOMPARE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OSMADMINICON.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PUBS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRCEF.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\NOTIFICATION_HELPER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\132.0.2957.140\PWAHELPER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEINSTAL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KTAB.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SSVAGENT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\XLICONS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.GAMINGAPP_2105.900.24.0_X64__8WEKYB3D8BBWE\XBOXSTUB.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IELOWUTIL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\MSEDGEWEBVIEW2.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVAWS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAW.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVDLLSURROGATE64.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX64\MICROSOFT ANALYSIS SERVICES\AS OLEDB\140\SQLDUMPER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\INSTALL\{E82B72DE-E604-4D8F-B1D7-38905DC82757}\MICROSOFTEDGE_X64_139.0.3405.125.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\132.0.2957.140\COOKIE_EXPORTER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WABMIG.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\INPUTPERSONALIZATION.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SCHEMAGEN.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SERVICING\LCU\PACKAGE_FOR_ROLLUPFIX~31BF3856AD364E35~AMD64~~22000.493.1.3\WOW64_MICROSOFT-WINDOWS-CONTROL_31BF3856AD364E35_10.0.22000.318_NONE_9F38AA7663FCBF45\F\CONTROL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.STARTMENUEXPERIENCEHOST_CW5N1H2TXYEWY\STARTMENUEXPERIENCEHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..OMMANDLINEUTILITIES_31BF3856AD364E35_10.0.22000.1_NONE_9ECF8C975AE30ADC\FIND.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-OOBE-FIRSTLOGONANIMEXE_31BF3856AD364E35_10.0.22000.1_NONE_21929EAC926A49B0\FIRSTLOGONANIM.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_10.0.22000.1_NONE_B7671877039E31C8\TYPEPERF.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-GUESTCOMPUTESERVICE_31BF3856AD364E35_10.0.22000.282_NONE_88AB4CA49843F4B5\R\VMCOMPUTEAGENT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BCDBOOT-CMDLINETOOL_31BF3856AD364E35_10.0.22000.194_NONE_5C736727C3870F49\BCDBOOT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MDMAGENT_31BF3856AD364E35_10.0.22000.1_NONE_9B404AC522E88EB7\MDMAGENT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_10.0.22000.282_NONE_069016EFD47610D8\R\WMPLAYER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-SPP-UX_31BF3856AD364E35_10.0.22000.348_NONE_571935DE2408AE28\R\SLUI.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SERVICING\LCU\PACKAGE_FOR_ROLLUPFIX~31BF3856AD364E35~AMD64~~22000.493.1.3\AMD64_PRODUCT-CONTAINEROS..X-DEPLOYMENT-SERVER_31BF3856AD364E35_10.0.22000.493_NONE_E73DFE4D18FF7931\F\APPLYTRUSTOFFLINE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CORRUPTEDFILERECOVERY_31BF3856AD364E35_10.0.22000.1_NONE_DDFD55862D9061D5\COFIRE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PKTMON-SETUP_31BF3856AD364E35_10.0.22000.434_NONE_4F4AC04322F04123\PKTMON.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RUNLEGACYCPLELEVATED_31BF3856AD364E35_10.0.22000.1_NONE_674FACC3FA15E905\RUNLEGACYCPLELEVATED.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-AUTOCHKCONFIGURATOR_31BF3856AD364E35_10.0.22000.1_NONE_795AC390C0EE4B33\CHKNTFS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-COMPACT_31BF3856AD364E35_10.0.22000.1_NONE_5A8D82C2EEBC5EC0\COMPACT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-ADMINCMDTOOLS_31BF3856AD364E35_10.0.22000.1_NONE_0AF1BA5C97D13826\RPCINFO.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWSSEARCHENGINE_31BF3856AD364E35_7.0.22000.282_NONE_555AD0E288836A51\F\SEARCHPROTOCOLHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-CLIENT-LI..M-SERVICE-MIGRATION_31BF3856AD364E35_10.0.22000.120_NONE_9268B7169B04C4A6\F\CLIPUP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.22000.318_NONE_2BC95A47EAA37094\F\HVIX64.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONTAINER-MANAGER_31BF3856AD364E35_10.0.22000.318_NONE_8E5804EC62C5891C\F\CMPROXYD.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..LICATIONS-CLIENTSKU_31BF3856AD364E35_10.0.22000.282_NONE_1A017429CB7FEA2C\F\RDPSHELL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX4-ASPNET_REGIIS_EXE_B03F5F7F11D50A3A_4.0.15806.0_NONE_814D9CD431D93BD0\ASPNET_REGIIS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-I..ATEDUSERMODE-KERNEL_31BF3856AD364E35_10.0.22000.348_NONE_E313CFB919DAA6B1\F\SECUREKERNEL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..MSETTINGS-DATAMODEL_31BF3856AD364E35_10.0.22000.469_NONE_E574FA2E821169AC\F\SYSTEMSETTINGSBROKER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..OR-NATIVE-SERVERBOX_31BF3856AD364E35_10.0.22000.120_NONE_6B23F06CE93F4F52\F\RMACTIVATE_SSP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINLOGON-TOOLS_31BF3856AD364E35_10.0.22000.120_NONE_8FD8AAB412295721\R\WLRMDR.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-OPENWITH_31BF3856AD364E35_10.0.22000.1_NONE_CDB916A4ABDDBB05\OPENWITH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_CURL_31BF3856AD364E35_10.0.22000.1_NONE_D4AF4DB521F3EBAF\CURL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..MANAGEMENT-OMADMPRC_31BF3856AD364E35_10.0.22000.1_NONE_0C0C8E31403FE0C1\OMADMPRC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-SETUP-SUPPORT_31BF3856AD364E35_11.0.22000.282_NONE_04AF1CE80D4A389A\IE4UINIT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETWORKING-MPSSVC-NETSH_31BF3856AD364E35_10.0.22000.434_NONE_AA4EFCF84BE1B89B\R\CHECKNETISOLATION.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\DATASVCUTIL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AUDIO-AUDIOCORE_31BF3856AD364E35_10.0.22000.469_NONE_71E2BDA169E58AEA\R\AUDIODG.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..DIALOGHOST.APPXMAIN_31BF3856AD364E35_10.0.22000.120_NONE_0B04AA9DCB2DB938\F\CREDDIALOGHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COM-SURROGATE_31BF3856AD364E35_10.0.22000.1_NONE_9A678C5BF84B14E6\DLLHST3G.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..D-SEARCHINTEGRATION_31BF3856AD364E35_10.0.22000.1_NONE_DBFB4F42942AC176\IMESEARCH.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EXTRAC32_31BF3856AD364E35_10.0.22000.1_NONE_316D384508AE771E\EXTRAC32.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-CLIENTCMDTOOLS_31BF3856AD364E35_10.0.22000.1_NONE_A7A700C8F53B4106\UMOUNT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-COMPONENT_31BF3856AD364E35_10.0.22000.376_NONE_2D61A5193292E66C\SETUP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\DFSVC\2.0.0.0__B03F5F7F11D50A3A\DFSVC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.22000.376_NONE_C7A79DE54D7799EC\SYNCAPPVPUBLISHINGSERVER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEPLOYMENT_31BF3856AD364E35_10.0.22000.1_NONE_52329470F2171593\SETUPUGC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FILEPICKER.APPXMAIN_31BF3856AD364E35_10.0.22000.120_NONE_BDD6ED7A5949F71C\R\FILEPICKER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MIGRATIONENGINE_31BF3856AD364E35_10.0.22000.348_NONE_53FF6ED560767984\MIGHOST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-USEREXPERIENCE-DESKTOP_31BF3856AD364E35_10.0.22000.493_NONE_81CDAB704EAAD423\F\WEBEXPERIENCEHOSTAPP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..IODATAMODEL-LIBRARY_31BF3856AD364E35_10.0.22000.51_NONE_57505AFC50444312\WINBIODATAMODELOOBE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-NOTEPAD_31BF3856AD364E35_10.0.22000.1_NONE_CFB2D573A92990DE\NOTEPAD.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.AAD.BROKERPLUGIN_CW5N1H2TXYEWY\MICROSOFT.AAD.BROKERPLUGIN.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-LABEL_31BF3856AD364E35_10.0.22000.1_NONE_B7C753C003725517\LABEL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-PING-UTILITIES_31BF3856AD364E35_10.0.22000.1_NONE_09C9ECFFC9049DC0\TRACERT.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_NETFX4-SERVICEMODELREG_EXE_B03F5F7F11D50A3A_4.0.15806.0_NONE_14B35D27C5CAEE09\SERVICEMODELREG.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_REGSVCS_B03F5F7F11D50A3A_4.0.15806.0_NONE_8CE2F3FE679C53CD\REGSVCS.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\INSTALLUTIL.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPX-DEPLOYMENT-SERVER_31BF3856AD364E35_10.0.22000.318_NONE_5CC755143BC62566\R\CUSTOMINSTALLEXEC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..ALCONTROLS.APPXMAIN_31BF3856AD364E35_10.0.22000.120_NONE_9ED34DD5B0C53507\R\WPCUAPAPP.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-TOOLS-KLIST_31BF3856AD364E35_10.0.22000.282_NONE_3C5AF3814BE830AB\KLIST.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_10.0.22000.1_NONE_4548A15E322E11AC\TSCON.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-T..MINALSERVICESCLIENT_31BF3856AD364E35_10.0.22000.282_NONE_53574BB7DAD4A93C\F\MSTSC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\VBC.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.22000.65_NONE_4F258EC343F09686\R\WINDEPLOY.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PRINTING-SPOOLER-CORE_31BF3856AD364E35_10.0.22000.376_NONE_D180C9EC46D962EB\SPOOLSV.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RECOVERYDRIVE_31BF3856AD364E35_10.0.22000.132_NONE_23EF129810E14356\F\RECOVERYDRIVE.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-WOW64-LEGACY_31BF3856AD364E35_10.0.22000.1_NONE_4C569CED0CA81910\USER.EXE 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4712 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe 4712 2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_93c57c21adbaf5cfa25b85137404c628_elex_nymaim_rhadamanthys_wannacry.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4712
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1