Analysis
- max time kernel
149s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/05/2026, 12:49
Behavioral task
behavioral1
Sample
2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe
Resource
win11-20250619-en
windows11-21h2-x64
10 signatures
150 seconds
General
- Target 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe
- Size 2.8MB
- Sample260506-p2fnpse19r
- SHA256 5815f6e6e52c363c40034c26a6c6d02fca9c787c48b388c563923fffc7fc57a4
- MD5 9a9cae989f5f2a3325e9ccf364f5135d
- SHA1 424fd3e4aa7402d326a23f7ed5130f5f5a29ec67
- SHA512 a958dca5d05bc13d2029bf2ee88c2676b05ca51901b0e252d1973c2fb08957e1c5e5ed264c70fe63afad7558064f150e0ca9bd1f54f4541f37646c94207948dc
- SSDEEP 49152:jj9LxcO4Q5YTjPs8ZbnKYcMg8Zbnxyj9LxcO4Q5YTjPs8ZbnKYcMg8Zbnxyj9Lxl:jjBxcO4EYTjA5xjBxcO4EYTjA5xjBxcc
- TLSH T18FD57D02B3C99076DDB316B006766B7B8238BE24061586CF9744DD9ABFB26D1AD3D343
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe - Drops file in System32 directory 7 IoCs
description ioc Process File created C:\Windows\SysWOW64\DbTasker.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Windows\SysWOW64\DbTasker.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\hal.dll 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\DBTASK.EXE 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\dbzip2.dll 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\dbexe2.dll 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\LockFile.dat 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe -
resource yara_rule behavioral1/memory/2788-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/files/0x0007000000024292-5.dat upx behavioral1/memory/2788-698-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/2788-1429-0x0000000000400000-0x0000000000450000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\dbcicons.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedgewebview2.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\orbd.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\Installer\setup.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeUpdateSetup.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\VPREVIEW.EXE 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_pwa_launcher.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdate.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pptico.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate32.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\grv_icons.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\Windows NT\Accessories\wordpad.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsimport.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\msouc.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0409-1000-0000000FF1CE}\misc.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CLVIEW.EXE 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\lyncicon.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zG.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe - Program crash 1 IoCs
pid pid_target Process procid_target 4176 2788 WerFault.exe 83 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe 2788 2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-06_9a9cae989f5f2a3325e9ccf364f5135d_amadey_elex_glassworm_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 104282⤵
- Program crash
PID:4176
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2788 -ip 27881⤵PID:3124
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 2.8MB
- SHA256 d85357d3792cc4d1e8fffe176e387a830f72ede321b0171fee13cce39a505c64
- MD5 5bc84ca4502fde98f7018193f9dd3f72
- SHA1 6d2a4cac439ab96ab62e7202106f30d3f13a9069
- SHA512 7febb917dd3a436e090e4ba89c09a95336fc15a5144a9e7c79ec10f2972405316e8f54dc923255c77a217e91752e19c02a308092a66af511bda71932de042d8f
- SSDEEP 49152:jj9LxcO4Q5YTjPs8ZbnKYcMg8Zbnxyj9LxcO4Q5YTjPs8ZbnKYcMg8Zbnxyj9LxA:jjBxcO4EYTjA5xjBxcO4EYTjA5xjBxcZ
- TLSH T15CD57D02B3C99076EDB316B006766B7B8638BE24061586CF5744DD9ABFB26D0AD3D343
- MD5 SHA1 SHA512 SSDEEP TLSH