Analysis
- max time kernel
149s - max time network
79s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
28/05/2026, 02:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
20 signatures
150 seconds
General
- Target 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 1.8MB
- Sample260528-da2ajsfy81
- SHA256 9966b7ce86574e5412472c6e20f747b67717e841f755053189d71bf321cb3578
- MD5 d694523c1b8f738a8ed73591c9effb95
- SHA1 3694c0ee2025951a1fa9f837cd743b963fecbed9
- SHA512 df9d0bc770cdf27d05e5018d3316903febe2a265b5ec935a9bdff24c621209c0c3d127542c0630abdb7a376d129d805c779b0626ac62b979c8755a4711f04444
- SSDEEP 24576:sudVtTj2i64MjzaT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaoB:zbTC/xKCnFnQXBbrtgb/iQvu0UHOW
- TLSH T1E395EF152790CD61F36FC07283E16E79B5B329213733D896AE4865316BF2E2FE782491
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Windows security bypass 2 TTPs 24 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" WdExt.exe - Custom signatureDetects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 24 IoCs
resource yara_rule behavioral2/memory/4404-123-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-126-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-124-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-87-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-38-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-172-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-144-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-196-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-255-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-553-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-554-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4404-604-0x00000000022D0000-0x000000000335E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-687-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-688-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-689-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-724-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-684-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-622-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-683-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-690-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-616-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-1210-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-1199-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3196-1640-0x0000000002310000-0x000000000339E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - Custom signatureUPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/4404-123-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-126-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-124-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-87-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-38-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-172-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-144-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-196-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-255-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-553-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-554-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-604-0x00000000022D0000-0x000000000335E000-memory.dmp UPX behavioral2/memory/4404-609-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/3196-687-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-688-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-689-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-724-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-684-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-622-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-683-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-690-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-616-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-1210-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-1199-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-1640-0x0000000002310000-0x000000000339E000-memory.dmp UPX behavioral2/memory/3196-1645-0x0000000000400000-0x000000000044D000-memory.dmp UPX - Executes dropped EXE 5 IoCs
pid Process 3196 WdExt.exe 4208 launch.exe 4204 wtmps.exe 1900 launch.exe 2840 mscaps.exe - Loads dropped DLL 2 IoCs
pid Process 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 3196 WdExt.exe - Windows security modification 2 TTPs 25 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UacDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusOverride = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\FirewallDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\UpdatesDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc\AntiVirusDisableNotify = "1" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe -
resource yara_rule behavioral2/memory/4404-123-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-126-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-124-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-87-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-38-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-172-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-144-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-196-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-255-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-553-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-554-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/4404-604-0x00000000022D0000-0x000000000335E000-memory.dmp upx behavioral2/memory/3196-687-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-688-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-689-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-724-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-684-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-622-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-683-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-690-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-616-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-1210-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-1199-0x0000000002310000-0x000000000339E000-memory.dmp upx behavioral2/memory/3196-1640-0x0000000002310000-0x000000000339E000-memory.dmp upx - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtmps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 3196 WdExt.exe 3196 WdExt.exe 3196 WdExt.exe 3196 WdExt.exe 4208 launch.exe 4208 launch.exe 4208 launch.exe 4208 launch.exe 4208 launch.exe 4208 launch.exe 4208 launch.exe 4208 launch.exe 4208 launch.exe 4208 launch.exe 4208 launch.exe 4208 launch.exe 1900 launch.exe 1900 launch.exe 1900 launch.exe 1900 launch.exe 1900 launch.exe 1900 launch.exe 1900 launch.exe 1900 launch.exe 1900 launch.exe 1900 launch.exe 1900 launch.exe 1900 launch.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Suspicious use of WriteProcessMemory 41 IoCs
description pid Process procid_target PID 4404 wrote to memory of 820 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 9 PID 4404 wrote to memory of 824 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 10 PID 4404 wrote to memory of 760 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 14 PID 4404 wrote to memory of 2652 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 51 PID 4404 wrote to memory of 2980 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 52 PID 4404 wrote to memory of 2004 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 53 PID 4404 wrote to memory of 3172 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 54 PID 4404 wrote to memory of 3300 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 55 PID 4404 wrote to memory of 3572 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 57 PID 4404 wrote to memory of 3584 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 58 PID 4404 wrote to memory of 3648 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 59 PID 4404 wrote to memory of 3728 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 60 PID 4404 wrote to memory of 3824 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 61 PID 4404 wrote to memory of 3888 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 62 PID 4404 wrote to memory of 4248 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 63 PID 4404 wrote to memory of 2464 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 81 PID 4404 wrote to memory of 2140 4404 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 83 PID 2464 wrote to memory of 3196 2464 cmd.exe 85 PID 3196 wrote to memory of 820 3196 WdExt.exe 9 PID 3196 wrote to memory of 824 3196 WdExt.exe 10 PID 3196 wrote to memory of 760 3196 WdExt.exe 14 PID 3196 wrote to memory of 2652 3196 WdExt.exe 51 PID 3196 wrote to memory of 2980 3196 WdExt.exe 52 PID 3196 wrote to memory of 2004 3196 WdExt.exe 53 PID 3196 wrote to memory of 3172 3196 WdExt.exe 54 PID 3196 wrote to memory of 3300 3196 WdExt.exe 55 PID 3196 wrote to memory of 3572 3196 WdExt.exe 57 PID 3196 wrote to memory of 3584 3196 WdExt.exe 58 PID 3196 wrote to memory of 3648 3196 WdExt.exe 59 PID 3196 wrote to memory of 3728 3196 WdExt.exe 60 PID 3196 wrote to memory of 3824 3196 WdExt.exe 61 PID 3196 wrote to memory of 3888 3196 WdExt.exe 62 PID 3196 wrote to memory of 4248 3196 WdExt.exe 63 PID 3196 wrote to memory of 2464 3196 WdExt.exe 81 PID 3196 wrote to memory of 2464 3196 WdExt.exe 81 PID 3196 wrote to memory of 4544 3196 WdExt.exe 82 PID 3196 wrote to memory of 3192 3196 WdExt.exe 86 PID 3192 wrote to memory of 4208 3192 cmd.exe 88 PID 4208 wrote to memory of 4144 4208 launch.exe 89 PID 4144 wrote to memory of 4204 4144 cmd.exe 91 PID 4204 wrote to memory of 2840 4204 wtmps.exe 94 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:820
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:824
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:760
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2652
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2980
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2004
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3172
-
C:\Users\Admin\AppData\Local\Temp\2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4404 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:4544
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3196 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 31966⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4208 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"8⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe9⤵
- Executes dropped EXE
PID:2840
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:2140
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3300
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:3572
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3584
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3648
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3728
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3824
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:3888
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4248
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1900
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E58BF92_Rar\2026-05-28_d694523c1b8f738a8ed73591c9effb95_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 1.7MB
- SHA256 5dbf2db0bd8993d482e11647287538ca4410ea67bf8e411ac47c1e4ccb21ddc0
- MD5 6a493c7e409cd4b983217ee5d69bfd1b
- SHA1 e891cd143c65fb3b85cc55d6c64665908bd7342c
- SHA512 69fd035e4859316e50cb413d5c3d07a3aeb1db85714bf1be78492a9dcc560466bf2544fb4a546020830891222a19630afa526368eca4e91d7fb0ff7e7c5a05c3
- SSDEEP 24576:OXdVtTj2i64T+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNb:mbTChxKCnFnQXBbrtgb/iQvu0UHOW
- TLSH T15085EE252790CD61F36FC07283E56E79B6B329213733D896AE4865312BF2E1FE781095
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\E7BB.tmp
- Size 406B
- SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
- MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
- SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
- SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
- TLSH T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
- Size 276KB
- SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
- MD5 75c1467042b38332d1ea0298f29fb592
- SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
- SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
- SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
- TLSH T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
- Size 172KB
- SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
- MD5 daac1781c9d22f5743ade0cb41feaebf
- SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
- SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
- SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
- TLSH T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
- Size 1.8MB
- SHA256 9966b7ce86574e5412472c6e20f747b67717e841f755053189d71bf321cb3578
- MD5 d694523c1b8f738a8ed73591c9effb95
- SHA1 3694c0ee2025951a1fa9f837cd743b963fecbed9
- SHA512 df9d0bc770cdf27d05e5018d3316903febe2a265b5ec935a9bdff24c621209c0c3d127542c0630abdb7a376d129d805c779b0626ac62b979c8755a4711f04444
- SSDEEP 24576:sudVtTj2i64MjzaT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaoB:zbTC/xKCnFnQXBbrtgb/iQvu0UHOW
- TLSH T1E395EF152790CD61F36FC07283E16E79B5B329213733D896AE4865316BF2E2FE782491
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
- Size 1.8MB
- SHA256 e09d243068e2b21930a320c4e0c7389da45db0ff382d4405eabca51c2bfd9f3b
- MD5 78a0017174b03810b435367ab9ccbc4a
- SHA1 dd7b5ec524aedff680fbc0d37c6c113bd367575c
- SHA512 6883cf614e6102627ce0e73fcb13c50a8930d998d9ba8c01acca318d97081e170e0ef72251f4b975bc2d7126d108672acd7b0d9004354d0884e6144a1a550157
- SSDEEP 24576:sudVtTj2i64MjzaT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaoE:zbTC/xKCnFnQXBbrtgb/iQvu0UHOV
- TLSH T15795EE152790CD61F36FC07283E16E79B5B329213733D896AE4865316BF2E2FE782491
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
- Size 129B
- SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
- MD5 d1073c9b34d1bbd570928734aacff6a5
- SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
- SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
- TLSH T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 126B
- SHA256 12fbad21e17c393cc3b0ea8558d098447e6b3c0b5e4ddc2ad4c1bb8439370294
- MD5 6b251a05a6f59236c4c256177ee6bc94
- SHA1 64ab24c461ed31a6dfe1be4059d88c4baca46863
- SHA512 03f6be444ad8a5bdb26ef3f365189fd5fe28a8b2ad37793dd42264f2d77559b2ea46e8246b8a1978cedbc96296595a4041d0c0a503f9d3fb3c8dc2cab6632607
- TLSH T1C6B09B1603C9C74E746260570775545D507C4AC23E94B605C611C488314580CFC56955
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 358B
- SHA256 722436a015c7e2c5431868884ee5bbda73869ff23bade68c125ecbe0adbe7e8b
- MD5 fbb891c8117a14c6bdae0ad0b69c5bb7
- SHA1 45296d4ccfc749fc0c48d0c5090d79c4ea51cca0
- SHA512 f8f69f92c737aae0764ba31e3d237a7e3b6c541358a5d9d6b7f750f90b7ff2e3cf92b3affdbf09ca8bdc124233a7617196ee8f5059aa8bdba7afa96b728070aa
- TLSH T117E0C00402BEC73DB04472C79B70806DC03C3FBB3E4C1B168321D4C89A9390D7A61A22
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
- Size 102B
- SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
- MD5 3ca08f080a7a28416774d80552d4aa08
- SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
- SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
- TLSH T114B0121243CBCF0D148060D70775A1CCC0740C983F947714DF11C84C314080DFDC6A41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 397KB
- SHA256 172c5d203978efd4c41ff771b9d91cdaf6b7dbc243f4e49d3494f0eb68e174d0
- MD5 54c2f1e94d36d256eec1a83954d6ec61
- SHA1 b4206dddea2ef133aaa82146b1da6acfc3824882
- SHA512 9758f747f571c72ca4dba7e3d6b8b7687365595ee554eecb27dde5facf912e3e4b89e55f1a8dec362426411772a345783ef587446c3619f26c693a22ef3edf93
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyT:/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 397KB
- SHA256 46531fdcb25851c1cc9aabd320aea1925b459a3106040d1c37334b97980aaec2
- MD5 dfd79ed7a3e608aa717743f9e75c4613
- SHA1 1e9ab2729d2da8e3fe5116a833d089cd517b17ac
- SHA512 c08bf246451a32c708808fb5a870629d732581c35da0333600e74d00dae5a05dc7d9978fefb1fc34f7c099b0ee9bb9155756ff16b82a9826c90635dbbf973f80
- SSDEEP 6144:AeDT2zbyLpoFDpyfaMUqbcQ2uAOwe0Yg1ATPcdUoJFfAaaNzxOPMVP1tQ+jBSK4+:AeDCysQ2uWoFNgdo4+
- TLSH T165843A03EAA890A1E9F74B70296EA22A503DB8754F50DDDF726447EDA430EC18F75B13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 828cd645b3e062fd579da03673aeb965ca8deb90235b1ae4cfb187638e3383ac
- MD5 5248a688a51d96ddbf73f8a68fbef27c
- SHA1 2a643269cf864b1380e190571877853ea93e65e8
- SHA512 943e9547129fb44251c98a01c33496c8f0d6e44503873c938229a804b90a54101493e8ba9ce3505854b8a609431cb48d4b92feffdad0a0c4309e5b23cd25a3f5
- TLSH T1A0D05E0E4BDD11AD9046002F3178D4C272399F11D8720F4C9039674164286E9FF7E3AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mscaps.exe
- Size 200KB
- SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
- MD5 78d3c8705f8baf7d34e6a6737d1cfa18
- SHA1 9f09e248a29311dbeefae9d85937b13da042a010
- SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
- SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
- TLSH T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
- MD5 SHA1 SHA512 SSDEEP TLSH