Analysis
- max time kernel
150s - max time network
116s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260630-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
03/07/2026, 16:18
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
20 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260630-en
windows11-ltsc_2024-x64
19 signatures
150 seconds
General
- Target 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 1.1MB
- Sample260703-tr2weacx3w
- SHA256 85e346c34a6a48caf6893c62044ab8749ec36349f0c2ddb3f43f57bf1a0cb935
- MD5 2c5d00902f18127c5c828f8102fa8f4f
- SHA1 389d263719f274d12f185fd19b687d48ff35c74a
- SHA512 9da7bb1fc3089db75415304068f638b164c8d514fcdc9c2569ff63e92f12693354488b2fd20c043f24cfec38291482769901431c1aa0990ed4ea975103de5dd5
- SSDEEP 24576:DGXzatThRiVapabLGJv6plFh9iGa2oMYMgdsHGe1:g8Tjtp1JspDLoVMgdkL1
- TLSH T12735EF192B90CDA1F36FC07296D0AE34B6732A203733DC4A6E4895381BF1E5FE792556
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 22 IoCs
resource yara_rule behavioral2/memory/2836-8-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-7-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-6-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-1-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-13-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-12-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-14-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-11-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-10-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-48-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-57-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2560-74-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2560-76-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2560-88-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2560-173-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2560-87-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2560-86-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2560-85-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2560-83-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2560-84-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2560-77-0x00000000023A0000-0x000000000342E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/2836-47-0x00000000023E0000-0x000000000346E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 26 IoCs
resource yara_rule behavioral2/memory/2836-8-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-7-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-6-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-15-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-1-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-13-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-12-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-14-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-11-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-10-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-48-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-57-0x00000000023E0000-0x000000000346E000-memory.dmp UPX behavioral2/memory/2836-70-0x0000000000400000-0x000000000044E000-memory.dmp UPX behavioral2/memory/2560-78-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2560-74-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2560-76-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2560-88-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2560-172-0x0000000000400000-0x000000000044E000-memory.dmp UPX behavioral2/memory/2560-173-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2560-87-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2560-86-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2560-85-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2560-83-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2560-84-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2560-77-0x00000000023A0000-0x000000000342E000-memory.dmp UPX behavioral2/memory/2836-47-0x00000000023E0000-0x000000000346E000-memory.dmp UPX - Executes dropped EXE 5 IoCs
pid Process 2560 WdExt.exe 876 module_launcher.exe 3752 module_launcher.exe 3548 kb50145.exe 4956 injector_s.exe - Loads dropped DLL 2 IoCs
pid Process 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 2560 WdExt.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2132828192-1552876075-2324613956-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Admin\\module_launcher.exe\"" module_launcher.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe -
resource yara_rule behavioral2/memory/2836-8-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-7-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-6-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-15-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-1-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-13-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-12-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-14-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-11-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-10-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-48-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2836-57-0x00000000023E0000-0x000000000346E000-memory.dmp upx behavioral2/memory/2560-78-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2560-74-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2560-76-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2560-88-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2560-173-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2560-87-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2560-86-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2560-85-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2560-83-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2560-84-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2560-77-0x00000000023A0000-0x000000000342E000-memory.dmp upx behavioral2/memory/2836-47-0x00000000023E0000-0x000000000346E000-memory.dmp upx - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language module_launcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language module_launcher.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language kb50145.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language injector_s.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 2560 WdExt.exe 2560 WdExt.exe 2560 WdExt.exe 2560 WdExt.exe 876 module_launcher.exe 876 module_launcher.exe 876 module_launcher.exe 876 module_launcher.exe 876 module_launcher.exe 876 module_launcher.exe 876 module_launcher.exe 876 module_launcher.exe 3752 module_launcher.exe 3752 module_launcher.exe 3752 module_launcher.exe 3752 module_launcher.exe 3752 module_launcher.exe 3752 module_launcher.exe 3752 module_launcher.exe 3752 module_launcher.exe 4956 injector_s.exe 4956 injector_s.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2836 wrote to memory of 1196 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 16 PID 2836 wrote to memory of 2120 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 45 PID 2836 wrote to memory of 2660 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 46 PID 2836 wrote to memory of 3180 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 49 PID 2836 wrote to memory of 3448 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 51 PID 2836 wrote to memory of 3456 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 52 PID 2836 wrote to memory of 3224 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 59 PID 2836 wrote to memory of 4224 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 61 PID 2836 wrote to memory of 4232 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 62 PID 2836 wrote to memory of 4356 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 63 PID 2836 wrote to memory of 4404 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 64 PID 2836 wrote to memory of 4460 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 65 PID 2836 wrote to memory of 4728 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 67 PID 2836 wrote to memory of 4964 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 68 PID 2836 wrote to memory of 5128 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 69 PID 2836 wrote to memory of 5200 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 70 PID 2836 wrote to memory of 5240 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 71 PID 2836 wrote to memory of 3440 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 88 PID 2836 wrote to memory of 4736 2836 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 90 PID 3440 wrote to memory of 2560 3440 cmd.exe 92 PID 2560 wrote to memory of 1196 2560 WdExt.exe 16 PID 2560 wrote to memory of 2120 2560 WdExt.exe 45 PID 2560 wrote to memory of 2660 2560 WdExt.exe 46 PID 2560 wrote to memory of 3180 2560 WdExt.exe 49 PID 2560 wrote to memory of 3448 2560 WdExt.exe 51 PID 2560 wrote to memory of 3456 2560 WdExt.exe 52 PID 2560 wrote to memory of 3224 2560 WdExt.exe 59 PID 2560 wrote to memory of 4224 2560 WdExt.exe 61 PID 2560 wrote to memory of 4232 2560 WdExt.exe 62 PID 2560 wrote to memory of 4356 2560 WdExt.exe 63 PID 2560 wrote to memory of 4404 2560 WdExt.exe 64 PID 2560 wrote to memory of 4460 2560 WdExt.exe 65 PID 2560 wrote to memory of 4728 2560 WdExt.exe 67 PID 2560 wrote to memory of 4964 2560 WdExt.exe 68 PID 2560 wrote to memory of 5128 2560 WdExt.exe 69 PID 2560 wrote to memory of 5200 2560 WdExt.exe 70 PID 2560 wrote to memory of 5240 2560 WdExt.exe 71 PID 2560 wrote to memory of 3440 2560 WdExt.exe 88 PID 2560 wrote to memory of 3440 2560 WdExt.exe 88 PID 2560 wrote to memory of 5588 2560 WdExt.exe 89 PID 2560 wrote to memory of 4736 2560 WdExt.exe 90 PID 2560 wrote to memory of 4736 2560 WdExt.exe 90 PID 2560 wrote to memory of 5224 2560 WdExt.exe 91 PID 2560 wrote to memory of 52 2560 WdExt.exe 93 PID 52 wrote to memory of 876 52 cmd.exe 95 PID 876 wrote to memory of 4112 876 module_launcher.exe 97 PID 4112 wrote to memory of 3548 4112 cmd.exe 100 PID 3548 wrote to memory of 4956 3548 kb50145.exe 101 PID 3548 wrote to memory of 3220 3548 kb50145.exe 102 PID 4956 wrote to memory of 3456 4956 injector_s.exe 52 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1196
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2120
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"2⤵PID:3448
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3180
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3456
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"2⤵PID:5240
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-03_2c5d00902f18127c5c828f8102fa8f4f_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2836 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5588
-
-
C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe"C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2560 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:52 -
C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe"C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe" /i 25606⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe"C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe"8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Roaming\injector_s.exe"C:\Users\Admin\AppData\Roaming\injector_s.exe"9⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4956
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\a0x.bat" "C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe" "C:\Users\Admin\AppData\Local\Temp\a0x.bat""9⤵
- System Location Discovery: System Language Discovery
PID:3220
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:4736 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:5224
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3224
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:4224
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:4232
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4356
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4404
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4460
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4728
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000268;000000000000026C;1⤵PID:4964
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5128
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:5200
-
C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe"C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3752
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\a0x.bat
- Size 44B
- SHA256 b1e4990bf84c402594a53a2a98011b8880239e790872de1f6c7b8b9cd1005cf5
- MD5 804bb96081db73d249b1d21573d8ea59
- SHA1 abf76e8d0702ce245bb7afbb513cdcc8bac6ab35
- SHA512 d037dea300ffe466ab83c2a1c2c9a55693c36b546dbbcfa0a7a1ef477a3ea5c33f9831d71389466cf4c74192b417bf9ed0b7e0ad88d927f1ca997fcba254414c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Admin\WdExt.exe
- Size 1.1MB
- SHA256 c2af2c17b4067cf057db9b36e6e50b46bd00def8c3f437be3e97046406d25b80
- MD5 f661c2a816171ff8e4ffcf7933393543
- SHA1 ed953c09ff1e49973267416b8bbca085549be7d5
- SHA512 cff47534492de83359d9eee9281a711b032e4a08a8098572a366beb656343ec21ad29b529bec9344e1c20250a1a9817adb6ad6c3a9bbd68ee02add07e6531213
- SSDEEP 24576:DGXzatThRiVapabLGJv6plFh9iGa2oMYMgdsHGeO:g8Tjtp1JspDLoVMgdkLO
- TLSH T10935DF192B90CDA1F36FC07296D0AE34B6732A203733DC4A6E4895381BF1E5FE792556
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Admin\kb50145.exe
- Size 76KB
- SHA256 048655d212b269073107e4636125ceeea262acce1d364fc512a0cc8f4783dcf7
- MD5 8bf335774fbb62bbe1de03921dfe047a
- SHA1 24fc750a20aebb52f23e84264d201f458106d95d
- SHA512 aed95f1c37cc99cee23d250e395a80c9c45c7c1c017ec7baef2af860711dbd5b540bf077d372e94582c9758961063f4c166a03fffce3b17e7fb468ce174b7aea
- SSDEEP 1536:4PvHSkIOrnToIfvl9ys325hnA2tQAxlLo6G41JJsi9eQ3:4PLTBfvl9ys32flG6G4H+Q3
- TLSH T10C73E101569003AAC0FD8A3DADDD7FFC5AA8B370179405878E5C6DB61A093A27A746CE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Admin\module_launcher.exe
- Size 172KB
- SHA256 b4febd6c6fc42b7d86b575f6c44f0d49fbe9ec02e98d3be00cb26b3e32a3a6d1
- MD5 6ff3155e619e2c601db536c88741e094
- SHA1 c71bfc0a9b11db33c801035e06d31a03e2901dd0
- SHA512 8a3047ff46833003464f0979702a4b4f0cf3998c3e4aa865b2f61cfd377689eae706fb9017c2ca97a2fee7f65d6c17c73ae37e86940a6aefdd06d8f0281bcebc
- SSDEEP 3072:pzFKPt9YZEJiqtTBfwVVxt377g3zd3jceABCO0RC4R:pC7YZwiqtTBoRXKFGUOiC2
- TLSH T10104AE193A9089B2C0AFD4B3C0D5BB28F7B733321321D94B679C96751E62776F6122C6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Admin\module_usbdetect.dll
- Size 99KB
- SHA256 7177e1cc90b22224ba7da03393ae867ee16b3da15d994ed0ec3fd8a0dd867808
- MD5 c7cc0186feb89de73bd3240709561712
- SHA1 fca1806c6fe4c22a5364da0491abca7f2e43c9aa
- SHA512 2794ea723ad2457db116058f1fb6116499d37b10aa8e45e0a229dbc777900ef1c2f6b8e129a7558e6e1aedfa3f139099dbc4dd10b29b1fc8341e07cf976dc755
- SSDEEP 1536:LJz6RWBl0Zk3Q4F/2TCRJkFb6GMsLwCUZnroksAIOqFnToIfi2DztODIECR:V9l5PF/LnsoU2qtTBfi2HtODiR
- TLSH T100A3AC0276A0C577D0B2447448D65F3EAFBF785047359D839B5C9B2E2E70B60EA1A2CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
- Size 105B
- SHA256 ff5e923c453d3d61a7989b2b0f978b0bba924a7052667311c9eed54852a20cfd
- MD5 902a1098f800859502aec4eac3026495
- SHA1 a6b209e9aa15087670e830af5de8179b31abc897
- SHA512 cf7f0197c78f9c7db81068fbc702596a00c5d7c8280751641965917056c0e71265a3a89f3daf6a3600faa13034b54fbedea50ea583723abbfc286f2e7e79fe77
- TLSH T1FFB0922303C88B0D684152A71B75A08CC07449C47B843508DB01C488214080CFC9A812
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 358B
- SHA256 e28694c43f3f39693083c5051647a6d978b53767a0be6d9a5f80a1c3470ea1f3
- MD5 008326e5ec652e9380dd569e500ff3f7
- SHA1 8e690108bba9dda9954742519a2eb9e74b1f456c
- SHA512 fecab0cf09d8345f4d069a7729549e04e630b4d9c792579289d3cdad1d4a3e507823c0b78b63da1f902551d4df007fe758bd3918ed19358e2906dba5226e185a
- TLSH T17FE02044029DC72D7B0493872A68D0BCC1F7AAA47F6D53859711C685525360FB972541
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 122B
- SHA256 17bf4736cc4890c07ae437900912cbebb472576606967802bdc15e9da0f6c1e3
- MD5 2ba70e48f77f5011996a56fa99a77f2c
- SHA1 9dec7b9229d1651d3e6a9b60d4a3c2ff8a76a7ea
- SHA512 c945ff60463adcaf322673f5cf5df1ac1f64c576e368f07c3fdbdaad81ee143724cc7a3eb2cbd919c158c14b08dae4590ee5aeaac7b302782898e024161a3cc8
- TLSH T160B09B1502D5CB0D740550571BB551ADC4B545C53E443714CA01CC8C214841DFC85D12
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
- Size 107B
- SHA256 bf1b95975082845d3d9d8948999d69d666dfe50d741a36cdf81fa180fa4c777b
- MD5 85eb3280f9675f88d00040cbea92277f
- SHA1 2fece0a30b2153b4a9fee72fe5a637dee1967a2f
- SHA512 2641b1dfa67216ed86d0394dbc6dd78f6124978c23673c73e4e1da66a93f98364acafc13c3df017fab682ed3d9a2c993f3d9bb562e07b7a1b0a01576e1381298
- TLSH T1C0B0921203C69B0D688160EB0B75A08CC0B44A843B843609CF01C888324080CED86802
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 382KB
- SHA256 5c130fd7e962456900bb9a9c88425a9aacc7d879cf61c142ed9e43413b812556
- MD5 8f95063ace2b2e5b9e74b3dbbb05981f
- SHA1 cb617fde7807a68991bcc00e69374882f2af06d7
- SHA512 82d7a0a613729c4ae3cb6a63f7e221303de2bf9577516b365792c082bd1946a0e5f6b809b83df353a24492f308d114a5db86a87d94cc8a9260db4bc5853c53f8
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyb:f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 382KB
- SHA256 f0a24c3d4e5f5948dd84a9db1206e07b904c6c12ff9e20de2a2ad7d6b04c6946
- MD5 311930917a26dd0cc3754133b6ffc342
- SHA1 3c6baf292592dc733d71c2b984a7b75070b43aff
- SHA512 b8401339f12ebf39f9ec6ffad3d6db7188387d9fe997d74f11a0d324389758b777b14f4f4a732879259955c428db6d01644f541c9f21db90e2c7eb94b15ca2f0
- SSDEEP 6144:ED1coZXbdacDWZyehpRHy9H4dIBXCN2x/DMVP1tF+jBSVJ6:EDhZLdN9eNXdIlCNuorJ6
- TLSH T106842942AAE95420D2F357306A7DBB39212E78785BA0ECDFB24057FDA420AC19F75353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\injector_s.exe
- Size 188KB
- SHA256 22c5c5bcb256c1dcaead463c92a70107ba1bac40564fe1e7d46594c6a3936778
- MD5 1d1491e1759c1e39bf99a5df90311db3
- SHA1 8bd6faed091bb00f879ef379715461130493e97f
- SHA512 ac6ca48acbd288011849e55b0c66faf9ead479e39dc2deaecc7ad998e764f02a1807bb9227e03f12ce1a0b1f5c5b3072c3b86b5bae336e84d95d7a3e42cf5a1e
- SSDEEP 1536:ZcnSpj9lXZGDvgwT//05l4L3uWF+YqQFVGXOPTIaf:OSpj9+3/05l4LFF+3LXV
- TLSH T1BB146D0B76C045F3C09F453094A25B2ADFBF6E69066108C377653FCD2D72661FA35A46
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 a5587c7618ce7f8c2a2c1a909a1c786adcd3db31e6b317a42ba848cd7bdf57fc
- MD5 f331ca009189c674d7f3e656e4e4dfe0
- SHA1 c8656a15b3ed80fb1c40fbc3d55319808ffb9461
- SHA512 1036a219b005e599322b6707987a649c7ac9bc1a359e77bb4cf44e16b72f3b3588237aa85c52187eaba931edda976e8ec05cec529feb56bad24e3352c0bab96e
- TLSH T1FDD0170E4BA911AD9042002E2178D0C272299F1198320B5C50296B8164296A9BF7E2AE
- MD5 SHA1 SHA512 TLSH