Analysis
- max time kernel
22s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/07/2026, 17:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260706-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe
- Size 3.3MB
- Sample260709-vpy76set5j
- SHA256 3800fa3cc133754015e1b3b55f5b251b45f7f9c9e82f2b2bfc2c8e78c959f17b
- MD5 74cd071923da4f78c381c1592c78d059
- SHA1 d5ec553752eca3c053eb168a90f3c81a5beaea85
- SHA512 94ac716af0be288d5e429716e178989a630f5c803671ec1cd17161c0e50979400468f7ed0ff641e812c17acdbd3f0dc984565397ff8c00403fac5aa6cec268ed
- SSDEEP 49152:/C4rL8+/SdDTKbbTCaxKCnFnQXBbrtgb/iQvu0UHOaYmLs:/TrLR/SdDTKb6axvWbrtUTrUHO2g
- TLSH T129F55B07B4C4FC97D1FA5DBCAB42D242D2697891349EF782967A3A2CD571F02B03B681
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 9 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" @AE4198.tmp.exe - UAC bypass 3 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe - Windows security bypass 2 TTPs 18 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 39 IoCs
resource yara_rule behavioral1/memory/2684-19-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2684-23-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2684-24-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2684-430-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2684-431-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2684-511-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2684-539-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2684-541-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2684-542-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2684-543-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2684-565-0x00000000022C0000-0x000000000337A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-583-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-585-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-586-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-587-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-599-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-601-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-605-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-603-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-602-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-588-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-614-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-987-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-1510-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/2012-1522-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1558-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1557-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1559-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1560-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1561-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1562-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1574-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1576-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1578-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1583-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1601-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1600-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1602-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/700-1603-0x0000000004FA0000-0x000000000605A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 41 IoCs
resource yara_rule behavioral1/memory/2684-19-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-23-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-24-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-430-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-431-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-511-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-539-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-541-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-542-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-543-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-565-0x00000000022C0000-0x000000000337A000-memory.dmp UPX behavioral1/memory/2684-577-0x0000000000400000-0x000000000044B000-memory.dmp UPX behavioral1/memory/2012-583-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-585-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-586-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-587-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-599-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-601-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-605-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-603-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-602-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-588-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-614-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-987-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-1510-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-1522-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/2012-1537-0x0000000000400000-0x000000000044B000-memory.dmp UPX behavioral1/memory/700-1558-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1557-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1559-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1560-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1561-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1562-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1574-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1576-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1578-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1583-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1601-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1600-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1602-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX behavioral1/memory/700-1603-0x0000000004FA0000-0x000000000605A000-memory.dmp UPX - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation @AE4198.tmp.exe Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation WdExt.exe Key value queried \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation launch.exe - Executes dropped EXE 7 IoCs
pid Process 2684 @AE4198.tmp.exe 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 2012 WdExt.exe 1604 launch.exe 968 wtmps.exe 4176 mscaps.exe 3316 launch.exe - Loads dropped DLL 2 IoCs
pid Process 2684 @AE4198.tmp.exe 2012 WdExt.exe - Windows security modification 2 TTPs 21 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" @AE4198.tmp.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe - Checks whether UAC is enabled 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AE4198.tmp.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe - Enumerates connected drives 3 TTPs 6 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\G: 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\H: 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\I: 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\J: 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\B: 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe -
resource yara_rule behavioral1/memory/2684-19-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2684-23-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2684-24-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2684-430-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2684-431-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2684-511-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2684-539-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2684-541-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2684-542-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2684-543-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2684-565-0x00000000022C0000-0x000000000337A000-memory.dmp upx behavioral1/memory/2012-583-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-585-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-586-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-587-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-599-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-601-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-605-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-603-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-602-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-588-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-614-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-987-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-1510-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/2012-1522-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/700-1558-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1557-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1559-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1560-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1561-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1562-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1574-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1576-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1578-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1583-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1601-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1600-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1602-0x0000000004FA0000-0x000000000605A000-memory.dmp upx behavioral1/memory/700-1603-0x0000000004FA0000-0x000000000605A000-memory.dmp upx - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\e584476 @AE4198.tmp.exe File opened for modification C:\Windows\SYSTEM.INI @AE4198.tmp.exe File created C:\Windows\e584fd1 WdExt.exe File created C:\Windows\e587059 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtmps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language @AE4198.tmp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 2684 @AE4198.tmp.exe 2684 @AE4198.tmp.exe 2684 @AE4198.tmp.exe 2684 @AE4198.tmp.exe 2012 WdExt.exe 2012 WdExt.exe 2012 WdExt.exe 2012 WdExt.exe 1604 launch.exe 1604 launch.exe 1604 launch.exe 1604 launch.exe 1604 launch.exe 1604 launch.exe 1604 launch.exe 1604 launch.exe 1604 launch.exe 1604 launch.exe 1604 launch.exe 1604 launch.exe 3316 launch.exe 3316 launch.exe 3316 launch.exe 3316 launch.exe 3316 launch.exe 3316 launch.exe 3316 launch.exe 3316 launch.exe 3316 launch.exe 3316 launch.exe 3316 launch.exe 3316 launch.exe 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe Token: SeDebugPrivilege 2684 @AE4198.tmp.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4212 wrote to memory of 5832 4212 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 87 PID 4212 wrote to memory of 5832 4212 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 87 PID 4212 wrote to memory of 5832 4212 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 87 PID 5832 wrote to memory of 2684 5832 explorer.exe 88 PID 5832 wrote to memory of 700 5832 explorer.exe 89 PID 2684 wrote to memory of 788 2684 @AE4198.tmp.exe 8 PID 2684 wrote to memory of 792 2684 @AE4198.tmp.exe 9 PID 2684 wrote to memory of 524 2684 @AE4198.tmp.exe 14 PID 2684 wrote to memory of 1160 2684 @AE4198.tmp.exe 51 PID 2684 wrote to memory of 752 2684 @AE4198.tmp.exe 52 PID 2684 wrote to memory of 1488 2684 @AE4198.tmp.exe 53 PID 2684 wrote to memory of 3224 2684 @AE4198.tmp.exe 55 PID 2684 wrote to memory of 3416 2684 @AE4198.tmp.exe 57 PID 2684 wrote to memory of 3600 2684 @AE4198.tmp.exe 58 PID 2684 wrote to memory of 3692 2684 @AE4198.tmp.exe 59 PID 2684 wrote to memory of 3756 2684 @AE4198.tmp.exe 60 PID 2684 wrote to memory of 3840 2684 @AE4198.tmp.exe 61 PID 2684 wrote to memory of 4052 2684 @AE4198.tmp.exe 62 PID 2684 wrote to memory of 5884 2684 @AE4198.tmp.exe 65 PID 2684 wrote to memory of 3296 2684 @AE4198.tmp.exe 78 PID 2684 wrote to memory of 4696 2684 @AE4198.tmp.exe 79 PID 2684 wrote to memory of 4588 2684 @AE4198.tmp.exe 80 PID 2684 wrote to memory of 5136 2684 @AE4198.tmp.exe 85 PID 2684 wrote to memory of 5832 2684 @AE4198.tmp.exe 87 PID 2684 wrote to memory of 700 2684 @AE4198.tmp.exe 89 PID 2684 wrote to memory of 700 2684 @AE4198.tmp.exe 89 PID 2684 wrote to memory of 5468 2684 @AE4198.tmp.exe 90 PID 2684 wrote to memory of 1776 2684 @AE4198.tmp.exe 91 PID 5468 wrote to memory of 2012 5468 cmd.exe 94 PID 2012 wrote to memory of 788 2012 WdExt.exe 8 PID 2012 wrote to memory of 792 2012 WdExt.exe 9 PID 2012 wrote to memory of 524 2012 WdExt.exe 14 PID 2012 wrote to memory of 1160 2012 WdExt.exe 51 PID 2012 wrote to memory of 752 2012 WdExt.exe 52 PID 2012 wrote to memory of 1488 2012 WdExt.exe 53 PID 2012 wrote to memory of 3224 2012 WdExt.exe 55 PID 2012 wrote to memory of 3416 2012 WdExt.exe 57 PID 2012 wrote to memory of 3600 2012 WdExt.exe 58 PID 2012 wrote to memory of 3692 2012 WdExt.exe 59 PID 2012 wrote to memory of 3756 2012 WdExt.exe 60 PID 2012 wrote to memory of 3840 2012 WdExt.exe 61 PID 2012 wrote to memory of 4052 2012 WdExt.exe 62 PID 2012 wrote to memory of 5884 2012 WdExt.exe 65 PID 2012 wrote to memory of 3296 2012 WdExt.exe 78 PID 2012 wrote to memory of 4696 2012 WdExt.exe 79 PID 2012 wrote to memory of 4588 2012 WdExt.exe 80 PID 2012 wrote to memory of 5136 2012 WdExt.exe 85 PID 2012 wrote to memory of 5468 2012 WdExt.exe 90 PID 2012 wrote to memory of 5468 2012 WdExt.exe 90 PID 2012 wrote to memory of 1776 2012 WdExt.exe 91 PID 2012 wrote to memory of 1776 2012 WdExt.exe 91 PID 2012 wrote to memory of 5724 2012 WdExt.exe 92 PID 2012 wrote to memory of 4716 2012 WdExt.exe 93 PID 2012 wrote to memory of 5652 2012 WdExt.exe 95 PID 5652 wrote to memory of 1604 5652 cmd.exe 97 PID 1604 wrote to memory of 6140 1604 launch.exe 99 PID 6140 wrote to memory of 968 6140 cmd.exe 101 PID 968 wrote to memory of 4176 968 wtmps.exe 103 PID 700 wrote to memory of 788 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 8 PID 700 wrote to memory of 792 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 9 PID 700 wrote to memory of 524 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 14 PID 700 wrote to memory of 1160 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 51 PID 700 wrote to memory of 752 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 52 PID 700 wrote to memory of 1488 700 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe 53 - System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" @AE4198.tmp.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:788
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:792
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:524
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:1160
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:752
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:1488
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3224
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5832 -
C:\Users\Admin\AppData\Local\Temp\@AE4198.tmp.exe"C:\Users\Admin\AppData\Local\Temp\@AE4198.tmp.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5468 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:5724
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"6⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2012 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "7⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5652 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 20128⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "9⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6140 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV110⤵PID:4024
-
-
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"10⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe11⤵
- Executes dropped EXE
PID:4176
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "5⤵
- System Location Discovery: System Language Discovery
PID:1776 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV16⤵PID:4716
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:700
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3416
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3600
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3692
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3756
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3840
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4052
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:5884
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3296
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4696
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4588
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:5136
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3316
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E584513_Rar\@AE4198.tmp.exe
- Size 1.7MB
- SHA256 4319e26412b34f592a4a6aabdb96c7206d461bd882ad7331c2864323eec11f14
- MD5 3dc28faf205e8446fba2ce06d9552ac8
- SHA1 026042f68eb09dff36952bdcb6826032dee20877
- SHA512 daca7d0ba6ad590a0f802a0f7f4a2cfd4b8f7340f19c68baf4c2bfe843ebb7bf3efecff4a8441a5f23a62a6cce3cb4559204b2d86a2d0bb7cc7656c0d56a97c8
- SSDEEP 49152:mbTChxKCnFnQXBbrtgb/iQvu0UHOaYmLR:m6hxvWbrtUTrUHO29
- TLSH T16885EF252790CD61F36FC07683E16E79B9B329213733D896AE4855312BF2E2FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0E585FEE_Rar\WdExt.exe
- Size 1.7MB
- SHA256 15883b7dba094aee0846d0c88e7edf208b17e80e054c8cac7c3de915b310657a
- MD5 be832dc253fc94217f77e90172a75bfe
- SHA1 f6ff8d6ceda02200c3e82c7c1298cdac31e2e5ac
- SHA512 23989348bffbe65b4004218cfd9544babc868417a98312445a455ade213dc4c37b76aa3c302d09bbe0bf2ff5f8426d0d49fc0b2175bed4908769e5867071d89d
- SSDEEP 49152:mbTC0xKCnFnQXBbrtgb/iQvu0UHOaYmLE:m60xvWbrtUTrUHO2g
- TLSH T1DF85EF252790CD60F36FC07683E16E79B9B329213733D896AE4855312BF2E1FE781196
- MD5 SHA1 SHA512 SSDEEP TLSH
2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe
- Path C:\Users\Admin\AppData\Local\Temp\2026-07-09_74cd071923da4f78c381c1592c78d059_coinminer_darkgate_darpapox_elex_gcleaner_glassworm_nymaim_rhadamanthys_wannacry.exe
- Size 1.5MB
- SHA256 434e755137f5e90724f2384a80f6074578d35a39a70a6a836a2268ba79489f93
- MD5 4b418f7f03f5c31be24413ce23242d05
- SHA1 e906c0e789ad3e1b6a0ff9edf53a3985e1cda5ec
- SHA512 8b5a328cf25b68434902e797a7f7976074b0b2857878017e5ae84b5f99c895f9889dcf8429ad78ab315220c13da12e00a2e49dd846e05605a78ef23bc46f09c7
- SSDEEP 12288:VOxfdRDs8s0QTOe9RVfPLbHQaTntPTL1EEMpSXZwSbllpfZmHQEo6tc3nxsnxznB:VCzL/QhxHrt3KP4bBZIESdDT
- TLSH T10F75520BF4C4F8ABC1F92DBCAB12D242D25879D5349EF786967A3A1CD521F01B43B681
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\751B.tmp
- Size 406B
- SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
- MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
- SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
- SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
- TLSH T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\@AE4198.tmp.exe
- Size 1.8MB
- SHA256 b2fab256e641d06e316eae219f18282494acddbf04e9b2b797fa1eb71df86c81
- MD5 151644cdc4c21f75d99fbe6f1b198706
- SHA1 8c80e6782da9c6a8d97fbf32e605b900d4edde14
- SHA512 d585bbf28c2276ccf761233a488622c01bad1b1f2d0f5243844d46f9dc48ebf9a3d55104b0078c473be0d9e97fd720edc97b9218dd0aaea0de7a4ee41b5a4c4a
- SSDEEP 49152:HbTCaxKCnFnQXBbrtgb/iQvu0UHOaYmLR:H6axvWbrtUTrUHO29
- TLSH T13A95FF212790CD61F36FD07683E52E79B9B325613B33D886AE4855312BF2E2FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\geifu.exe
- Size 1KB
- SHA256 03e0c6c4ca8a24f961477887763397045e67862e059f7494014aefc21891d40e
- MD5 b360fa63134a63f9acfe046d2dfe10d9
- SHA1 b47a7f2ad61c79e454b55e39b0d7500aca753a17
- SHA512 575673255d389fc6667f46931301925bf4bb3030d7a3f6da3d3e7d878f86bb496ad6706e20191a1daa2e177cacda9b677424327bd9d438c1ad109c4222064102
- TLSH T12A11AB4317A9ACBBD2CC227E06C3D006A8BD1C0507F7C8B31F901479A42236A3AF5E15
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp629E.tmp
- Size 229KB
- SHA256 70a392389aecd0f58251e72c3fd7e9159f481061d14209ff8708a0fd9ff584dc
- MD5 6f90e1169d19dfde14d6f753f06c862b
- SHA1 e9bca93c68d7df73d000f4a6e6eb73a343682ac5
- SHA512 f0c898222e9578c01ebe1befac27a3fb68d8fb6e76c7d1dec7a8572c1aa3201bacf1e69aa63859e95606790cf09962bcf7dc33b770a6846bed5bd7ded957b0b3
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp62EE.tmp
- Size 126KB
- SHA256 ae5697f849fa48db6d3d13455c224fcf6ceb0602a1e8ac443e211dd0f32d50f4
- MD5 02ae22335713a8f6d6adf80bf418202b
- SHA1 4c40c11f43df761b92a5745f85a799db7b389215
- SHA512 727d16102bfc768535b52a37e4e7b5d894f5daa268d220df108382c36dcce063afdbc31fd495a7a61305263ec4cd7e92713d894faa35b585c0b379217a1d929c
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp630E.tmp
- Size 89KB
- SHA256 63149ad45db380f5dd15f65d9ceb2611d53a0a66e022483bee4ce2ff7d2610e2
- MD5 09203a9741b91f3a9ed01c82dcb8778d
- SHA1 13e6f3fb169cd6aa5e4d450417a7e15665a2e140
- SHA512 9e9e6fe0dd713417d0e28ba787cf862d55ecda9ee9f3df1eada144657f6a3b6ada1984fd05a3fffcd597a9715383225a8e40b6e5d0d8d39ec0d3a64b8dea9846
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyS:O
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp631F.tmp
- Size 99KB
- SHA256 5ec8093ef5939d1abce1c576097b584fb600b94ad767c1da897f7cb7f0063d26
- MD5 9a27bfb55dd768ae81ca8716db2da343
- SHA1 55da0f4282bd838f72f435a5d4d24ac15b04482b
- SHA512 d9bb49d2f282ed09c351a1d8eb2540781e6a7fb39265473fd59d146bfc162f27a4ab1405301ed7395c12929a80551a399437d7d794d7ac48650e9037b60eb69c
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp634F.tmp
- Size 172KB
- SHA256 27c945ccb84aa024f1f063701327e829a7ef3a7ede4a43b2febbb1dddbdf8740
- MD5 2634fa3a332c297711cb59d43f54ffce
- SHA1 8e2b68d0ee4e792efb1945ba86eceb87f07087d2
- SHA512 84e4799b9b18a7cc7be685c793a9b4fb135ea331d1d235fe823e1d7091130f131ab2fbad1da4dea795e82547aa16b00f4e2a9faaa96cb522d795f9abfda2fc53
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyK:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\tmp636F.tmp
- Size 276KB
- SHA256 d2fa6f9686386a92253a9c5ea25ace702a111483540b60c1300789235cea7fdc
- MD5 e07c6a9e595f045fadc463dfda44ab16
- SHA1 e6b199272ade02613f2003c365a4cb1487431e23
- SHA512 f3c630ae8381b99519aeeadbc2918810e7fb09a909f73ee6c46f4e9d3cf8c5051a5cf763db6a775d6cd8713ccf95a63b18df9ed756fa28276e8d7ab6a47f2cbf
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyX:T
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
- Size 276KB
- SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
- MD5 75c1467042b38332d1ea0298f29fb592
- SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
- SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
- SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
- TLSH T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Common\Shared\dis.dll
- Size 120KB
- SHA256 b0c0c49eed934e6d2ed990913d4c71108f6104352d23f72d3ef0a3ef4074d92e
- MD5 1fcc5b3ed6bc76d70cfa49d051e0dff6
- SHA1 3ffa43efdc893a57dcad3d45c9b14980dd52eb58
- SHA512 8769438aacc26f0a720926f419a2564813dee2f526b2dbb7a3f57d587dc385612bf5780f4e39ce2149de5fb4c1af839dcc099f3d77387989e16d2bc76c6de929
- SSDEEP 3072:PWFWnu/0NPlE+qoytTBf+28aVytl34iQA:PW8nlQ+RytTBV2J
- TLSH T1A0C39E1376D085F7E1B2843099E99F3DEBFBB5318A618AC3574857681E31A50EE123CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
- Size 172KB
- SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
- MD5 daac1781c9d22f5743ade0cb41feaebf
- SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
- SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
- SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
- TLSH T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
- Size 1.8MB
- SHA256 e47fafa4386a539738708a772d68941e15842433c4bba9823afe8b7966be6b2b
- MD5 ffb5ceed5f618d10da77a323dfbdc040
- SHA1 562d3a1658bd7b876efc212a460f6f23dc7208a8
- SHA512 d59753e8df22a77037ecea4284a88d4d62b77657f6a9f15ec3ef4f35e46c615af1ceed0b48a6b5b6145d7daa1f615911e6b198c20a6c27c8d8337ae14f6b9ed2
- SSDEEP 49152:HbTCaxKCnFnQXBbrtgb/iQvu0UHOaYmLE:H6axvWbrtUTrUHO2g
- TLSH T14E95FF212790CD61F36FD07683E52E79B9B325613B33D886AE4855312BF2E2FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
- Size 129B
- SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
- MD5 d1073c9b34d1bbd570928734aacff6a5
- SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
- SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
- TLSH T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 126B
- SHA256 8b073d3ce92d6b02dd7b3a66303dec80f348b96d7d48e4a38da219a02a54a5be
- MD5 da30b92acc4ba122373a83809551ebfa
- SHA1 83d2bb017c61ac795fb38aaf85721fb03f8e2b7c
- SHA512 49dbe00f52cbf99bf2c497a4f531206aa060665f501c277d78843c5fb83e780a0b7ebd8ce11fa8794a4a34aff00fcd2f2308e0050151becf6c08b0dd7a36cfa4
- TLSH T1BEB09B1603CDD70EB45360971775555D50784AC23E947605C611848C3255C0CFC9A549
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 196B
- SHA256 0bd43d9645f6e0c6a63927d74f8dd0f6d95fc108b0269c1ba4c2ac56d7b55be0
- MD5 6c8c1ccee14207e2d1eeee9324f719ab
- SHA1 511957661c26939521c217b719cae21a3ce81f21
- SHA512 879392b3b109de1d551f06c5961e5bbebba1a3bd7e386216d58bcd318cdbb95f63b86a4f994b69d4c08e969717f553a86bd6fc6fb3444987db73ebcc9ad64288
- TLSH T197D0120683C6C79D684464570FB5519DD2F84AED3F89373A8A22C55C218151DB993601
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
- Size 102B
- SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
- MD5 3ca08f080a7a28416774d80552d4aa08
- SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
- SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
- TLSH T114B0121243CBCF0D148060D70775A1CCC0740C983F947714DF11C84C314080DFDC6A41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 388KB
- SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
- MD5 8d7db101a7211fe3309dc4dc8cf2dd0a
- SHA1 6c2781eadf53b3742d16dab2f164baf813f7ac85
- SHA512 8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83
- SSDEEP 12288:PDCOy/psISIHbl9f/mnmO/5Se71RpNJmq3CrP:RyRznmnp5SedNJBCL
- TLSH T1E3843A12B7A98025D6F30A74263DB536A4397C750F50EEEB73250B6DA830FC1DB79A12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 294b4b6190b03b9fb91f3571db5dc27751cd6bb96217b6c6ed99a48572c7790a
- MD5 60ffbcaecd6400b23b3f7a0c2d88d41b
- SHA1 411ec9b540281c0b8f2e6a063fdc17895024a6b5
- SHA512 4ef45e48f6573176035f0b6b4f71e3d5f5aad70d1b651930c6ca56bca09e3cffd36ec1b82451fa4a50730858d9b43c0b8b5e15e66144ec853baa58deee8120fa
- TLSH T1DDD05E0E4BDD51ADA052006F3178D4C2723D9F11DC720F4C5139674164286D9BF7E2AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mscaps.exe
- Size 200KB
- SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
- MD5 78d3c8705f8baf7d34e6a6737d1cfa18
- SHA1 9f09e248a29311dbeefae9d85937b13da042a010
- SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
- SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
- TLSH T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path F:\jymwr.pif
- Size 97KB
- SHA256 7078c1b836c9feb886119b8c153975362f340a4a791180d44a60a15602692af8
- MD5 0e2e3c47832ce129ea4321c1db61029d
- SHA1 548fbb9ee1baaa364e0a3c0730989c42eab7d450
- SHA512 26ab711fc41373acc74e5021038f4fb308110701c604f0d0fad798ab4e2faefa89c3ed3bac4ba1309a18e46269f75383bb51ca2afe55ff8000b2620d3ce3bf0a
- SSDEEP 3072:kKCxFL0pXwVfegjnTWEDgBSdKtHs+yqfkCgHZd:8xFAV0O9gKGq2
- TLSH T12EA312F211FA8CE7CC4D24B9ECB690AC4132BD45938BDD7178C004E2A979F9D772A529
- MD5 SHA1 SHA512 SSDEEP TLSH