Analysis
- max time kernel
148s - max time network
132s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
28/07/2026, 22:48
Behavioral task
behavioral1
Sample
2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe
- Size 683KB
- Sample260728-2rbm8abl3x
- SHA256 666b26044c9ade33735bc71b4fcc59e3cd668bcb8bd3c17e817d9846397d4582
- MD5 6e75747240506479e116f4ab937f6a98
- SHA1 273884579374b9c91d59d7d98242bab3048776bf
- SHA512 ea14f27660cb6a1169a9edcab569e9097279caa9cd6dc7bdda7acde2f61a63f4535c53b90202e984cd2878672cdf6f7d5926e93eebe95ebc87185865a4b54bfa
- SSDEEP 12288:vj9cw63ct47h4QKAzYzTFAg7Hqa+b1NF18QFU3/sNgC59+0RsaW:vj9cw63ct04QFzY11+Hj3Fk/3a9hsaW
- TLSH T196E46D12F34288B1CA7706B90497A7765638E9104721DBC7BB44EBD86F732D1AE39B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\DbTasker.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\DBTASK.EXE 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\dbexe2.dll 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\regedit.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\DbTasker.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\hal.dll 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\dbzip2.dll 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\LockFile.dat 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe -
resource yara_rule behavioral1/memory/1328-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/files/0x0007000000024661-5.dat upx behavioral1/memory/1328-1004-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral1/memory/1328-2355-0x0000000000400000-0x0000000000450000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Internet Explorer\ExtExport.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Program Files (x86)\Internet Explorer\ielowutil.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\nb-no\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\sv-se\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\de\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\tnameserv.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\symbols\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\ru-ru\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\tr-tr\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\msinfo\ja-jp\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\fi-fi\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\nl-nl\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\it\Pamela Anderson FULL VIDEO.mpg .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath_target_83765\javaw.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\identity_helper.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-br\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\fr-ca\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\office16\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\NORTON Internet security 2006.rar .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\WinAmp 5.08 FULL.zip ÅÜúðÉØúðædc:\program files\common files\microsoft shared\ink\de-de\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\miÀèdc:\program files\common files\microsoft shared\inÅÜúðÉØúðædc:\program files\common files\microsoft shared\ink\pt-br\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\Internet Explorer\iexplore.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\pt-pt\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\msinfo\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Program Files\Windows Photo Viewer\ImagingDevices.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\miÀèdc:\program files\common files\microsoft shared\inÅÜúðÉØúðædc:\program files\common files\microsoft shared\ink\en-gb\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\stationery\Internet Explorer 7 FULL BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\dotnet\dotnet.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\policytool.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\osmadminicon.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\WinAmp 5.08 FULL.zip ÅÜúðÉØúðædc:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Pamela Anderson FULL VIDEO.mpg .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\es\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\elevation_service.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{26DAE493-BB25-4AFA-A100-0B8EFB02FE62}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_32\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\assembly\GAC_32\MSBuild\3.5.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrobroker.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\WFServicesReg.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\WsatConfig\v4.0_4.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regbrowsers.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\reader_sl.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regsql.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\vbc.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Boot\PCAT\memtest.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\acrotextextractor.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_compiler.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\dfsvc.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ServiceModelReg.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CasPol.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMConfigInstaller.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\WsatConfig.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\vbc.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\notepad.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\WsatConfig.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\WinTask.zip 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\PresentationFontCache\3.0.0.0__31bf3856ad364e35\PresentationFontCache.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\explorer.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\ImmersiveControlPanel\SystemSettings.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\XamlViewer\XamlViewer_v0300.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\assembly\GAC_MSIL\WsatConfig\3.0.0.0__b03f5f7f11d50a3a\WsatConfig.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\InstallUtil.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInUtil.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\jsc.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B744CAF070E41400\15.7.20033\wow_helper.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\DataSvcUtil.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\AppLaunch.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\PrintDialog\PrintDialog.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\bfsvc.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\assembly\GAC_64\MSBuild\v4.0_4.0.0.0__b03f5f7f11d50a3a\MSBuild.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\NETFXSBS10.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ilasm.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1764 1328 WerFault.exe 84 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\msinfo\en-us\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ for Dummies.pdf .exec:\program files\common files\microsoft shared\office16\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\pûŽc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\als.txt .cmdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\es\Kazaa Lite 2005 Edition.rar .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Hyc:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Èxc:\program files\common files\microsoft shared\ink\pt-br\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Úúð`çdc:\program files\common files\microsoft shared\msinfo\fr-fr\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`vLêdc:\program files\common files\microsoft shared\officesoftwareprotectionplatform\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\vsto\10.0\DVD Xcopy PRO Illegal Warez.iso .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`v¼çdc:\program files\common files\microsoft shared\ink\ar-sa\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\uk-ua\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\miuÚúðyÖúð¨èdc:\program files\common files\microsoft shared\vc\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`vLêdc:\program files\common files\microsoft shared\vsto\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\üÿÿÿc:\program files\common files\microsoft shared\NORTON Internet security 2006.rar .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\0ædc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\tr\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Úúð`çdc:\program files\common files\microsoft shared\ink\es-mx\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Úúð`çdc:\program files\common files\microsoft shared\msinfo\en-us\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\th-th\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\áÜúðÐädc:\program files\common files\microsoft shared\vsto\10.0\1033\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\2c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\Visual Studio .NET FULL.zip .cpl 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\lv-lv\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\ro-ro\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\H}c:\program files\common files\microsoft shared\ink\sr-latn-rs\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\miÀèdc:\program files\common files\microsoft shared\inÅÜúðÉØúðædc:\program files\common files\microsoft shared\ink\sl-si\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`v¼çdc:\program files\common files\microsoft shared\triedit\en-us\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Ûdc:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP2 WORKING activation crack.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\ink\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`v¼çdc:\program files\common files\microsoft shared\msinfo\ja-jp\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\@¢w(‚Šc:\program files\common files\microsoft shared\triedit\en-us\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Ùúððédc:\program files\common files\microsoft shared\clicktorun\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\ar-sa\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`vLêdc:\program files\common files\microsoft shared\msinfo\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ÿc:\program files\common files\microsoft shared\clicktorun\DVD Xcopy PRO Illegal Warez.iso .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ð÷Žc:\program files\common files\microsoft shared\vsto\10.0\1033\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ .cmdc:\program files\common files\microsoft shared\ink\cs-czc:\program files\common files\microsoft shared\ink\cs-cz\Kazaa Lite 2005 Edition.rar .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\es-mx\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\textconv\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\H.þÿÿÿ¤Ödc:\program files\common files\microsoft shared\vsto\10.0\1033\Windows XP SECRET DEVELOPER serials.txt .cmd 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\H.þÿÿÿ4Ùdc:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\Windows XP SECRET DEVELOPER serials.txt .cmd 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`v¼çdc:\program files\common files\microsoft shared\ink\fi-fi\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\ink\hu-hu\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`v¼çdc:\program files\common files\microsoft shared\ink\it-it\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Úúð`çdc:\program files\common files\microsoft shared\ink\da-dk\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\áÜúðÐädc:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ .cplc:\program files\common files\microsoft shared\ink\he-il\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\0üŽc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\pl\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ˆóc:\program files\common files\microsoft shared\ink\cs-cz\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`v¼çdc:\program files\common files\microsoft shared\ink\pl-pl\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`v¼çdc:\program files\common files\microsoft shared\msinfo\fr-fr\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ .pif\Windows XP SECRET DEVELOPER serials.txt ÅÜúðÉØúðædc:\program files\common files\microsoft shared\msinfo\it-it\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ôãdc:\program files\common files\microsoft shared\office16\office setup controller\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ .scrc:\program files\common files\microsoft shared\triedit\Visual Studio .NET FULL.zip .cpl 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\áÜúðÐädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\es\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\f&VFÇM°Û1{9³Å #u ÑuœÜdc:\program files\common files\microsoft shared\clicktorun\Windows XP SECRET DEVELOPER serials.txt .cmd 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\miÀèdc:\program files\common files\microsoft shared\inÅÜúðÉØúðædc:\program files\common files\microsoft shared\ink\en-us\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\È{c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\miÀèdc:\program files\common files\microsoft shared\ink\ru-ru\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`v¼çdc:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Úúð`çdc:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Úúð`çdc:\program files\common files\microsoft shared\ink\fr-ca\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`vLêdc:\program files\common files\microsoft shared\ink\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Úúð`çdc:\program files\common files\microsoft shared\msinfo\de-de\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`v,ådc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\zh-hans\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\,]`vLêdc:\program files\common files\microsoft shared\clicktorun\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 1328 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1328 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1328 -s 161042⤵
- Program crash
PID:1764
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1328 -ip 13281⤵PID:2456
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 896KB
- SHA256 ae88d7a7923696291e115a6f3fe4b024326fe1a9a2af21f1b83f91505a22c0a5
- MD5 1c371cafd7bdb7c9aad837ec779dfc14
- SHA1 15616f6e9b8980e96c0109e59728e780a8c82cec
- SHA512 38a71209d776ab5bf563c976c9ed4d310c7ca56df2e72b905582241f13fef7992a0200ba54ac3316573e36b510c63f25c5a4053c4d3c2d251a6b25db13f8b3ef
- SSDEEP 24576:vj9cw63ct04QFzY11+Hj3Fk/3a9hsaiVbqPb88R:vj9cxcO4Q5Y11+Hj3O/3JVO88R
- TLSH T161157D26F34140B1D57242B985C7A73BD634B94143318ACBAB84DBD86F736E1993DB23
- MD5 SHA1 SHA512 SSDEEP TLSH