Analysis
- max time kernel
149s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/07/2026, 22:48
Behavioral task
behavioral1
Sample
2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe
- Size 683KB
- Sample260728-2rbm8abl3x
- SHA256 666b26044c9ade33735bc71b4fcc59e3cd668bcb8bd3c17e817d9846397d4582
- MD5 6e75747240506479e116f4ab937f6a98
- SHA1 273884579374b9c91d59d7d98242bab3048776bf
- SHA512 ea14f27660cb6a1169a9edcab569e9097279caa9cd6dc7bdda7acde2f61a63f4535c53b90202e984cd2878672cdf6f7d5926e93eebe95ebc87185865a4b54bfa
- SSDEEP 12288:vj9cw63ct47h4QKAzYzTFAg7Hqa+b1NF18QFU3/sNgC59+0RsaW:vj9cw63ct04QFzY11+Hj3Fk/3a9hsaW
- TLSH T196E46D12F34288B1CA7706B90497A7765638E9104721DBC7BB44EBD86F732D1AE39B13
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\Drivers\ETC\HOSTS 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\system32\Drivers\ETC\HOSTS\HOSTS 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\System Database Administration Service = "C:\\Windows\\system32\\DbTasker.exe" 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\SysWOW64\LockFile.dat 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\DbTasker.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\hal.dll 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\DBTASK.EXE 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\dbzip2.dll 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\dbexe2.dll 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe -
resource yara_rule behavioral2/memory/3856-0-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/files/0x000c00000001c5bc-5.dat upx behavioral2/memory/3856-297-0x0000000000400000-0x0000000000450000-memory.dmp upx behavioral2/memory/3856-412-0x0000000000400000-0x0000000000450000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\qps-plocm\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\sl-si\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\sv-se\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\msinfo\es-es\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\msinfo\de-de\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\ru\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\de\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\en-gb\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\msinfo\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\it\Pamela Anderson FULL VIDEO.mpg .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ru\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\as-in\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\az-latn-az\Internet Explorer 7 FULL BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\cs-cz\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\gl-es\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\ko-kr\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\sq-al\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\uk-ua\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\de\Pamela Anderson FULL VIDEO.mpg .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\6.0.27\Playboy centerfold HOT.gif .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\8.0.15\Pamela Anderson FULL VIDEO.mpg .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\clicktorun\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\ca-es\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\ga-ie\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\fi-fi\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\auxpad\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\tr\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\it\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\es-mx\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\or-in\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.netcore.app\7.0.16\Pamela Anderson FULL VIDEO.mpg .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Google\Chrome\Application\140.0.7339.81\chrome_pwa_launcher.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\msinfo\fr-fr\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\vsto\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskmenu\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\osknumpad\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\fsdefinitions\oskpred\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\pack200.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\be-by\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\bg-bg\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\mk-mk\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\office16\office setup controller\Playboy centerfold HOT.gif .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\vsto\10.0\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\ml-in\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\common files\microsoft shared\ink\zh-tw\How to stop NetSky.doc .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\de\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ko\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File opened for modification C:\Program Files\Java\jre-1.8\bin\javaw.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\WinTask.zip 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1692 3856 WerFault.exe 87 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - NTFS ADS 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\vsto\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\it\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ê @@ædc:\program files\common files\microsoft shared\clicktorun\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\df c:\program files\common files\microsoft shared\ink\fsdefinitions\WinAmp 5.08 FU¼UDw @ædc:\program files\common files\microsoft shared\ink\id-id\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ .exe\Windows XP Sc:\program files\common files\microsoft shared\msinfo\de¼UDw @ædc:\program files\common files\microsoft shared\msinfo\en-us\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ko\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\@œ†c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\pl\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\cs\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\ja\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\af-za\Internet Explorer 7 FULL BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\€c:\ \program files\common files\ÿc:\program files\common files\microsoft shared\ink\ar-sa\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\þÿÿÿc:\program files\common files\microsoft shared\ink\fsdefinitions\oskclearui\Pamela Anderson FULL VIDEO.mpg .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\sk-sk\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\ur-pk\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\š@°ãdc:\program files\common files\microsoft shared\msinfo\it-it\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\msinfo\it-it\Internet Explorer 7 FULL BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\tr\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\df c:\program files\common files\mc:\program files\common files\microsoft shared\ink\mk-mk\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\de\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ @ ádc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\de\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\tr\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\DEO.mpg c:\progrc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\zh-hans\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\am-et\Internet Explorer 7 FULL BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\€c:\c:\program files\common files\microsoft shared\ink\es-mx\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\df c:\program files\common files\mc:\program files\common files\microsoft shared\¼UDw @ædc:\program files\common files\microsoft shared\ink\sq-al\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\š@°ãdc:\program files\common files\microsoft shared\ink\ug-cn\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\š@°ãdc:\program files\common files\microsoft shared\msinfo\ja-jp\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\À©†c:\program files\common files\microsoft shared\officesoftwareprotectionplatform\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\cs\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ @ ádc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ru\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\common files\microsoft shared\ink\af-za\DVD Xcopy PRO Illegal Warez.iso .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\nguagemodel\dc:\program files\common files\microsoft shared\ink\uz-latn-uz\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ .exec:\program files\common files\microsoft shared\vsto\10.0\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\pt-br\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\zh-hant\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ c:\program files\common files\microsoft shared\ink\af-za\NORTON Internet security 2006.rar .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\š@°ãdc:\program files\common files\microsoft shared\ink\da-dk\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program fdc:\program files\common files\microsoft shared\ink\id-id\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\df c:\program files\common files\mc:\program files\common files\microsoft shared\ink\is-is\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\€‘†c:\program files\common files\microsoft shared\ink\ka-ge\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\Internet Explorer 7 FULL BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\programdc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\de\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ @ ádc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\ja\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\€c:\c:\program files\common files\microsoft shared\ink\et-ee\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created \??\c:\program fdc:\program files\common files\microsoft shared\ink\ka-ge\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\nguagemodel\dc:\program files\common files\microsoft shared\ink\sr-cyrl-rs\Windows 2000.iso .com 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\š@°ãdc:\program files\common files\microsoft shared\office16\office setup controller\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.netcore.app\NORTON Internet security 2006.rar .scr 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\fr\Hacking for Dummies.pdf .cpl 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\7.0.16\it\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\Ðädc:\program files\dotnet\shared\microsoft.windowsdesktop.app\8.0.15\it\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\€‘†c:\program files\common files\microsoft shared\ink\af-za\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\~‚w}"“ c:\program files\common files\microsoft shared\ink\fsdefinitions\keypad\Full warez download sites.html .pif 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\ms-my\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\€‘†c:\program files\common files\microsoft shared\ink\mt-mt\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\pt-br\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\df c:\program files\common files\mc:\program files\common files\microsoft shared\¼UDw @ædc:\program files\common files\microsoft shared\ink\sl-si\WinAmp 5.08 FULL.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\vi-vn\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\c:\program files\dotnet\shared\microsoft.windowsdesktop.app\6.0.27\cs\DVD Xcopy PRO Illegal Warez.iso .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\ac:\program files\common files\microsoft shared\clicktorun\Internet Explorer 7 FULL BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\š@°ãdc:\program files\common files\microsoft shared\ink\el-gr\Windows XP SP3 REAL VERSION.zip .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\is-is\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\€‘†c:\program files\common files\microsoft shared\ink\kok-in\Hacking and Virus Writing for Dummies.pdf .exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe File created C:\Users\Admin\AppData\Local\Temp\`çdc:\program files\common files\microsoft shared\ink\sr-cyrl-ba\WinRAR 4.01 Cracked BETA.exe 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe 3856 2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-28_6e75747240506479e116f4ab937f6a98_amadey_elex_glassworm_wannacry.exe"1⤵
- Drops file in Drivers directory
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3856 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3856 -s 44882⤵
- Program crash
PID:1692
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 228 -p 3856 -ip 38561⤵PID:4772
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\wkw4D2.tmp
- Size 640KB
- SHA256 19a885a8956341eb85d66919629c791a8755cb06e3a51616a3b464eb0761022c
- MD5 5a7660746d5f9bf93b289074451f9330
- SHA1 08de35d0617d1e744c78d29474b5730c596bc526
- SHA512 644f0371137eb702402edf887db1fae67f0d05d308d6b997f95d108b95b786695a89f46f175e61a3ed2826b23ed728c15f8d3ff1e6bf45e23068788f4b9395d8
- SSDEEP 12288:vj9cw63ct47h4QKAzYzTFAg7Hqa+b1NF18QFU3/sNgC59+0R:vj9cw63ct04QFzY11+Hj3Fk/3a9h
- TLSH T1FDD46C12F34288B1CA7306B50497A6775638E9144722DBC7BB84EBD86F732D16E39B13
- MD5 SHA1 SHA512 SSDEEP TLSH