Analysis
- max time kernel
148s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 21:59
Behavioral task
behavioral1
Sample
2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe
- Size 123KB
- Sample260802-1v17lsgd36
- SHA256 1ddd4b2fba5d3ee7937adbfea1a7aba7cc472457faa918c2d66db4cc7ccf6eaf
- MD5 297c24fba9ffc2261ea4e14a583fd594
- SHA1 7d00f8f6358d52949f63df92b64c10909ca2083f
- SHA512 b53140d2f90c644208ef7475595e9c7e302a9389f52ffc41f9e8fb00b2ef844a7f34ae165b5ed90169c7e62397ca377a7a790b50afe7dd63366897fb63e763bf
- SSDEEP 3072:tjWTFoHKITkBXkHBDHsl3piopbuHzeF4ajomCP14:tjC+qITkBXkHhIi6VC94
- TLSH T187C36D02BBE4843AE2A30DF059B6AB161276BE341ED41F8FA7543F8E9D35684D139317
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\ktmutil.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\more.com 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_isv.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\fltMC.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\LaunchTM.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\RMActivate_ssp_isv.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\InputSwitchToastHandler.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\PickerHost.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\PresentationHost.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\rasdial.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\wusa.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\cacls.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\comp.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\relog.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\TCPSVCS.EXE- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\unlodctr.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\SearchProtocolHost.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\autochk.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\ftp.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\gpresult.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\MRINFO.EXE- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\provlaunch.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\TRACERT.EXE- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\compact.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\logman.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\msinfo32.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\print.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\reg.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\Com\MigRegDB.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\PhotoScreensaver.scr- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\colorcpl.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\eventvwr.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMEPADSV.EXE- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\ktmutil.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\poqexec.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\systray.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\wbem\WinMgmt.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\IME\IMETC\IMTCPROP.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\scrnsave.scr- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\shutdown.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\doskey.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\tasklist.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\rasautou.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\rundll32.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\sdiagnhost.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\mavinject.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\PasswordOnWakeSettingFlyout.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\SysWOW64\timeout.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe -
resource yara_rule behavioral2/memory/5012-0-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/files/0x000e00000001c553-5.dat upx behavioral2/memory/5012-1104-0x0000000000400000-0x0000000000410000-memory.dmp upx behavioral2/memory/5012-2918-0x0000000000400000-0x0000000000410000-memory.dmp upx - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\pubs.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jdb.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\ktab.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\VideoLAN\VLC\vlc.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Windows Defender\NisSrv.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\64BitMAPIBroker.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\rmid.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\unpack200.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\officeappguardwin32.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\msedge_proxy.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\MicrosoftEdgeUpdate.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Google\Chrome\Application\chrome_proxy.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\klist.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Mozilla Firefox\pingsender.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jstat.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Windows Defender\MpCmdRun.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Windows Defender\MsMpEng.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Windows Media Player\wmpnscfg.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Windows Media Player\wmpshare.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\disabledupdater.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\BHO\ie_to_edge_stub.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\servertool.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\wordicon.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\show_third_party_software_licenses.bat 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\MicrosoftEdgeUpdate.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\pwahelper.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\show_third_party_software_licenses.bat- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ink\TabTip.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\rmic.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Windows Media Player\setup_wm.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Install\{8F4E2A33-DC18-4884-A646-9283C13498CD}\MicrosoftEdge_X64_139.0.3405.125.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Windows Defender\MpDefenderCoreService.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Windows Media Player\wmpconfig.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Internet Explorer\ieinstal.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\misc.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Windows Defender\MpDlpCmd.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Windows Mail\wab.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wab.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.26100.1591_none_68327241782dd35b\AppVNice.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-winrsplugins_31bf3856ad364e35_10.0.26100.1150_none_b21dc6dde1913832\r\winrs.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-m..-management-console_31bf3856ad364e35_10.0.26100.1742_none_b56d38775a1eaac9\r\mmc.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.26100.1591_none_afc2e5d4c65ca426\PinningConfirmationDialog.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..riencehost.appxmain_31bf3856ad364e35_10.0.26100.1591_none_989a65f2aef55b28\r\ShellExperienceHost.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.26100.1_none_ec48597b611b680a\systeminfo.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_msbuild_b03f5f7f11d50a3a_4.0.15912.0_none_07ea43e35ad4fd3b\MSBuild.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..riseclientsync-host_31bf3856ad364e35_10.0.26100.1591_none_69d37612269b8f36\WorkFolders.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..-network-management_31bf3856ad364e35_10.0.26100.1591_none_6022424238410d39\nmscrub.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-securestartup-cpl_31bf3856ad364e35_10.0.26100.1591_none_f346527b3b1f36f2\BitLockerWizardElev.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-extrac32_31bf3856ad364e35_10.0.26100.1_none_e271ed51a0d2c02e\extrac32.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-r..sistance-dcomserver_31bf3856ad364e35_10.0.26100.1_none_373bf2a6128009cf\raserver.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..roblemstepsrecorder_31bf3856ad364e35_10.0.26100.1591_none_76b18c52fb009a32\psr.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-expand_31bf3856ad364e35_10.0.26100.1_none_556624dcc06d0b8d\expand.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-h..public-utils-shared_31bf3856ad364e35_10.0.26100.1591_none_ffa10fa7b29d4d78\hvsiproxyapp.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..line-user-interface_31bf3856ad364e35_10.0.26100.1150_none_78cec33b8cc1ebd0\r\cmdkey.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-update-uus-core-ux_31bf3856ad364e35_10.0.26100.1591_none_8f2563a7ac59897b\MoNotificationUx.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wab-app_31bf3856ad364e35_10.0.26100.1_none_3f9d05e1401f38e7\wab.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-g..policy-cmdlinetools_31bf3856ad364e35_10.0.26100.1_none_42b151b278e19c01\gpupdate.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-appmanagement-appvwow_31bf3856ad364e35_10.0.26100.1591_none_4ef9c76ea26d9c67\r\mavinject.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..vironment-os-loader_31bf3856ad364e35_10.0.26100.1742_none_f6cbfd471cc28a5c\r\winload.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..x-directxdiagnostic_31bf3856ad364e35_10.0.26100.1591_none_bf8393590dcad014\r\dxdiag.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.26100.1_none_065309a92fd714e9\poqexec.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-sort_31bf3856ad364e35_10.0.26100.1150_none_47a573c9c96cd2e9\r\sort.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\CBS\MiniSearchHost.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\x86_netfx4-mscorsvw_exe_b03f5f7f11d50a3a_4.0.15912.0_none_c6c9a6c536b87ee9\mscorsvw.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-onecore-gameinputsvc_31bf3856ad364e35_10.0.26100.1301_none_2476c9fd1a91bf33\GameInputSvc.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lxss-wsl_31bf3856ad364e35_10.0.26100.1150_none_1ed5d4d47eca0768\wsl.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-webcamexperience_31bf3856ad364e35_10.0.26100.1150_none_08d020c05bb7ff70\r\CameraSettingsUIHost.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_multimedia-rrinstaller_31bf3856ad364e35_10.0.26100.1150_none_aed4fccd3d3ea792\rrinstaller.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_openssh-common-components-onecore_31bf3856ad364e35_10.0.26100.1_none_b99a252d184bf301\scp.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_userexperience-desktop_31bf3856ad364e35_10.0.26100.1591_none_c815e77f1a5104dd\r\CBS\WindowsBackupClient.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_winappsdk-cbs_31bf3856ad364e35_10.0.26100.1591_none_60aad032a4073cbd\r\DeploymentAgent.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-o..onalfeatures-fondue_31bf3856ad364e35_10.0.26100.1150_none_e59c5dab3c0f4ed2\r\Fondue.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-parentalcontrols-ots_31bf3856ad364e35_10.0.26100.1150_none_2e4aac6427dee1fd\r\ApproveChildRequest.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-trustedinstaller_31bf3856ad364e35_10.0.26100.1150_none_2cf483fafd109e7e\r\TrustedInstaller.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-wmi-core_31bf3856ad364e35_10.0.26100.1150_none_553b538bcf828876\r\WmiApSrv.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-usercpl-usermgrbroker_31bf3856ad364e35_10.0.26100.1_none_1df4641271a5054b\UserAccountBroker.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ime-eashared-imepad_31bf3856ad364e35_10.0.26100.1591_none_d64c3d514f37d908\IMEPADSV.EXE- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..ting-lprportmonitor_31bf3856ad364e35_10.0.26100.1_none_b0f749e1a65b338a\lpr.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-printing-spooler-core_31bf3856ad364e35_10.0.26100.1591_none_720b9e48718f9c5a\spoolsvworker.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-user-choice-protection_31bf3856ad364e35_10.0.26100.1591_none_40b544c10dfa1d6f\UCPDMgr.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-w..for-management-core_31bf3856ad364e35_10.0.26100.1150_none_664cc5d65cf1b4d8\WSManHTTPConfig.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.26100.1591_none_069d7eb507aa0068\SearchFilterHost.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mspaint_31bf3856ad364e35_10.0.26100.712_none_3a9448740bd98799\mspaint.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess32.exe 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-ecapp.appxmain_31bf3856ad364e35_10.0.26100.1150_none_98f799d63c0fa1b8\r\Microsoft.ECApp.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\umount.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-advancedtaskmanager_31bf3856ad364e35_10.0.26100.1742_none_54e0c846cffbbd55\Taskmgr.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-diskpart_31bf3856ad364e35_10.0.26100.1_none_7020b80d32da4344\diskpart.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\x86_caspol_b03f5f7f11d50a3a_10.0.26100.1_none_10165438a36843ef\CasPol.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\dfsvc.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvsystem_31bf3856ad364e35_10.0.26100.1150_none_e501748828a1adac\r\AppVClient.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.26100.1150_none_8097a9dca8ee24c4\rwinsta.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-scripting_31bf3856ad364e35_10.0.26100.1591_none_ee7cf88ee4c18aba\cscript.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sysinfo_31bf3856ad364e35_10.0.26100.1_none_f69d03cd957c2a05\systeminfo.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v3.5\AddInProcess.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-attrib_31bf3856ad364e35_10.0.26100.1_none_af81c311f4c11a95\attrib.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-nfs-clientcmdtools_31bf3856ad364e35_10.0.26100.1150_none_ed4ab399a05c1619\r\mount.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\WinSxS\msil_jsc_b03f5f7f11d50a3a_10.0.26100.1_none_4c13a06c8b009cc4\jsc.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe- 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_297c24fba9ffc2261ea4e14a583fd594_amadey_elex_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5012
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7zFM.exe-
- Size 1.1MB
- SHA256 37f2fea402935250c42c11ca1a25d336aef8292e0b430854b0a56b533c1c5d00
- MD5 df85c6f67fabd7ca1b8e122215cfd0f7
- SHA1 0e35eccba880358888f66bd4a1200ad0c0029559
- SHA512 a6227e841ba1c0ba2c864f114dadf2b06e0195083edc850dd562166f4ab99ecde9c6c608bd86f5962de7760f4f7d0d04cbba306cfb1a442f566ddbcf6f2f33fc
- SSDEEP 12288:1II98vaa81soeyezSC6v/ciLKK3kg5aqghpSy1TIPxTmqCLwKzu/G:1IIOa7/ezSC6vUyD/aqgrvWx6q8wyue
- TLSH T15B350815F5788323D0B2D0BAC5D6BA9AFE3234465B3089CB0246976C3E277E6C536739
- MD5 SHA1 SHA512 SSDEEP TLSH