Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 00:30
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe
- Size 52KB
- Sample260802-atl37aah98
- SHA256 9a2557d4af2b6d56d4fbf8dd3848d3df97d8b7e52785622ad015395428589c2e
- MD5 70f596c2a83dd2e4de6f3e72551293eb
- SHA1 8e43cd1e9d776cbdd8458152598f047822fbf334
- SHA512 724503e54c16ddc5051f437e605fa7a85ba741427ae45a638056438d4aaa4dacb4976d8a3b36d7aec4518579a2246fb2f4eca1e87bcfedfad12820cb30a9f1ed
- SSDEEP 768:FlQ4hrvaEGU4aikqykezg2XpfYd/MjYioRoV3Gl5:fLhE1Dezg2ZfYpBoxU5
- TLSH T16D337C13B9ED4573DD518AB114BB0B3B6B3BF9120251118BAF08DD9E7DB22849D3236B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\N: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\P: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\R: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Y: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\I: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Q: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\W: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Z: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\S: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\G: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\K: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\L: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\M: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\T: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\U: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\V: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\D: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\H: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\O: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\X: 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\TSTHEME.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WUSA.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COLORCPL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DRIVERQUERY.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\MOFCOMP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CERTREQ.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DISM\DISMHOST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICPL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PREVHOST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP_ISV.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NDADMIN.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULTSECURE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CMD.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CURL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHWINAPP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSINFO32.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NOTEPAD.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WHERE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DDODIAG.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RASDIAL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\APPVDLLSURROGATE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CONTROL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MFPMP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PACKAGEDCWALAUNCHER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RUNDLL32.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESCOMPUTERNAME.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GPSCRIPT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IEUNATT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPUEXC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PERFHOST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TYPEPERF.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ICACLS.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CIPHER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\AT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DVDPLAY.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NETSH.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NEWDEV.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ROBOCOPY.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SDBINST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CALC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DXDIAG.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MRINFO.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RDRLEAKDIAG.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SORT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPROTECTION.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESREMOTE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TOKENBROKERCOOKIES.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCPROP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSAPROXY.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SPATIALAUDIOLICENSESRV.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TASKLIST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTCONTROLSETTINGS.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWS.WARP.JITSERVICE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ARP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BTHUDTASK.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EXTRAC32.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMCCPHR.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\OPENFILES.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVADOC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\EXCEL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\1.3.195.65\MICROSOFTEDGEUPDATESETUP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE16\LICLUA.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\POLICYTOOL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\MSOXMLED.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0409-1000-0000000FF1CE}\MISC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\JAVA\JAVA UPDATE\JAUREG.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\MSEDGE_PROXY.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\7-ZIP\UNINSTALL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEINSTAL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\POLICYTOOL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\MSOICONS.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-040C-1000-0000000FF1CE}\MISC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-006E-0409-1000-0000000FF1CE}\MISC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\8.0.15\CREATEDUMP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\INSTALLER\CHRMSTP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MISC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\DW\DW20.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MPDEFENDERCORESERVICE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\NISSRV.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\MSEDGE_PWA_LAUNCHER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MAIL\WABMIG.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAWS.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SELFCERT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\WORDCONV.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PINGSENDER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\PWAHELPER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JMAP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KLIST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\APPSHARINGHOOKCONTROLLER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\ELEVATION_SERVICE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\MSEDGEWEBVIEW2.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATEONDEMAND.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\BHO\IE_TO_EDGE_STUB.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVSHNOTIFY.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\PWAHELPER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\NOTIFICATION_HELPER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JABSWITCH.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMIREGISTRY.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSQRY32.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.EDGE.GAMEASSIST_1.0.3456.0_X64__8WEKYB3D8BBWE\EDGEGAMEASSIST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\CHROME_PWA_LAUNCHER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\EXTCHECK.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSESAMPLEUPLOADER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVA.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAFXPACKAGER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOSYNC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OHUB32.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MPCMDRUN.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\TABTIP32.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGECOMREGISTERSHELLARM64.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMIC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVACPL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\EXCELCNV.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\1.3.195.65\MICROSOFTEDGEUPDATECORE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\IEEXEC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..RVICES-ADAM-INSTALL_31BF3856AD364E35_10.0.26100.1150_NONE_B8BBAAA483060B58\R\ADAMUNINSTALL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-VERCLSID_31BF3856AD364E35_10.0.26100.1_NONE_C32F23E8B061A8A0\VERCLSID.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..OR-NATIVE-SERVERBOX_31BF3856AD364E35_10.0.26100.1150_NONE_0BA6100513FBB80D\R\RMACTIVATE_SSP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-EASINVOKER_31BF3856AD364E35_10.0.26100.1_NONE_8917E9DC16872BC9\EASINVOKER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-APPMANAGEMENT-APPVWOW_31BF3856AD364E35_10.0.26100.1591_NONE_594E71C0D6CE5E62\R\APPVDLLSURROGATE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SETX_31BF3856AD364E35_10.0.26100.1_NONE_B3BF2881B5FDBF6E\SETX.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-WAB-APP_31BF3856AD364E35_10.0.26100.1_NONE_49F1B033747FFAE2\WAB.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..EXTSERVICE.APPXMAIN_31BF3856AD364E35_10.0.26100.1_NONE_4B95A6089B289B29\MICROSOFT.ASYNCTEXTSERVICE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPMANAGEMENT-UEVAGENT_31BF3856AD364E35_10.0.26100.1591_NONE_986BA09695018480\R\MICROSOFT.UEV.SYNCCONTROLLER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-HVSI-SERVICE-SHARED_31BF3856AD364E35_10.0.26100.1301_NONE_22D8CFB46252DD83\WDAGNETDIAG.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-ADMINCMDTOOLS_31BF3856AD364E35_10.0.26100.1150_NONE_50956D2D42F20D39\SHOWMOUNT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-O..NFRAMEWORK-PAIRTOOL_31BF3856AD364E35_10.0.26100.1150_NONE_AE401F21D0CB1063\PAIRTOOL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PCWDIAGNOSTIC_31BF3856AD364E35_10.0.26100.1591_NONE_90EBC90AAFAEEB97\PCWRUN.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RELIABILITY-POSTBOOT_31BF3856AD364E35_10.0.26100.1591_NONE_E980CB58B559B151\RELPOST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..TE-ORCHESTRATORCORE_31BF3856AD364E35_10.0.26100.1742_NONE_227796BA348EC62B\R\MOUSOCOREWORKER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NSLOOKUP_31BF3856AD364E35_10.0.26100.1150_NONE_6767C467165C7708\NSLOOKUP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ARTCARD-TPM-MANAGER_31BF3856AD364E35_10.0.26100.1150_NONE_36FD183D90DA21CB\RMTTPMVSCMGRSVR.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTEMRESTORE-MAIN_31BF3856AD364E35_10.0.26100.1591_NONE_E29FCB0E6345D56D\RSTRUI.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-I..ETEXPLORER-OPTIONAL_31BF3856AD364E35_11.0.26100.1_NONE_D3F029E4B58D022B\IEXPLORE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-IE-INTERNETEXPLORER_31BF3856AD364E35_11.0.26100.1_NONE_6A9BCD9421C5BB20\IEUNATT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_NETFX35LINQ-VB_COMPILER_ORCAS_31BF3856AD364E35_10.0.27000.360_NONE_C319A5F63C95AA27\VBC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACROBROKER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CORESYSTEM-WPR_31BF3856AD364E35_10.0.26100.1591_NONE_FDEF694F47F84AA8\R\WPR.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MANAGEDWINDOWSVM_31BF3856AD364E35_10.0.26100.1591_NONE_4C3489B778790277\MANAGEDWINDOWSVM.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NETWORKUX-LEGACYUX_31BF3856AD364E35_10.0.26100.1591_NONE_B94392693D48770C\R\LEGACYNETUXHOST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX4-NGENTASK_EXE_B03F5F7F11D50A3A_4.0.15912.0_NONE_D5E7146D665097C0\NGENTASK.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-EFS-REKEYWIZ_31BF3856AD364E35_10.0.26100.1_NONE_0F32FD2FA8C53BD5\REKEYWIZ.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..-DISPOSABLECLIENTVM_31BF3856AD364E35_10.0.26100.1591_NONE_815687268BC7E515\R\WINDOWSSANDBOXCLIENT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ICM-UI_31BF3856AD364E35_10.0.26100.1591_NONE_D618B29150D63DE2\COLORCPL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSCONFIG-EXE_31BF3856AD364E35_10.0.26100.1591_NONE_763A39AA4DC6E7D5\R\MSCONFIG.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICES-SVCHOST_31BF3856AD364E35_10.0.26100.1150_NONE_51A2AA17B537A668\R\SVCHOST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-VIRTUALDISKSERVICE_31BF3856AD364E35_10.0.26100.1150_NONE_06D22316AA9884BC\VDSLDR.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.STARTMENUEXPERIENCEHOST_CW5N1H2TXYEWY\STARTMENUEXPERIENCEHOST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CERTIFICATEREQUESTTOOL_31BF3856AD364E35_10.0.26100.1591_NONE_03D08EAAC76F1BA8\CERTREQ.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX4-CSC_EXE_B03F5F7F11D50A3A_4.0.15912.0_NONE_78CE8A6E35A89AD2\CSC.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-AUTOCHK_31BF3856AD364E35_10.0.26100.1_NONE_E93C3FFC5EAE7F6F\AUTOCHK.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-D..AGEMENT-COMMANDLINE_31BF3856AD364E35_10.0.26100.1_NONE_36C64BB72FFFB46A\DISM.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DDODIAG_31BF3856AD364E35_10.0.26100.1_NONE_334A3A73057B472F\DDODIAG.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-O..EMINPUTHOST-PROCESS_31BF3856AD364E35_10.0.26100.1150_NONE_24AEBD36AEF95F82\ISM.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..LIPBOARDREDIRECTION_31BF3856AD364E35_10.0.26100.1591_NONE_9D960BC9BB2901F9\R\RDPCLIP.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-APPLICATION..EGISTRATIONVERIFIER_31BF3856AD364E35_10.0.26100.1150_NONE_22D7B78874FA20B2\R\APPHOSTREGISTRATIONVERIFIER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-APPMANAGEMENT-APPVWOW_31BF3856AD364E35_10.0.26100.1591_NONE_594E71C0D6CE5E62\R\MAVINJECT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-M..AC-SQL-CLICONFG-EXE_31BF3856AD364E35_10.0.26100.1_NONE_7765998AF39F4114\CLICONFG.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-I..SERMODE-KERNEL-LA57_31BF3856AD364E35_10.0.26100.1742_NONE_8687939627E21DCF\R\SECUREKERNELLA57.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CIPHER_31BF3856AD364E35_10.0.26100.1150_NONE_48FDCFD155028BBE\CIPHER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\NETFXSBS10.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-CLIENTCMDTOOLS_31BF3856AD364E35_10.0.26100.1150_NONE_ED4AB399A05C1619\UMOUNT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SPEECHCOMMON-ONECORE_31BF3856AD364E35_10.0.26100.1591_NONE_0F19119BCDCAF335\SPEECHMODELDOWNLOAD.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TASKHOST_31BF3856AD364E35_10.0.26100.1000_NONE_C42BC74A0A3C26D8\R\TASKHOSTW.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MULTIPOINT-WMSSESSIONAGENT_31BF3856AD364E35_10.0.26100.1150_NONE_3D037CDB2138716C\WMSSESSIONAGENT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONTAINERDIAGNOSTICSTOOL_31BF3856AD364E35_10.0.26100.1150_NONE_234860E0E753C908\R\HCSDIAG.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-GROUPPOLICY-SCRIPT_31BF3856AD364E35_10.0.26100.1150_NONE_00FE88F91F962B70\GPSCRIPT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-USERINIT_31BF3856AD364E35_10.0.26100.1591_NONE_77E8B53C81B6CF4F\USERINIT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-SENSECLIENT-SERVICE_31BF3856AD364E35_10.0.26100.1_NONE_A518656DF7C165FB\SENSECE.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\LDR64.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\LKG\MICROSOFTWINDOWS.LKG.SEARCH_CW5N1H2TXYEWY\MINISEARCHHOST.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EDP-NOTIFY_31BF3856AD364E35_10.0.26100.1591_NONE_BC8D33C5EFDD20EF\EDPNOTIFY.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IIS-SHAREDLIBRARIES_31BF3856AD364E35_10.0.26100.1150_NONE_ACD0C33B64BC3FCF\R\IISRSTAS.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..TING-TOOLS-PRINTBRM_31BF3856AD364E35_10.0.26100.1150_NONE_1DA178EAF53E7C4D\PRINTBRMUI.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WININIT_31BF3856AD364E35_10.0.26100.1591_NONE_CCB2B3F5B4577DE6\WININIT.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RECOVER_31BF3856AD364E35_10.0.26100.1_NONE_8D5BA08151885BF2\RECOVER.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SHUTDOWN-EVENT-TRACKER_31BF3856AD364E35_10.0.26100.1_NONE_0A1C6A6364E5546E\SHUTDOWN.EXE 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1124 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe 1124 2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-01_70f596c2a83dd2e4de6f3e72551293eb_elex_nymaim_rhadamanthys_wannacry.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1124
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1