Analysis
- max time kernel
149s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
03/08/2026, 17:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe
- Size 1.9MB
- Sample260803-v99jmsvbjf
- SHA256 56e6d5edfafd7eea8b51f1940af8daef6c0f5bb20f699c5357dff3578b47ef1a
- MD5 7d236e20b3106aa1b7816ffe46e77f4a
- SHA1 6b99a611db0ddc461623322f58d52323bd245ee1
- SHA512 6faf3ff4b622e0cfab56c05d40021bd0a4b7a6540bb285874eb8d564099d1b7e50e9cc5de3140071dfdc672cac2cbcd7c16e4e1061236db5f46051ba29a64904
- SSDEEP 24576:kpi6/ZYTqMi8CtBd2QHCHmTBW5R/KCtMZd0qgKWEfes6lm5Q+dgulJS+Ix:kpEqJtb2Iy/KCGZd0qgNEf16lhulJL4
- TLSH T10F958E23F5A442B9D02AD079C7D6A636FE3234851B30B5CF038597692E37BE19B39721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\esentutl.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\IMEJP\IMJPUEX.EXE 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMCCPHR.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\msfeedssync.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rekeywiz.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\runas.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\sethc.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\TapiUnattend.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\at.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\certreq.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\dpnsvr.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\driverquery.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ipconfig.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\makecab.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\netsh.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ttdinject.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\calc.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ddodiag.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\dpapimig.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\DpiScaling.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Utilman.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wsmprovhost.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\cmd.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\fsquirt.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\verifiergui.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wiaacmgr.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\winrm.cmd- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\charmap.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\dplaysvr.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\extrac32.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\prevhost.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SecEdit.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\TsWpfWrp.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wevtutil.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wscadminui.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\AtBroker.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\hh.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Msdtc\Trace\msdtcvtr.bat 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\Netplwiz.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ReAgentc.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\regedt32.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\bitsadmin.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\diskperf.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\extrac32.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\mobsync.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\newdev.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\srdelayed.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\ctfmon.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\efsui.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\RdpSaUacHelper.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\wsmprovhost.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\auditpol.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\iexpress.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\IME\SHARED\IMESEARCH.EXE- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\isoburn.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\mountvol.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\mtstocom.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\rrinstaller.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\SystemPropertiesAdvanced.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SysWOW64\EhStorAuthn.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-001F-0C0A-1000-0000000FF1CE}\misc.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\AssertNew.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaw.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\cookie_exporter.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedge.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jar.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jps.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\pack200.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Mozilla Firefox\private_browsing.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\msedge_proxy.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\identity_helper.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateSetup.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\policytool.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\pwahelper.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\elevation_service.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Windows Mail\wabmig.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\ohub32.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\msedge_proxy.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\1.3.195.65\MicrosoftEdgeComRegisterShellARM64.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\javaws.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\jjs.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Integration\Integrator.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Mozilla Firefox\uninstall\helper.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\bin\Pester.bat 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\Client\AppVLP.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.ShowHelp.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\msedge.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateOnDemand.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\7-Zip\7z.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Windows Mail\wab.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\139.0.3405.125\pwahelper.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrServicesUpdater.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_bk\1.3.147.37\MicrosoftEdgeUpdateCore.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeUpdate_disable\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\139.0.3405.125\MicrosoftEdge_X64_139.0.3405.125.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Windows NT\Accessories\wordpad.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jdk-1.8\bin\java.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\kinit.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Mozilla Firefox\maintenanceservice.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files (x86)\Microsoft\EdgeCore\132.0.2957.140\cookie_exporter.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Program Files\Java\jre-1.8\bin\orbd.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\WinSxS\wow64_microsoft-windows-e..ageengine-utilities_31bf3856ad364e35_10.0.19041.1_none_99d1a4d398ff69a3\esentutl.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-m..nt-browser.appxmain_31bf3856ad364e35_10.0.19041.844_none_d9eb415c5b9dbe4e\f\SecureAssessmentBrowser.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-performancetoolsgui_31bf3856ad364e35_10.0.19041.1_none_51facbaf4051768b\perfmon.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-embedded-shelllauncher_31bf3856ad364e35_10.0.19041.1202_none_b918e36ffc7a6ffe\r\eshell.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_windows-senseclient-service_31bf3856ad364e35_10.0.19041.1288_none_1cec63974464878f\r\SenseCE.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.746_none_735abbdbad8c902f\r\cmd.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_10.0.19041.1_none_40fdd440b9ba0fea\cmd.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_windowssearchengine_31bf3856ad364e35_7.0.19041.264_none_8bd2f5fc0c992e06\SearchProtocolHost.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-a..l-systemuwplauncher_31bf3856ad364e35_10.0.19041.746_none_ed5986fc58f1b817\f\SystemUWPLauncher.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-wow64-legacy_31bf3856ad364e35_10.0.19041.1_none_ac040ccaa73c8c1b\setup16.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-d..ice-remoteposworker_31bf3856ad364e35_10.0.19041.1_none_d570c31a162768ba\RemotePosWorker.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-tcpip-utility_31bf3856ad364e35_10.0.19041.1_none_f30cab80229c6b29\ROUTE.EXE- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-verclsid_31bf3856ad364e35_10.0.19041.1_none_7c2c890be7329496\verclsid.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-security-browsercore_31bf3856ad364e35_10.0.19041.1_none_10bedc609ddcdbdb\BrowserCore.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-deployment_31bf3856ad364e35_10.0.19041.746_none_e43cebe9807e08e3\f\setupugc.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-t..ices-appcompattools_31bf3856ad364e35_10.0.19041.1_none_b36547673f7cb25f\USRLOGON.CMD- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\chgport.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-userexperience-desktop_31bf3856ad364e35_10.0.19041.173_none_6486f23c2831aaf3\f\InputApp\TextInputHost.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-com-complus-setup_31bf3856ad364e35_10.0.19041.746_none_c7a124154e1d7314\mtstocom.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-unp_31bf3856ad364e35_10.0.19041.264_none_8adc8bd8b75d383f\f\UNPUXHost.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_10.0.19041.1266_none_802f96a5044b0fbe\r\wmpconfig.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..tiondialog.appxmain_31bf3856ad364e35_10.0.19041.423_none_f20ecec27517964b\r\PinningConfirmationDialog.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-s..ttings-removedevice_31bf3856ad364e35_10.0.19041.746_none_915a78ef54321214\f\SystemSettingsRemoveDevice.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_wcf-m_sm_cfg_ins_exe_31bf3856ad364e35_10.0.19041.1_none_b6126993bc8370e6\SMConfigInstaller.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-i..tional-chinese-core_31bf3856ad364e35_10.0.19041.1_none_19c9b562d4b65581\IMTCLNWZ.EXE- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-autoplay_31bf3856ad364e35_10.0.19041.1266_none_9a152e76298cd801\f\wmlaunch.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\r\Narrator.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-cleanmgr_31bf3856ad364e35_10.0.19041.1266_none_ec5eb439471de957\r\cleanmgr.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-castserver_31bf3856ad364e35_10.0.19041.746_none_a5986eca8fd4063b\f\CastSrv.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-setup-mbr2gpt_31bf3856ad364e35_10.0.19041.84_none_ee550b91ec0a7e82\MBR2GPT.EXE- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventlog-commandline_31bf3856ad364e35_10.0.19041.1202_none_3fe90cdb6667211e\f\wevtutil.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\bfsvc.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SystemApps\ParentalControls_cw5n1h2txyewy\WpcUapApp.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-audio-audiocore_31bf3856ad364e35_10.0.19041.264_none_5481650943811810\r\SpatialAudioLicenseSrv.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hvsi-manager_31bf3856ad364e35_10.0.19041.1202_none_7cdad2e52790705d\r\hvsirpcd.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..nagement-appvclient_31bf3856ad364e35_10.0.19041.1202_none_4132a4047d5d53b2\AppVNice.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-i..switch-toasthandler_31bf3856ad364e35_10.0.19041.746_none_a89196e695076787\InputSwitchToastHandler.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-p..riencehost.appxmain_31bf3856ad364e35_10.0.19041.1_none_97b0a47239f6db64\PeopleExperienceHost.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-eventcreate_31bf3856ad364e35_10.0.19041.1_none_95a8887a13522472\eventcreate.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-mediaplayer-logagent_31bf3856ad364e35_10.0.19041.746_none_d38e81565538dedf\logagent.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-sctasks_31bf3856ad364e35_10.0.19041.906_none_72b8b02e4865ebca\r\schtasks.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v2.0.50727\RegSvcs.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\SystemApps\Microsoft.AAD.BrokerPlugin_cw5n1h2txyewy\Microsoft.AAD.BrokerPlugin.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-msconfig-exe_31bf3856ad364e35_10.0.19041.1110_none_4f46693352ed3250\msconfig.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-narrator_31bf3856ad364e35_10.0.19041.84_none_b5c0f628d1d661eb\f\Narrator.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-a..atibility-assistant_31bf3856ad364e35_10.0.19041.1266_none_a88c5999d8585853\pcalua.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-hyper-v-vfpext_31bf3856ad364e35_10.0.19041.1237_none_7578510aa0f564fa\r\vfpctrl.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_microsoft-windows-rasconnectionmanager_31bf3856ad364e35_10.0.19041.1_none_1f65f7473443d565\cmdl32.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\wow64_regasm_b03f5f7f11d50a3a_4.0.15805.0_none_9be7d950c1f8addd\RegAsm.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-b..onment-core-tcbboot_31bf3856ad364e35_10.0.19041.1288_none_75442af2fe19577c\tcblaunch.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-filtermanager-utils_31bf3856ad364e35_10.0.19041.1_none_cf7ec085c4b5345c\fltMC.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-oobe-user-broker_31bf3856ad364e35_10.0.19041.746_none_61e0347e850155a8\UserOOBEBroker.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spectrum_31bf3856ad364e35_10.0.19041.153_none_59d1094dec9b8480\f\Spectrum.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-spelling-host.binaries_31bf3856ad364e35_10.0.19041.746_none_eb2cdd2a40f60c45\r\MsSpellCheckingHost.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..ces-workspacebroker_31bf3856ad364e35_10.0.19041.1_none_45334ed1c0264cf2\wkspbroker.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\x86_microsoft-windows-sxs_31bf3856ad364e35_10.0.19041.746_none_30274b64fe158ec9\f\sxstrace.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-atbroker_31bf3856ad364e35_10.0.19041.1023_none_4478665ed379a3fc\r\AtBroker.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-t..es-commandlinetools_31bf3856ad364e35_10.0.19041.1_none_9aa166e99861c2bc\tsdiscon.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regsql.exe 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\Microsoft.NET\Framework64\v3.5\AddInUtil.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-lpksetup_31bf3856ad364e35_10.0.19041.153_none_ff44cfa7cb529ce3\f\lpksetup.exe- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe File created C:\Windows\WinSxS\amd64_microsoft-windows-e..-unifiedwritefilter_31bf3856ad364e35_10.0.19041.1_none_522bacd027283125\uwfservicingscr.scr- 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-03_7d236e20b3106aa1b7816ffe46e77f4a_amadey_elex_rhadamanthys_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1368
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7z.exe-
- Size 2.4MB
- SHA256 8c8c9377284630e51f4f4aab97d132808c6024018e5277a24a356637019e0b65
- MD5 51f635d718c7e56603aad634ce97537f
- SHA1 41129b9fa7de08b950eeebbd142d7d80e543812e
- SHA512 01020602b3686ec997b57e15991b6e497f63696788213ceea413cdf44983d9aced7514ac990ea23ff5c06e74345d2333fa827804b2ee250b1a07a85b909bbaae
- SSDEEP 49152:kpEqJtb2Iy/KCGZd0qgNEf16lhulJLaPji0AjY:kqcWQcjo0
- TLSH T1E8C56C27F5A44279D077C0B9C6D6A666FE3234861B30A9CF0385D7682E37BE18739721
- MD5 SHA1 SHA512 SSDEEP TLSH