Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 17:11
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
21 signatures
150 seconds
General
- Target 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 1.8MB
- Sample260809-vqjtwavyht
- SHA256 e50dc274c39f9decc98a3568ef0ff66cb060bc495d6f5b39c2158886d91c4f41
- MD5 16325aa5ffac068196d9c2e8497baa2c
- SHA1 0eb47d8104975fd3c4f01093ab88afaf5e9ad754
- SHA512 0b9ebe6708e4a5c89255ba5c6f2f44e8b825109d3f5fb00519fa9ff69b2d3a05abc8fc61b57a4415eac510ea2aee03449d2e1d3499604382d60bc8f363caa93b
- SSDEEP 49152:HbTCIuvxKCnFnQXBbrtgb/iQvu0UHOaYmLm:H6lxvWbrtUTrUHO2i
- TLSH T17095FF152380CD61F36FC07683E56E79B9B329213B33D896AE4855316BF2E2FE781191
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs
resource yara_rule behavioral1/memory/556-1-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-7-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-57-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-58-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-156-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-111-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-155-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-14-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-6-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-227-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-228-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-500-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-504-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/556-508-0x00000000021F0000-0x000000000327E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-533-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-535-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-551-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-541-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-539-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-542-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-540-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-537-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-538-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-949-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-948-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-1030-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-1114-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4484-1168-0x0000000002270000-0x00000000032FE000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral1/memory/556-1-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-7-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-57-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-58-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-156-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-111-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-155-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-14-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-6-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-227-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-228-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-500-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-504-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-508-0x00000000021F0000-0x000000000327E000-memory.dmp UPX behavioral1/memory/556-527-0x0000000000400000-0x000000000044E000-memory.dmp UPX behavioral1/memory/4484-533-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-535-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-551-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-541-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-539-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-542-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-540-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-537-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-538-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-949-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-948-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-1030-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-1114-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-1168-0x0000000002270000-0x00000000032FE000-memory.dmp UPX behavioral1/memory/4484-1435-0x0000000000400000-0x000000000044E000-memory.dmp UPX - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation WdExt.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation launch.exe Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Executes dropped EXE 5 IoCs
pid Process 4484 WdExt.exe 4628 launch.exe 5000 wtmps.exe 1320 launch.exe 3796 mscaps.exe - Loads dropped DLL 2 IoCs
pid Process 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4484 WdExt.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe -
resource yara_rule behavioral1/memory/556-1-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-7-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-57-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-58-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-156-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-111-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-155-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-14-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-6-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-227-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-228-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-500-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-504-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/556-508-0x00000000021F0000-0x000000000327E000-memory.dmp upx behavioral1/memory/4484-533-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-535-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-551-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-541-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-539-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-542-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-540-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-537-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-538-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-949-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-948-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-1030-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-1114-0x0000000002270000-0x00000000032FE000-memory.dmp upx behavioral1/memory/4484-1168-0x0000000002270000-0x00000000032FE000-memory.dmp upx - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4964 cmd.exe 3052 cmd.exe 620 cmd.exe 4060 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtmps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 34 IoCs
pid Process 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4484 WdExt.exe 4484 WdExt.exe 4484 WdExt.exe 4484 WdExt.exe 4628 launch.exe 4628 launch.exe 4628 launch.exe 4628 launch.exe 4628 launch.exe 4628 launch.exe 4628 launch.exe 4628 launch.exe 4628 launch.exe 4628 launch.exe 4628 launch.exe 4628 launch.exe 1320 launch.exe 1320 launch.exe 1320 launch.exe 1320 launch.exe 1320 launch.exe 1320 launch.exe 1320 launch.exe 1320 launch.exe 1320 launch.exe 1320 launch.exe 1320 launch.exe 1320 launch.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 556 wrote to memory of 816 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 9 PID 556 wrote to memory of 820 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 10 PID 556 wrote to memory of 512 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 14 PID 556 wrote to memory of 2732 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 51 PID 556 wrote to memory of 1056 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 52 PID 556 wrote to memory of 1520 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 53 PID 556 wrote to memory of 3296 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 56 PID 556 wrote to memory of 3424 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 57 PID 556 wrote to memory of 3612 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 58 PID 556 wrote to memory of 3716 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 59 PID 556 wrote to memory of 3776 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 60 PID 556 wrote to memory of 3852 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 61 PID 556 wrote to memory of 4080 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 62 PID 556 wrote to memory of 4552 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 65 PID 556 wrote to memory of 3524 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 77 PID 556 wrote to memory of 816 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 9 PID 556 wrote to memory of 820 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 10 PID 556 wrote to memory of 512 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 14 PID 556 wrote to memory of 2732 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 51 PID 556 wrote to memory of 1056 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 52 PID 556 wrote to memory of 1520 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 53 PID 556 wrote to memory of 3296 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 56 PID 556 wrote to memory of 3424 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 57 PID 556 wrote to memory of 3612 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 58 PID 556 wrote to memory of 3716 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 59 PID 556 wrote to memory of 3776 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 60 PID 556 wrote to memory of 3852 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 61 PID 556 wrote to memory of 4080 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 62 PID 556 wrote to memory of 4552 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 65 PID 556 wrote to memory of 3524 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 77 PID 556 wrote to memory of 4964 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 86 PID 556 wrote to memory of 3052 556 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 87 PID 4964 wrote to memory of 4484 4964 cmd.exe 91 PID 4484 wrote to memory of 816 4484 WdExt.exe 9 PID 4484 wrote to memory of 820 4484 WdExt.exe 10 PID 4484 wrote to memory of 512 4484 WdExt.exe 14 PID 4484 wrote to memory of 2732 4484 WdExt.exe 51 PID 4484 wrote to memory of 1056 4484 WdExt.exe 52 PID 4484 wrote to memory of 1520 4484 WdExt.exe 53 PID 4484 wrote to memory of 3296 4484 WdExt.exe 56 PID 4484 wrote to memory of 3424 4484 WdExt.exe 57 PID 4484 wrote to memory of 3612 4484 WdExt.exe 58 PID 4484 wrote to memory of 3716 4484 WdExt.exe 59 PID 4484 wrote to memory of 3776 4484 WdExt.exe 60 PID 4484 wrote to memory of 3852 4484 WdExt.exe 61 PID 4484 wrote to memory of 4080 4484 WdExt.exe 62 PID 4484 wrote to memory of 4552 4484 WdExt.exe 65 PID 4484 wrote to memory of 3524 4484 WdExt.exe 77 PID 4484 wrote to memory of 4964 4484 WdExt.exe 86 PID 4484 wrote to memory of 4964 4484 WdExt.exe 86 PID 4484 wrote to memory of 1696 4484 WdExt.exe 88 PID 4484 wrote to memory of 620 4484 WdExt.exe 94 PID 620 wrote to memory of 4628 620 cmd.exe 96 PID 4628 wrote to memory of 4060 4628 launch.exe 98 PID 4060 wrote to memory of 5000 4060 cmd.exe 100 PID 5000 wrote to memory of 3796 5000 wtmps.exe 104 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:816
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:820
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:512
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:1056
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:1520
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3296
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:556 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:1696
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4484 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 44846⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060 -
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"8⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe9⤵
- Executes dropped EXE
PID:3796
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:3052
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3424
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3612
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3716
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3776
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3852
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4080
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4552
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:3524
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1320
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E58434D_Rar\2026-08-09_16325aa5ffac068196d9c2e8497baa2c_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 1.7MB
- SHA256 ac9ff0f8847837cbb1123d5451929f249d5c4c071ad580e9f55883b4d218e805
- MD5 7818f09a0d64f2dee5a0863d168c328b
- SHA1 02c196abf5b2e7b70854e1df850a070b148059c3
- SHA512 989c4d07633d39bce9b455e6d1c7c73522767d98a9d7aeb25d1ecc3dc37b21c87132b2c907cc77c3b9ec6fc06dfa16da4316f3637af45125a632a4b80c6ce132
- SSDEEP 49152:mbTChxKCnFnQXBbrtgb/iQvu0UHOaYmLm:m6hxvWbrtUTrUHO2i
- TLSH T13085FF152790CD61F36FC07683E16E79B9B329213B33D886AE4855316BF2E2FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\AC29.tmp
- Size 406B
- SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
- MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
- SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
- SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
- TLSH T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
- Size 276KB
- SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
- MD5 75c1467042b38332d1ea0298f29fb592
- SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
- SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
- SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
- TLSH T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
- Size 172KB
- SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
- MD5 daac1781c9d22f5743ade0cb41feaebf
- SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
- SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
- SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
- TLSH T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
- Size 1.8MB
- SHA256 da8017ed0ad3d9f5ce23f65da7a023a89d706f473f70c71f8983d07223c0a4de
- MD5 3ab6efb386e63438c36e976e9c7b7b88
- SHA1 f6485f8718598e48f07d274413e929a472fcbccc
- SHA512 80a5b60097a4a63a9af6178ecf9bf49860f137cb4fa5210eb0b90161b959fee74db26b59644baa4efa5b8dbf857c8cf5adc896189771a9eacb46c3a74edd5d7c
- SSDEEP 49152:HbTCIuvxKCnFnQXBbrtgb/iQvu0UHOaYmLh:H6lxvWbrtUTrUHO2d
- TLSH T1CD95FF152380CD61F36FC07683E56E79B9B329213B33D886AE4855312BF2E2FE781195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
- Size 129B
- SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
- MD5 d1073c9b34d1bbd570928734aacff6a5
- SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
- SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
- TLSH T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 126B
- SHA256 9ccb4cef3f68b96d4bc4fae9c305d78df0a7097735aba5167911c3a2870ec832
- MD5 ce9ce111d95ce00b5782854d0345373f
- SHA1 7c8de11f8fdaad0068ee385bece5bbf931838884
- SHA512 6bfbbbfc349ed02becb4f8b1de51cf6e74fbc48f7cbebb0d9d5c230bcaa3f961c295e60324d7bf4a92600ba37dd7fe392170a6938fded2c6aded0f58297704a4
- TLSH T137B09B1613C9CB0F745260570779545D50784AC13E947615C6118488325680CFD66545
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 358B
- SHA256 f87aab41fda81174864239145112178b6a36a7080da53bd8b7a88ac1cbc6b70a
- MD5 a9ea593a00b2d414d5c7c8ccfb971b15
- SHA1 0882ce1edac3cc11444fb89d03ad7a44fc7e8bc3
- SHA512 47f2c88688437a915141de9690dc4261ae4f186f2c1187ebf7b6d2c0572d03111405863b7a98fcf40870cfdfab253535e0965660a80e38fb226c9ae8316bfe99
- TLSH T16CE0C00002ADCB55348462871E3CD0EDD0653E607E8E1306CA32D1D893D450CF823A60
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
- Size 102B
- SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
- MD5 3ca08f080a7a28416774d80552d4aa08
- SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
- SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
- TLSH T114B0121243CBCF0D148060D70775A1CCC0740C983F947714DF11C84C314080DFDC6A41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 388KB
- SHA256 c67ed34d9254b31e611ee830125c3f2572a1e686f82deb69e1580fb9a4614cd0
- MD5 e1e47695a0b98432911311352b63eaed
- SHA1 836142e550301e0fc13c1a047aae5a2f4481d7cd
- SHA512 da49234ee2e1d8f9956ba59d4a49fe04d3ab154f5dd60cf7a6c72e9d42defe8a4b0aeb38845444fe3a8d9c80976467d2101f7c992a48f98f6a9317d0e61ca961
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyz:/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 388KB
- SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
- MD5 8d7db101a7211fe3309dc4dc8cf2dd0a
- SHA1 6c2781eadf53b3742d16dab2f164baf813f7ac85
- SHA512 8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83
- SSDEEP 12288:PDCOy/psISIHbl9f/mnmO/5Se71RpNJmq3CrP:RyRznmnp5SedNJBCL
- TLSH T1E3843A12B7A98025D6F30A74263DB536A4397C750F50EEEB73250B6DA830FC1DB79A12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 32d7326b675167787886905d4012f1057cd7f3237379d6c7efbeec89a6db85e4
- MD5 27f5e67dd21c9e72990467104c0cfa12
- SHA1 0809ee9ebb3120d7851e181caf8665fed9291d69
- SHA512 82832a5e07ac8d79e0edea86b6334617844b8ff592cc443822d2800b3fb9deae20ab515c4dd710497e47ebc1dc26a5ef3fc188e5698de865e132596e69c76e82
- TLSH T1C9D05E0E4BED11AD9042002E3179D4C272399F51E8720F4C9039674164296D9BF7E2AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mscaps.exe
- Size 200KB
- SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
- MD5 78d3c8705f8baf7d34e6a6737d1cfa18
- SHA1 9f09e248a29311dbeefae9d85937b13da042a010
- SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
- SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
- TLSH T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
- MD5 SHA1 SHA512 SSDEEP TLSH