Analysis
- max time kernel
148s - max time network
132s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/08/2026, 23:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe
- Size 52KB
- Sample260812-3xwe9avybs
- SHA256 5bff9a618a3abfa1457abcccfb949f2e78d117c822fa062d0d1f7ba0ca372296
- MD5 e7ffdeb25cf12234e1d350bd1946ef57
- SHA1 f4594958d93a3719dcded03ed25d68f421d7e02f
- SHA512 0517d3eac83be5075478272470f859c7f35c3c59c4c79b5b81868182a366236d99b1e0a54907c21bb1d9041ef3d4cdc3e8c29ec38480a83d22292a46ddfb916f
- SSDEEP 768:DlQ4hrvaEGU4aikqykezg2XpfY7jYioRoPtxl5:5LhE1Dezg2ZfYSoVv5
- TLSH T155337C13F9ED01B3DD118AB124BB4B3A6B3BB9520251114BAF08DD9E7DB21848D2236B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\V: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\W: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Z: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\M: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Q: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\S: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\D: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\J: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\K: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\N: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\P: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\X: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\H: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\I: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\O: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\T: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\U: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Y: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\G: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\L: 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\ICSUNATTEND.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PATHPING.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ROBOCOPY.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BITSADMIN.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MUIUNATTEND.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RUNAS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TCPSVCS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\XWIZARD.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CMDKEY.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\STORDIAG.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SUDO.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SVCHOST.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CREDWIZ.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FONDUE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHPROTOCOLHOST.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REGISTER-CIMPROVIDER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULTSECURE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EXTRAC32.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FLTMC.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSHTA.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SC.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESDATAEXECUTIONPREVENTION.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TASKKILL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\UPNPCONT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FORFILES.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\KTMUTIL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SCHTASKS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SECEDIT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIPRVSE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DPLAYSVR.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GPSCRIPT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOCHK.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CACLS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CLOUDNOTIFICATIONS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COMPACT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\SETUP.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DISM\DISMHOST.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\_ISDEL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LOGAGENT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MFPMP.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NDADMIN.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPROTECTION.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\USER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FINDSTR.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\HH.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MAKECAB.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REGEDT32.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WOWREG32.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ATBROKER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DPISCALING.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GPUPDATE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\INFDEFAULTINSTALL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHINDEXER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOFSTX.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DOSKEY.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NET.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PRINTUI.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WINMGMT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COMP.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EASEOFACCESSDIALOG.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FIND.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAWS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JINFO.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVACPL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SSVAGENT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\TNAMESERV.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\NMHPROXY.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UPDATER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVSHNOTIFY.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\SSCICONS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\UNINSTALL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\MSEDGE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\NOTIFICATION_HELPER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE16\LICLUA.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\ELEVATED_TRACING_SERVICE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX45.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\LOGTRANSPORT2.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVAWS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\MSEDGEWEBVIEW2.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE_PROXY.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMIREGISTRY.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\TNAMESERV.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\ELEVATED_TRACING_SERVICE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX40.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\FLTLDR.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\UNINSTALL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JARSIGNER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\UNPACK200.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE 15\CLIENTX64\OFFICECLICKTORUN.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSESAMPLEUPLOADER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARMHELPER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEINSTAL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTACK.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\POLICYTOOL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SERIALVER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KTAB.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KTAB.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\INTEGRATION\ADDONS\ONEDRIVESETUP.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ONENOTE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\JOTICON.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\CHROME_PWA_LAUNCHER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOADFSB.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SCANPST.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\MSOICONS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSETVM.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPLAYER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\1.3.195.65\MICROSOFTEDGEUPDATE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-040C-1000-0000000FF1CE}\MISC.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEINSTAL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT ANALYSIS SERVICES\AS OLEDB\140\SQLDUMPER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVAW.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS DEFENDER\MPCMDRUN.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\INSTALLUTIL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AUTHENTICATION-LOGONUI_31BF3856AD364E35_10.0.26100.1_NONE_6286BAEEDBC54537\LOGONUI.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..OMMANDLINEUTILITIES_31BF3856AD364E35_10.0.26100.1_NONE_7A109607CFE12F00\PRINT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PERFORMANCETOOLSGUI_31BF3856AD364E35_10.0.26100.1591_NONE_37C9B95250FAC754\RESMON.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..TNET-MUA-HOSTSERVER_31BF3856AD364E35_10.0.26100.1150_NONE_6CD729C157564F7C\R\WINRTNETMUAHOSTSERVER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_USEREXPERIENCE-LKG_31BF3856AD364E35_10.0.26100.1742_NONE_3C72368675EAE921\LKG.SEARCH\SEARCHHOST.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-W..TNET-MUA-HOSTSERVER_31BF3856AD364E35_10.0.26100.1_NONE_D8382BFD4459C379\WINRTNETMUAHOSTSERVER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CASTSERVER_31BF3856AD364E35_10.0.26100.1_NONE_C492CC5E99915BFB\CASTSRV.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-E..AGEENGINE-UTILITIES_31BF3856AD364E35_10.0.26100.1591_NONE_754BE8247547F871\ESENTUTL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..LEPC-MOBILITYCENTER_31BF3856AD364E35_10.0.26100.1_NONE_578D9D3A73CFB479\MBLCTR.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-TOOLS-KLIST_31BF3856AD364E35_10.0.26100.1_NONE_3E2848112F1873ED\KLIST.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WPD-SHELLEXTENSION_31BF3856AD364E35_10.0.26100.1301_NONE_ACF5850F76C86DB8\R\WPDSHEXTAUTOPLAY.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-A..PACKAGEDCWALAUNCHER_31BF3856AD364E35_10.0.26100.1_NONE_EA8223E29A7906A5\PACKAGEDCWALAUNCHER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_REGSVCS_B03F5F7F11D50A3A_4.0.15912.0_NONE_8EC56A4C64C63B5B\REGSVCS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..BIOMETRICS-TRUSTLET_31BF3856AD364E35_10.0.26100.1150_NONE_E129C29CB0451E37\BIOISO.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..E-CLIENT-UI-WSRESET_31BF3856AD364E35_10.0.26100.1591_NONE_6237F51EB608E6F4\R\WSRESET.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..OMMAND-LINE-UTILITY_31BF3856AD364E35_10.0.26100.1150_NONE_3D9125D57CC0DA9E\WMIC.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-D..IME-EASHARED-IMEPAD_31BF3856AD364E35_10.0.26100.1591_NONE_E0A0E7A383989B03\IMEPADSV.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-KTMUTIL_31BF3856AD364E35_10.0.26100.1_NONE_8FD24AD09E1634F0\KTMUTIL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..MENT-BOOTSECTORTOOL_31BF3856AD364E35_10.0.26100.1150_NONE_A875B50B457475FD\BOOTSECT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PERFORMANCETOOLSGUI_31BF3856AD364E35_10.0.26100.1591_NONE_37C9B95250FAC754\R\PERFMON.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPMANAGEMENT-UEVAGENT_31BF3856AD364E35_10.0.26100.1591_NONE_986BA09695018480\R\UEVAPPMONITOR.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NFS-ADMINCMDTOOLS_31BF3856AD364E35_10.0.26100.1150_NONE_50956D2D42F20D39\NFSADMIN.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-UPDATE-UUS-CORE_31BF3856AD364E35_10.0.26100.1591_NONE_944DE837A97599AB\R\USOCLIENT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WAASMEDIC_31BF3856AD364E35_10.0.26100.1150_NONE_CF3B1BF5EE04490B\WAASMEDICAGENT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-COMMANDLINE-DSMGMT_31BF3856AD364E35_10.0.26100.1150_NONE_E6BDBE4DAEDB7DF6\DSMGMT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_10.0.26100.1455_NONE_A73031E9FF1C7610\WMPCONFIG.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICINGSTACK_31BF3856AD364E35_10.0.26100.1_NONE_065309A92FD714E9\TIWORKER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NGENTASK.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.CREDDIALOGHOST_CW5N1H2TXYEWY\CREDDIALOGHOST.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_COMSVCCONFIG_B03F5F7F11D50A3A_4.0.15912.0_NONE_48717892BCEC72F7\COMSVCCONFIG.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-EVENTCREATE_31BF3856AD364E35_10.0.26100.1150_NONE_714A211AEF7DC47F\R\EVENTCREATE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LPKINSTALL_31BF3856AD364E35_10.0.26100.1150_NONE_A51A55A6FAF616D3\R\LPKINSTALL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PRINTING-EDUPRINTPROV_31BF3856AD364E35_10.0.26100.1150_NONE_4D28A605D2D4D62B\R\EDUPRINTPROV.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-AUTOFSTX_31BF3856AD364E35_10.0.26100.1591_NONE_55245726CCBB616F\AUTOFSTX.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-T..MINALSERVICESCLIENT_31BF3856AD364E35_10.0.26100.1591_NONE_F3F0F30E057F293D\MSTSC.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DXP-DEVICEEXPERIENCE_31BF3856AD364E35_10.0.26100.1150_NONE_E30C7C3AA9B12724\DXPSERVER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-E..RISECLIENTSYNC-HOST_31BF3856AD364E35_10.0.26100.1591_NONE_69D37612269B8F36\WORKFOLDERS.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMI-CORE_31BF3856AD364E35_10.0.26100.1150_NONE_553B538BCF828876\MOFCOMP.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WPF-TERMINALSERVERWPFWRAPPEREXE_31BF3856AD364E35_10.0.26100.1_NONE_2152E7EB342C1E53\TSWPFWRP.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-HTMLHELP_31BF3856AD364E35_10.0.26100.1591_NONE_6E6A9C2B69241453\R\HH.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WIN32CALC_31BF3856AD364E35_10.0.26100.1150_NONE_E5966FA8C7A04CF1\WIN32CALC.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COMPAT-COMPATTELRUNNER_31BF3856AD364E35_10.0.26100.1591_NONE_5AE89417C15099F2\R\COMPATTELRUNNER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..TX-DXGIADAPTERCACHE_31BF3856AD364E35_10.0.26100.1591_NONE_435B2733E13C4689\DXGIADAPTERCACHE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ERRORREPORTINGFAULTS_31BF3856AD364E35_10.0.26100.1591_NONE_0BC717C8ECD0287D\WERFAULTSECURE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IEFRAME_31BF3856AD364E35_11.0.26100.1742_NONE_43FFC3A787AF4B46\IESETTINGSYNC.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-N..KGROUNDTRANSFERHOST_31BF3856AD364E35_10.0.26100.1_NONE_8B784347184CB631\BACKGROUNDTRANSFERHOST.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..IODATAMODEL-LIBRARY_31BF3856AD364E35_10.0.26100.1591_NONE_10D0D236E479806F\R\WINBIODATAMODELOOBE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-NEWDEV_31BF3856AD364E35_10.0.26100.1_NONE_18BE9E06ED967433\NDADMIN.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-PROVISIONING-PLATFORM_31BF3856AD364E35_10.0.26100.1_NONE_71D0D2E420E01CFD\PROVLAUNCH.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..RARIES-SERVERCOMMON_31BF3856AD364E35_10.0.26100.1150_NONE_4572DC061FF88008\APPCMD.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..RITY-SPP-VALIDATION_31BF3856AD364E35_10.0.26100.1150_NONE_B6D21851D2F58AC9\GENVALOBJ.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SMARTSCREEN_31BF3856AD364E35_10.0.26100.1150_NONE_59491CDDD00C2DBA\SMARTSCREEN.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_NETFX4-NGEN_EXE_B03F5F7F11D50A3A_4.0.15912.0_NONE_FC8DF34CE61B153B\NGEN.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\INSTALLUTIL.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-S..BOOTENCODEUEFI-TASK_31BF3856AD364E35_10.0.26100.1591_NONE_8F5A876D69245542\SECUREBOOTENCODEUEFI.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-D..-JAPANESE-UTILITIES_31BF3856AD364E35_10.0.26100.1591_NONE_9345E45E568242FB\IMJPDCT.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-U..IEDWRITEFILTER-MGMT_31BF3856AD364E35_10.0.26100.1150_NONE_68A5BBED8A1F4ED6\R\UWFMGR.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ARTCARD-TPM-MANAGER_31BF3856AD364E35_10.0.26100.1150_NONE_36FD183D90DA21CB\R\TPMVSCMGRSVR.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..TEELEVATEDINSTALLER_31BF3856AD364E35_10.0.26100.1150_NONE_21762269BB195F5B\WINDOWSUPDATEELEVATEDINSTALLER.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEVICEPAIRINGAPP_31BF3856AD364E35_10.0.26100.1150_NONE_0B85B224B1F670B4\R\DEVICEPAIRINGWIZARD.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RECOVERYDRIVE_31BF3856AD364E35_10.0.26100.1591_NONE_C452AC383BB44C33\R\RECOVERYDRIVE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..TTINGS-REMOVEDEVICE_31BF3856AD364E35_10.0.26100.1150_NONE_4F487E99A54CB5D2\R\SYSTEMSETTINGSREMOVEDEVICE.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHELL-SHELLHOST_31BF3856AD364E35_10.0.26100.1591_NONE_E7AD5A201DDFFAC9\SHELLHOST.EXE 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2036 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe 2036 2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-12_e7ffdeb25cf12234e1d350bd1946ef57_elex_nymaim_rhadamanthys_wannacry.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2036
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1