Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 00:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
22 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
23 signatures
150 seconds
General
- Target 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 1.8MB
- Sample260815-aqnslsda22
- SHA256 4ca7ce0f182b84e0cb41a04aa455934391049e417f48cb5537a4bdedcd7283b1
- MD5 0ac914ebd6b0813d46a34e287fef9cab
- SHA1 872f47112887328e88a6cb662ce7fa374459d8c8
- SHA512 7f3df55911ae2d113bbb456f9d3011b5e281a1ce5e03a8eda3d4723c3f4590a29e53f882030f8206df8cbf3fab21cfeeef8f09d845ad6b4930276c20e6506768
- SSDEEP 24576:i5dVtTj2i6Q8SdT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaopo:cbTC7xKCnFnQXBbrtgb/iQvu0UHOaM
- TLSH T13985F0252790CC61F36FC07683E56E39BAB329213733D8866E4851316BF1E6FE781196
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
-
http://www.klkjwre9fqwieluoi.info/
-
http://kukutrustnet777888.info/
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 28 IoCs
resource yara_rule behavioral2/memory/5296-14-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-11-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-13-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-12-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-10-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-9-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-3-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-7-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-8-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-21-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-20-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-22-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-33-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/5296-68-0x00000000023D0000-0x000000000345E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-87-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-99-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-96-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-97-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-95-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-94-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-91-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-93-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-85-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-106-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-107-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-142-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-167-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/1176-182-0x0000000002390000-0x000000000341E000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 30 IoCs
resource yara_rule behavioral2/memory/5296-14-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-11-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-13-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-12-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-10-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-9-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-3-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-7-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-8-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-21-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-20-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-22-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-33-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-68-0x00000000023D0000-0x000000000345E000-memory.dmp UPX behavioral2/memory/5296-80-0x0000000000400000-0x000000000044D000-memory.dmp UPX behavioral2/memory/1176-87-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-99-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-96-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-97-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-95-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-94-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-91-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-93-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-85-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-106-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-107-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-142-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-167-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-182-0x0000000002390000-0x000000000341E000-memory.dmp UPX behavioral2/memory/1176-198-0x0000000000400000-0x000000000044D000-memory.dmp UPX - Executes dropped EXE 5 IoCs
pid Process 1176 WdExt.exe 3800 launch.exe 720 launch.exe 5340 wtmps.exe 1056 mscaps.exe - Loads dropped DLL 2 IoCs
pid Process 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 1176 WdExt.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\D: WdExt.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe -
resource yara_rule behavioral2/memory/5296-14-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-11-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-13-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-12-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-10-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-9-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-3-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-7-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-8-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-21-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-20-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-22-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-33-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/5296-68-0x00000000023D0000-0x000000000345E000-memory.dmp upx behavioral2/memory/1176-87-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-99-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-96-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-97-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-95-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-94-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-91-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-93-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-85-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-106-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-107-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-142-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-167-0x0000000002390000-0x000000000341E000-memory.dmp upx behavioral2/memory/1176-182-0x0000000002390000-0x000000000341E000-memory.dmp upx - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 2244 cmd.exe 4248 cmd.exe 2312 cmd.exe 4640 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtmps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\ WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\ WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\ WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\ WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\ WdExt.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 1176 WdExt.exe 1176 WdExt.exe 1176 WdExt.exe 1176 WdExt.exe 1176 WdExt.exe 1176 WdExt.exe 3800 launch.exe 3800 launch.exe 3800 launch.exe 3800 launch.exe 3800 launch.exe 3800 launch.exe 3800 launch.exe 3800 launch.exe 3800 launch.exe 3800 launch.exe 720 launch.exe 720 launch.exe 720 launch.exe 720 launch.exe 720 launch.exe 720 launch.exe 720 launch.exe 720 launch.exe 720 launch.exe 720 launch.exe 720 launch.exe 720 launch.exe 3800 launch.exe 3800 launch.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5296 wrote to memory of 1164 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 15 PID 5296 wrote to memory of 2892 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 45 PID 5296 wrote to memory of 3188 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 47 PID 5296 wrote to memory of 3480 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 48 PID 5296 wrote to memory of 3180 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 55 PID 5296 wrote to memory of 4320 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 57 PID 5296 wrote to memory of 4424 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 58 PID 5296 wrote to memory of 4472 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 59 PID 5296 wrote to memory of 4800 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 61 PID 5296 wrote to memory of 4168 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 62 PID 5296 wrote to memory of 5208 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 63 PID 5296 wrote to memory of 5272 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 64 PID 5296 wrote to memory of 5312 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 65 PID 5296 wrote to memory of 5132 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 78 PID 5296 wrote to memory of 4516 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 80 PID 5296 wrote to memory of 1628 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 81 PID 5296 wrote to memory of 1608 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 82 PID 5296 wrote to memory of 1164 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 15 PID 5296 wrote to memory of 2892 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 45 PID 5296 wrote to memory of 3188 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 47 PID 5296 wrote to memory of 3480 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 48 PID 5296 wrote to memory of 3180 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 55 PID 5296 wrote to memory of 4320 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 57 PID 5296 wrote to memory of 4424 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 58 PID 5296 wrote to memory of 4472 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 59 PID 5296 wrote to memory of 4800 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 61 PID 5296 wrote to memory of 4168 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 62 PID 5296 wrote to memory of 5208 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 63 PID 5296 wrote to memory of 5272 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 64 PID 5296 wrote to memory of 5312 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 65 PID 5296 wrote to memory of 5132 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 78 PID 5296 wrote to memory of 4516 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 80 PID 5296 wrote to memory of 1628 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 81 PID 5296 wrote to memory of 1608 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 82 PID 5296 wrote to memory of 2312 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 89 PID 5296 wrote to memory of 4640 5296 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 91 PID 2312 wrote to memory of 1176 2312 cmd.exe 93 PID 1176 wrote to memory of 1164 1176 WdExt.exe 15 PID 1176 wrote to memory of 2892 1176 WdExt.exe 45 PID 1176 wrote to memory of 3188 1176 WdExt.exe 47 PID 1176 wrote to memory of 3480 1176 WdExt.exe 48 PID 1176 wrote to memory of 3180 1176 WdExt.exe 55 PID 1176 wrote to memory of 4320 1176 WdExt.exe 57 PID 1176 wrote to memory of 4424 1176 WdExt.exe 58 PID 1176 wrote to memory of 4472 1176 WdExt.exe 59 PID 1176 wrote to memory of 4800 1176 WdExt.exe 61 PID 1176 wrote to memory of 4168 1176 WdExt.exe 62 PID 1176 wrote to memory of 5208 1176 WdExt.exe 63 PID 1176 wrote to memory of 5272 1176 WdExt.exe 64 PID 1176 wrote to memory of 5312 1176 WdExt.exe 65 PID 1176 wrote to memory of 5132 1176 WdExt.exe 78 PID 1176 wrote to memory of 4516 1176 WdExt.exe 80 PID 1176 wrote to memory of 1628 1176 WdExt.exe 81 PID 1176 wrote to memory of 1608 1176 WdExt.exe 82 PID 1176 wrote to memory of 2312 1176 WdExt.exe 89 PID 1176 wrote to memory of 2312 1176 WdExt.exe 89 PID 1176 wrote to memory of 5920 1176 WdExt.exe 90 PID 1176 wrote to memory of 4640 1176 WdExt.exe 91 PID 1176 wrote to memory of 1200 1176 WdExt.exe 92 PID 1176 wrote to memory of 1164 1176 WdExt.exe 15 PID 1176 wrote to memory of 2892 1176 WdExt.exe 45 PID 1176 wrote to memory of 3188 1176 WdExt.exe 47 PID 1176 wrote to memory of 3480 1176 WdExt.exe 48 PID 1176 wrote to memory of 3180 1176 WdExt.exe 55 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1164
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3188
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3480
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3180
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4320
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4424
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4472
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4800
-
C:\Windows\system32\ctfmon.exe/QuitInfo:000000000000026C;0000000000000270;1⤵PID:4168
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:5208
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:5272
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5312
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:5132
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:4516
-
C:\Users\Admin\AppData\Local\Temp\2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-14_0ac914ebd6b0813d46a34e287fef9cab_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5296 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:5920
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1176 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:2244 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 11767⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:3800 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4248 -
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5340 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe10⤵
- Executes dropped EXE
PID:1056
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4640 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:1200
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:1628
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:1608
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:720
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\733D.tmp
- Size 406B
- SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
- MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
- SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
- SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
- TLSH T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\tmp50D2.tmp
- Size 229KB
- SHA256 70a392389aecd0f58251e72c3fd7e9159f481061d14209ff8708a0fd9ff584dc
- MD5 6f90e1169d19dfde14d6f753f06c862b
- SHA1 e9bca93c68d7df73d000f4a6e6eb73a343682ac5
- SHA512 f0c898222e9578c01ebe1befac27a3fb68d8fb6e76c7d1dec7a8572c1aa3201bacf1e69aa63859e95606790cf09962bcf7dc33b770a6846bed5bd7ded957b0b3
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyq:u
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
- Size 276KB
- SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
- MD5 75c1467042b38332d1ea0298f29fb592
- SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
- SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
- SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
- TLSH T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Caches\Files\usd.dll
- Size 99KB
- SHA256 d3a46f71aa7467920b16b64c9d17eaf6c4e147f41cd1390dccff01e4a81f8dfa
- MD5 f1c9f4a1f92588aeb82be5d2d4c2c730
- SHA1 3dc5a017b15ba74fae2342937380905bf7e8fbd5
- SHA512 6171e740ce318d8fc35c92663684f2c35e7b5374c9a8ce6f4dc1c28c9ae62064f9cf44116266c650089bd5a3d328e87f9bdbd63ac1123e0a33ce52a1d21cffad
- SSDEEP 1536:AfVMTLl0+j+R3S6CVaTqifclr7MB3tY0ZHp8FkK4+3IOqFnToIfwCBztSoRa6A:Fl67CVgBbNEfZqtTBfwCptSw/A
- TLSH T16FA3AD0276E0C977C0B2407488DA5F3DAFBF765147359D839B4C976D2E70B60EA1A2CA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Common\Shared\dis.dll
- Size 120KB
- SHA256 b0c0c49eed934e6d2ed990913d4c71108f6104352d23f72d3ef0a3ef4074d92e
- MD5 1fcc5b3ed6bc76d70cfa49d051e0dff6
- SHA1 3ffa43efdc893a57dcad3d45c9b14980dd52eb58
- SHA512 8769438aacc26f0a720926f419a2564813dee2f526b2dbb7a3f57d587dc385612bf5780f4e39ce2149de5fb4c1af839dcc099f3d77387989e16d2bc76c6de929
- SSDEEP 3072:PWFWnu/0NPlE+qoytTBf+28aVytl34iQA:PW8nlQ+RytTBV2J
- TLSH T1A0C39E1376D085F7E1B2843099E99F3DEBFBB5318A618AC3574857681E31A50EE123CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
- Size 172KB
- SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
- MD5 daac1781c9d22f5743ade0cb41feaebf
- SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
- SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
- SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
- TLSH T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
- Size 1.8MB
- SHA256 46f5f7c474f994322d3005c73cd8c987d85aeda06e032d4eae16795f3392d650
- MD5 187d61b8be74d2805f8598444bdaa7fe
- SHA1 a7f4cf4f7c678b665e21e71d10e08a7deb1efaf8
- SHA512 9b2bdd4c8cccd3ab1ed9e785e9ef1301dd7a6e5717c4615858458bc471c6988aa0c81880ecd94124b0b7d5ae773e4f0d372ea8aff7101f74f623b5c79484d405
- SSDEEP 24576:i5dVtTj2i6Q8SdT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaopV:cbTC7xKCnFnQXBbrtgb/iQvu0UHOaB
- TLSH T10F85F0252790CC61F36FC07683E56E39BAB329213733D8866E4851316BF1E6FE781196
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Repairs\sha.dll
- Size 89KB
- SHA256 0b059565160c180df60470349770a6dd225981a8051639385bb49d33d2a73632
- MD5 6a9461f260ebb2556b8ae1d0ba93858a
- SHA1 01e14b87b69dce8272d84669f44f81d685dcf7c5
- SHA512 263041e149a2e7cd95c16a614175179b5e1fea8eca137aac02d903b45f107ad1c9467a3e790408caca7250b0cb83da77aa73887239f25b7b93b221cffc02772b
- SSDEEP 1536:h5QmUNtCKcKcyR2zh5Te2D6grD5Z3MIOKFnToIf+VHutHaA:hItC42zhlGgrXCKtTBf+VOtHaA
- TLSH T1CF939D22B2D08577C0B2843A44D65B3DEFBB362243355D935F4C6A691D71AA0EB273CB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
- Size 129B
- SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
- MD5 d1073c9b34d1bbd570928734aacff6a5
- SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
- SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
- TLSH T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 126B
- SHA256 3fb12f15e3b0594901267b9ef2b2f8794feb757f89e330e48dc6c7e19af220a5
- MD5 6b2b499b66dac08d5f98800a3d6952aa
- SHA1 5d5c55b803ba90ee8e9f53158d1751d7d40e658b
- SHA512 ede92929eecf009af838027307bc102972e3a0b4c2863d86b67c794614756b443b1ce1b56cddbcf710cde2fc1450b2226cbceed821eac985cec167c7d4585166
- TLSH T134B09B1603D9C70E745260570775945D50784EC13E947705C6118489314684DFD5A945
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 358B
- SHA256 7c3cd9df447e837f273906de3ec012089c698f286e2f0924d04a7beea622fa0b
- MD5 cf017c2f8e678787ebf8ed0ac6e47375
- SHA1 05ed989ebae48c156ca917db95f5d2d6080edb10
- SHA512 441cce3ebb0396131b954a8b35fdecc9f1c4bb0f5a01a161ccdf57715a3ddb5bee3498455a114d88b819151c1f6b2c8df7992c7da10b419f238a1d9b2ff6057e
- TLSH T16AE068C402BFC3692D8451870E69D25CC134BDA56B8C3BA94732C4E4A14094C7E12540
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
- Size 102B
- SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
- MD5 3ca08f080a7a28416774d80552d4aa08
- SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
- SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
- TLSH T114B0121243CBCF0D148060D70775A1CCC0740C983F947714DF11C84C314080DFDC6A41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 382KB
- SHA256 f0a24c3d4e5f5948dd84a9db1206e07b904c6c12ff9e20de2a2ad7d6b04c6946
- MD5 311930917a26dd0cc3754133b6ffc342
- SHA1 3c6baf292592dc733d71c2b984a7b75070b43aff
- SHA512 b8401339f12ebf39f9ec6ffad3d6db7188387d9fe997d74f11a0d324389758b777b14f4f4a732879259955c428db6d01644f541c9f21db90e2c7eb94b15ca2f0
- SSDEEP 6144:ED1coZXbdacDWZyehpRHy9H4dIBXCN2x/DMVP1tF+jBSVJ6:EDhZLdN9eNXdIlCNuorJ6
- TLSH T106842942AAE95420D2F357306A7DBB39212E78785BA0ECDFB24057FDA420AC19F75353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 f1f5087bfddeae3672a734dc6746b95e2fefd78dbc869de67fc36177be4f36a5
- MD5 ad00aa5cde78e11e0b17bb54706deafe
- SHA1 04fa3e81a22166786e9e2d243851b93207e58754
- SHA512 0f0fde7d4ba5920b88f131e9a24a1194ce015e50bc9c8bdda33ab4045e97c726fc70218ff051145d797a0e8d9d348f49620b542b2b23d408948eaa335ca37b3f
- TLSH T145D05E0E4FDD11ADD042002E317CD0C672399F11E8320F4C5139674164296DABFBE2AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mscaps.exe
- Size 200KB
- SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
- MD5 78d3c8705f8baf7d34e6a6737d1cfa18
- SHA1 9f09e248a29311dbeefae9d85937b13da042a010
- SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
- SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
- TLSH T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
- MD5 SHA1 SHA512 SSDEEP TLSH