b71a24d89ff5185f986ab8fc45ac54813dd4f1684ad11d323db4fcc0b7433035

Analysis

max time kernel
12s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe
Size 99KB
Sample260815-gp7yesfp4w
SHA256 b71a24d89ff5185f986ab8fc45ac54813dd4f1684ad11d323db4fcc0b7433035
MD5 503be18e85e6cd34976213a2235e075b
SHA1 b1cf122765d61b07c47631fb7d9828c7ddef8acd
SHA512 ea41dd72f54080bec99148bde762293e780c5e70984d58e8a4631c07a1819060e14e47986a0c03fdfd6ab024776a336621686535bb4a706f04d19f5084bb5dfc
SSDEEP 1536:EaM5QIi+G5qH4u2eziPLRGpzA9RojCJ37S+tYComCEi1b:zaQVG4urzuVGp8rojCJ37NtBomCP1b
TLSH
T135A39E13BEA081BBD9D6063824B54E569BF7ED320220DD47D7A07A8F3C72299DD26317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
5840	MSWDM.EXE
4708	MSWDM.EXE
3332	2026-08-15_503BE18E85E6CD34976213A2235E075B_AMADEY_ELEX_IPAMOR_NYMAIM_RHADAMANTHYS_WANNACRY.EXE
5108	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe
File opened for modification	C:\Windows\devF5F4.tmp	2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_503BE18E85E6CD34976213A2235E075B_AMADEY_ELEX_IPAMOR_NYMAIM_RHADAMANTHYS_WANNACRY.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4708	MSWDM.EXE
4708	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 5840	4188	2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe	88
PID 4188 wrote to memory of 4708	4188	2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe	89
PID 4708 wrote to memory of 3332	4708	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4188
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5840
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devF5F4.tmp!C:\Users\Admin\AppData\Local\Temp\2026-08-15_503be18e85e6cd34976213a2235e075b_amadey_elex_ipamor_nymaim_rhadamanthys_wannacry.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Users\Admin\AppData\Local\Temp\2026-08-15_503BE18E85E6CD34976213A2235E075B_AMADEY_ELEX_IPAMOR_NYMAIM_RHADAMANTHYS_WANNACRY.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:3332
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devF5F4.tmp!C:\Users\Admin\AppData\Local\Temp\2026-08-15_503BE18E85E6CD34976213A2235E075B_AMADEY_ELEX_IPAMOR_NYMAIM_RHADAMANTHYS_WANNACRY.EXE!
    3⤵
    PID:3692

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-15_503BE18E85E6CD34976213A2235E075B_AMADEY_ELEX_IPAMOR_NYMAIM_RHADAMANTHYS_WANNACRY.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-08-15_503BE18E85E6CD34976213A2235E075B_AMADEY_ELEX_IPAMOR_NYMAIM_RHADAMANTHYS_WANNACRY.EXE
Size 99KB
SHA256 8971302a28629266c0a08b1bdd7ebdafff71f4b94b8645b0951c331fdc2a6304
MD5 57fe04f98e8b5d96da6ae5bae396bc07
SHA1 283bb2a56c45f75bd5e3af9ae617e116c15b616d
SHA512 eb493f3324db9a9e41fabdf821a1d0f822bb0c389bddee6ccff5df56aec3625b10c99fd5011c19e1efd5bb4cfd10d2595bd5a8e14fa4b2b71c7c1ef9a6ea6361
SSDEEP 1536:EaM5QIi+G5qH4u2eziPLRGpzA9RojCJ37S+tYComCEi1b:zaQVG4urzuVGp8rojCJ37NtBomCP1b
TLSH
T12DA38E13BEA081BBD9D6063824B54E569BF7ED320220DD47D7A07A8F3C72299DD26317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 84KB
SHA256 21e12eb303a330a2752d0616a63cf9022d1cb4f6bbc53da3368c690632a3ad5f
MD5 95cd5f1de64d65fd9070221651e3b384
SHA1 2c1994ff0e1a597de0c3db561c0cc1a08b30a853
SHA512 6c752e12fb20991ff2d74a1671eb6d8339d5e162fa564ca9babc467b0f5e7e6153ac214a16597ab9418b1b889e0783a6a2a1607f1799edf3d4b47679d2131d9d
SSDEEP 1536:EaM5QIi+G5qH4u2eziPLRGpzA9RojCJ37S+tY:zaQVG4urzuVGp8rojCJ37Nt
TLSH
T1C4838C277CA0817FC4CA453914754F5A9BFADE3202219987DB907A8B3C722EEDD29317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devF5F4.tmp

Path C:\Windows\devF5F4.tmp
Size 15KB
SHA256 24a2472e3bd5016cb22ce14cefee112d5bc18354bf099e8e66ad9846aea15088
MD5 b0cec9f342bf95700b602ee376446577
SHA1 b955b1b64280bb0ea873538029cf5ea44081501b
SHA512 05ebecfc8d3e2e7885d3cacc65bfd97db710c2cbc0fb76b19b7d6cc82b327b25df953a20affc8d84002167dd8ac7710622279d3579c6605e742a98fe7095aa4e
SSDEEP 192:WN8CeeT+a2j12sUr/XKRbU+86HOO7+Bb2NpWP1oynJ+y7ihXar28d/o:xeT+a2jfUrfKRa6HiqpA13+y7+Xa1
TLSH
T15A62F7029FA804A1FBFB0B307EFA5D539576BD200964EF0E46707BAA5D70600E952767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3692-19-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4188-0-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4188-12-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4708-10-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/4708-21-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5108-15-0x0000000000400000-0x0000000000415000-memory.dmp

Download

memory/5840-22-0x0000000000400000-0x0000000000415000-memory.dmp

Download