Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/08/2026, 00:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe
- Size 92KB
- Sample260820-a1dqdsaf56
- SHA256 ab5c1634f936e19e9f61de6c04559fe2ff093d4e5d6d1722f888071ae5176422
- MD5 0ccb7396a6a0eff760a87873c03c96b9
- SHA1 38078a64e7a936a37497f0221cf7622917288b5f
- SHA512 f35326c67316c17f7eb73f5df3c6427a4d42e2ee856c360078605e9899596bfba3805f086e0a5c651d774841fcd0d2b15c61db9b395944f9fc4618e201593fe8
- SSDEEP 1536:/JvJnBpwdaMIOOnToIfiV6pdQcTUgaVojko:/JvxKaCqTBfiooXg4ojk
- TLSH T1AF938E137DD50AA3E8B2067000DA5B1EC77BFD30432695A7E70FAFE61B2259199352CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\BITSADMIN.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MAVINJECT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\VERIFIERGUI.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WWAHOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOCONV.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CREDWIZ.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DISM\DISMHOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IEUNATT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCLNWZ.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NETSH.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TAPIUNATTEND.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERPT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCCONF.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RMCLIENT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\UTILMAN.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINRSHOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WUSA.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DOSKEY.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FSQUIRT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHWINAPP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SRDELAYED.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DVDPLAY.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IEXPRESS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RASERVER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EXPAND.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPUEXC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MFPMP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TZUTIL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CONVERT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DPNSVR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DWWIN.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\UPNPCONT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CACLS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CERTENROLLCTRL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CLIP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COM\MIGREGDB.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FTP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICPL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\OPENFILES.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SHUTDOWN.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LOGMAN.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PSR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SXSTRACE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RASPHONE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RESMON.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ICACLS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LABEL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MMC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NETIOUGC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPROTECTION.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WERMGR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GPRESULT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSIEXEC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PRINTUI.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SETHC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SHRPUBW.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINRTNETMUAHOSTSERVER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WSMANHTTPCONFIG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE 15\CLIENTX64\INTEGRATEDOFFICE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32INFO.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\PLUG_INS\PI_BROKERS\32BITMAPIBROKER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\132.0.2957.140\MSEDGE_PWA_LAUNCHER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\MSEDGE_PWA_LAUNCHER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-040C-1000-0000000FF1CE}\MISC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.VP9VIDEOEXTENSIONS_1.0.22681.0_X64__8WEKYB3D8BBWE\CODECPACKS.VP9.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROTEXTEXTRACTOR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEXPLORE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\BHO\IE_TO_EDGE_STUB.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVAWS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\SSCICONS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\XLICONS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\UNINSTALL\HELPER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFT3DVIEWER_6.1908.2042.0_X64__8WEKYB3D8BBWE\3DVIEWER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.XBOX.TCUI_1.23.28002.0_X64__8WEKYB3D8BBWE\TCUI-APP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\ORBD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMID.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\RMIREGISTRY.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SSVAGENT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KINIT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KLIST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROLAYOUTRECOGNIZER\ACROLAYOUTRECOGNIZER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\PLUG_INS\PI_BROKERS\64BITMAPIBROKER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\INK\SHAPECOLLECTOR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JP2LAUNCHER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA-RMI.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\UNINSTALL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRCEF.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\TABTIP32.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTATD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MISC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.549981C3F5F10_1.1911.21713.0_X64__8WEKYB3D8BBWE\WIN32BRIDGE.SERVER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\FULLTRUSTNOTIFIER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\ELEVATION_SERVICE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\PWAHELPER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAH.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\PACK200.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JJS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\ORBD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSOLITAIRECOLLECTION_4.4.8204.0_X64__8WEKYB3D8BBWE\SOLITAIRE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.SKYPEAPP_14.53.77.0_X64__KZF8QXF38ZG5C\SKYPEBRIDGE\SKYPEBRIDGE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ADOBECOLLABSYNC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\132.0.2957.140\MSEDGE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\APPLETVIEWER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\SERVERTOOL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PUBS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.BINGWEATHER_4.25.20211.0_X64__8WEKYB3D8BBWE\MICROSOFT.MSN.WEATHER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE_PROXY.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JARSIGNER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMID.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PERFBOOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.EDGE.GAMEASSIST_1.0.3456.0_X64__8WEKYB3D8BBWE\EDGEGAMEASSIST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWSAPPS\MICROSOFT.MICROSOFTSTICKYNOTES_3.6.73.0_X64__8WEKYB3D8BBWE\MICROSOFT.NOTES.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\NOTIFICATION_HELPER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.147.37\MICROSOFTEDGEUPDATEBROKER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_COMPILER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-CLIENT-LI..M-SERVICE-MIGRATION_31BF3856AD364E35_10.0.19041.84_NONE_8EA6A37043F4AE90\CLIPUP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HNS-DIAGNOSTICSTOOL_31BF3856AD364E35_10.0.19041.1_NONE_5C015A65C60D8097\HNSDIAG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-VSTACK-VMWP_31BF3856AD364E35_10.0.19041.264_NONE_13222F28BEAA00A7\R\VMWP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-PNP-DRVINST_31BF3856AD364E35_10.0.19041.1202_NONE_CA1E0A7A1F21274C\R\DRVINST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_MSIL\WSATCONFIG\3.0.0.0__B03F5F7F11D50A3A\WSATCONFIG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACROTEXTEXTRACTOR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\APPLAUNCH.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CSC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.19041.1_NONE_23025624C75C162F\OOBELDR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-TETHERINGSERVICE_31BF3856AD364E35_10.0.19041.746_NONE_6BA9668B45CB4938\ICSENTITLEMENTHOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-U..IEDWRITEFILTER-MGMT_31BF3856AD364E35_10.0.19041.1266_NONE_41843EFC8F66BC7C\F\UWFMGR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.264_NONE_0E32F443C4669FED\F\HVIX64.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-CONSOLE-HOST-CORE_31BF3856AD364E35_10.0.19041.1288_NONE_E25DE9F9D964CDAD\CONHOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-ONLINESETUP-COMPONENT_31BF3856AD364E35_10.0.19041.1_NONE_23025624C75C162F\WINDEPLOY.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EULA.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMCONFIGINSTALLER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.CALLINGSHELLAPP_CW5N1H2TXYEWY\CALLINGSHELLAPP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.OOBENETWORKCAPTIVEPORTAL_CW5N1H2TXYEWY\OOBENETWORKCAPTIVEPORTAL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ADDINUTIL_B77A5C561934E089_4.0.15805.0_NONE_FCD173BC1B434B81\ADDINUTIL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGSQL_B03F5F7F11D50A3A_10.0.19041.1_NONE_C9157DDC38B83B1B\ASPNET_REGSQL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-S..CHSERVICE-COMPONENT_31BF3856AD364E35_10.0.19041.1266_NONE_2262E67641106C48\R\SPEECHRUNTIME.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..CATION-CREDUIBROKER_31BF3856AD364E35_10.0.19041.746_NONE_A8B46AAA6C07CA3D\CREDENTIALUIBROKER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\HELPPANE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSBUILD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\WFSERVICESREG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ILASM.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.XGPUEJECTDIALOG_CW5N1H2TXYEWY\XGPUEJECTDIALOG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\INPUTAPP\TEXTINPUTHOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\REGSVCS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_STATE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VBC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.SECUREASSESSMENTBROWSER_CW5N1H2TXYEWY\SECUREASSESSMENTBROWSER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\PARENTALCONTROLS_CW5N1H2TXYEWY\WPCUAPAPP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_COMPILER_B03F5F7F11D50A3A_4.0.15805.0_NONE_73CC8B3E43BA1056\ASPNET_COMPILER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_INSTALLUTIL_B03F5F7F11D50A3A_10.0.19041.1_NONE_F4B2FFFD9DA4C90A\INSTALLUTIL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_64\MSBUILD\3.5.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\COMSVCCONFIG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WPF\XAMLVIEWER\XAMLVIEWER_V0300.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.PINNINGCONFIRMATIONDIALOG_CW5N1H2TXYEWY\PINNINGCONFIRMATIONDIALOG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-HOST-SERVICE_31BF3856AD364E35_10.0.19041.1288_NONE_6C70124C60E2B4EF\R\VMCOMPUTE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.264_NONE_0E32F443C4669FED\HVIX64.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-D..ECTXDATABASEUPDATER_31BF3856AD364E35_10.0.19041.928_NONE_138FB436497565F4\DIRECTXDATABASEUPDATER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-UTILITYVM-SETUPAGENT_31BF3856AD364E35_10.0.19041.1_NONE_CF994A1A65720FD5\WCSETUPAGENT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\IEEXEC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MICROSOFT.WORKFLOW.COMPILER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SERVICEMODELREG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-I..ATEDUSERMODE-KERNEL_31BF3856AD364E35_10.0.19041.1023_NONE_5C93EF2449C89609\SECUREKERNEL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CSC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\BOOT\PCAT\MEMTEST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMCONFIGINSTALLER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS32.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\VBC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\JSC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\REGASM.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\RDRSERVICESUPDATER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\COMSVCCONFIG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\APPLAUNCH.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WPF\PRESENTATIONFONTCACHE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\JSC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_CURL_31BF3856AD364E35_10.0.19041.1_NONE_345CBD92BC885EBA\CURL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HNS-DIAGNOSTICSTOOL_31BF3856AD364E35_10.0.19041.423_NONE_841C30F68571C385\HNSDIAG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-DRIVERS-HYPERVISOR_31BF3856AD364E35_10.0.19041.264_NONE_0E32F443C4669FED\HVAX64.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:1236