Analysis
- max time kernel
150s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 00:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe
- Size 92KB
- Sample260820-a1dqdsaf56
- SHA256 ab5c1634f936e19e9f61de6c04559fe2ff093d4e5d6d1722f888071ae5176422
- MD5 0ccb7396a6a0eff760a87873c03c96b9
- SHA1 38078a64e7a936a37497f0221cf7622917288b5f
- SHA512 f35326c67316c17f7eb73f5df3c6427a4d42e2ee856c360078605e9899596bfba3805f086e0a5c651d774841fcd0d2b15c61db9b395944f9fc4618e201593fe8
- SSDEEP 1536:/JvJnBpwdaMIOOnToIfiV6pdQcTUgaVojko:/JvxKaCqTBfiooXg4ojk
- TLSH T1AF938E137DD50AA3E8B2067000DA5B1EC77BFD30432695A7E70FAFE61B2259199352CB
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\REGEDIT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\RMID.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ONENOTEM.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\FILECOMPARE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\SSCICONS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\NOTIFICATION_CLICK_HELPER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KINIT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KTAB.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\MSOUC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PPTICO.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\PLUG_INS\PI_BROKERS\64BITMAPIBROKER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_113265\JAVAWS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\PACK200.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KINIT.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PERFBOOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\ELEVATION_SERVICE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\INSTALLER\SETUP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\MSEDGE_PWA_LAUNCHER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS DEFENDER\MPCMDRUN.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\INSPECTOROFFICEGADGET.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\ELEVATED_TRACING_SERVICE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSADEBUGD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\CNFNOT32.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\MSOHTMED.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MPCOPYACCELERATOR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\JOTICON.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATECORE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\RMIREGISTRY.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JDB.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KLIST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PPTICO.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\READER_SL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\INSTALLER\SETUP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0C0A-1000-0000000FF1CE}\MISC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAFXPACKAGER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JABSWITCH.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVA.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PJ11ICON.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRCEF.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\PLUG_INS\PI_BROKERS\32BITMAPIBROKER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\PWAHELPER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\OS_UPDATE_HANDLER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\ORBD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.LOADER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOADFSB.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\COMMON.DBCONNECTION64.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ARH.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\COOKIE_EXPORTER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGECOMREGISTERSHELLARM64.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTACK.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\MSOXMLED.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVA.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\PWAHELPER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATEONDEMAND.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAWS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SCHEMAGEN.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PUBS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\FIREFOX.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSENDR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_STATE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DFSVC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ILASM.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\DATASVCUTIL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\COMSVCCONFIG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\JSC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\MSBUILD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\RDRSERVICESUPDATER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACROTEXTEXTRACTOR.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\MSBUILD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\VBC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\COMSVCCONFIG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\WSATCONFIG\V4.0_4.0.0.0__B03F5F7F11D50A3A\WSATCONFIG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\CASPOL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODELREG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NGENTASK.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\JSC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\ADDINPROCESS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSBUILD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ILASM.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\VBC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SMSVCHOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_32\MSBUILD\3.5.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\REGSVCS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_WP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SERVICEMODELREG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_COMPILER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\EDMGEN.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_STATE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VBC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\APPLAUNCH.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_REGIIS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCORSVW.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\VBC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\WSATCONFIG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\ASSEMBLY\GAC_64\MSBUILD\3.5.0.0__B03F5F7F11D50A3A\MSBUILD.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\BFSVC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\BROWSERCORE\BROWSERCORE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CVTRES.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS32.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ILASM.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_COMPILER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_STATE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_REGBROWSERS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\IMMERSIVECONTROLPANEL\SYSTEMSETTINGS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\EULA.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINPROCESS.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\LDR64.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACROBROKER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\INSTALLER\$PATCHCACHE$\MANAGED\68AB67CA7DA73301B744CAF070E41400\15.7.20033\ACRORD32.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DW20.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\APPLAUNCH.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\REGASM.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\COMSVCCONFIG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_WP.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CVTRES.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_COMPILER.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFSVC.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGSQL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WFSERVICESREG.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_STATE.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DATASVCUTIL.EXE 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-19_0ccb7396a6a0eff760a87873c03c96b9_elex_nymaim_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4352