Analysis
- max time kernel
148s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 07:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe
- Size 52KB
- Sample260820-hs15qa1hpc
- SHA256 8cbf24868e549f0316b3a165d2aed2ce69e878c69b364f361ffd11c423cd6851
- MD5 8723d29618ac7076fc7d7defe0140311
- SHA1 e17f4b62a697912887fb8809d0c1070c8f1fd4d3
- SHA512 110f426a789c4e52024b5e35655f43bee2f9b53b7fbe8a053512bdf9b0ceaa3e1f8f00fb8b2d6aff3de755d6ca679cfaa3d8be71d20934b9fee4322994c22451
- SSDEEP 768:DlQ4hrvaEGU4aikqykezg2XpfYuTjYioRo3eyl5:5LhE1Dezg2ZfYu6ouw5
- TLSH T1B5337C13B8ED0173DD518AB124BB4B3B6B3BF9520651114BAF08DD9E7DB2284CD3236A
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\R: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\U: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\V: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\S: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\M: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\O: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\P: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\X: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Y: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\J: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\T: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\W: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Z: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Q: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\D: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\G: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\H: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\K: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\L: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\I: 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\COMP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DPISCALING.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\INFDEFAULTINSTALL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RASERVER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SFC.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMINFO.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESREMOTE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CMMON32.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CTFMON.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GPRESULT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\_ISDEL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MAGNIFY.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PASSWORDONWAKESETTINGFLYOUT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SETX.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHWINAPP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MOBSYNC.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PCAUI.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\W32TM.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIPRVSE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINRSHOST.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DCOMCNFG.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DDODIAG.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MFPMP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SUBST.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPERFORMANCE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\UTILMAN.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\XCOPY.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GETMAC.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL_ISE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CHOICE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CREDWIZ.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPERF.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DWWIN.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMEPADSV.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PACKAGEDCWALAUNCHER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNESVR.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CONTROL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FINDSTR.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FTP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMCCPHR.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\STORDIAG.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TOKENBROKERCOOKIES.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PSR.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TCPSVCS.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\USERINIT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WERMGR.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\AUTOFSTX.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHST3G.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\HELP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RESMON.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SETHC.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SRDELAYED.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYNCHOST.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FLTMC.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\AGENTACTIVATIONRUNTIMESTARTER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CMDL32.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EASEOFACCESSDIALOG.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PPTICO.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ADELRCP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\ELEVATED_TRACING_SERVICE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAW.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTATD.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMID.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOHTMED.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\OUTLOOK.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\READER_SL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\INSTALL\{3776D576-0A64-4D44-BF96-63E8D160091B}\MICROSOFTEDGE_X64_139.0.3405.125.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\MSINFO\MSINFO32.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JP2LAUNCHER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVDLLSURROGATE64.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.LOADER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\LOGTRANSPORT2.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVACPL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\VIDEOLAN\VLC\VLC-CACHE-GEN.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MPDEFENDERCORESERVICE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\NOTIFICATION_CLICK_HELPER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPRPH.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSQRY32.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\NISSRV.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\MSEDGE_PROXY.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\IDENTITY_HELPER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\PWAHELPER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\APPLETVIEWER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JARSIGNER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\INTEGRATION\INTEGRATOR.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\NAMECONTROLSERVER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\FLTLDR.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\1.3.195.65\MICROSOFTEDGEUPDATECOMREGISTERSHELL64.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KTAB.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0409-1000-0000000FF1CE}\MISC.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\TABTIP32.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\MSEDGE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAPACKAGER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JINFO.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOSREC.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSEAP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRCEF.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\EXTEXPORT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\PWAHELPER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\MICROSOFTEDGEUPDATE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\OFFICE16\LICLUA.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KEYTOOL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\PACK200.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KEYTOOL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMIREGISTRY.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\FILECOMPARE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\ORBD.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOTD.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\APPSHARINGHOOKCONTROLLER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\GRV_ICONS.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNETWK.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ADOBE\ARM\1.0\ADOBEARM.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATECOMREGISTERSHELL64.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-FSUTIL_31BF3856AD364E35_10.0.26100.1_NONE_D3AC672B8CD9F8B1\FSUTIL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-X..RTIFICATEENROLLMENT_31BF3856AD364E35_10.0.26100.1591_NONE_8F56B2193EADB75B\R\CERTENROLLCTRL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-D..-COMMANDLINE-DSMGMT_31BF3856AD364E35_10.0.26100.1_NONE_EBAB7AB3AF20BEC2\DSMGMT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\DFSVC.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..CYMANAGERBROKERHOST_31BF3856AD364E35_10.0.26100.1150_NONE_1AB61FFF20240053\EASPOLICYMANAGERBROKERHOST.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-CORE_31BF3856AD364E35_10.0.26100.1455_NONE_A73031E9FF1C7610\WMPLAYER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ECAPP.APPXMAIN_31BF3856AD364E35_10.0.26100.1150_NONE_98F799D63C0FA1B8\R\MICROSOFT.ECAPP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-HTMLAPPLICATION_31BF3856AD364E35_11.0.26100.1_NONE_8A3F1279DCC4073C\MSHTA.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LOCKAPP.APPXMAIN_31BF3856AD364E35_10.0.26100.1591_NONE_83300DAF83F8B2A6\LOCKAPP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_10.0.26100.1150_NONE_8097A9DCA8EE24C4\RESET.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-DPISCALING_31BF3856AD364E35_10.0.26100.1_NONE_819025E8F7DD72E4\DPISCALING.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-S..SOR-NATIVE-WHITEBOX_31BF3856AD364E35_10.0.26100.1742_NONE_46EF5CCA15F489F9\RMACTIVATE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-JAPANESE-UTILITIES_31BF3856AD364E35_10.0.26100.1591_NONE_88F13A0C22218100\R\IMJPUEX.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..RESENTATIONSETTINGS_31BF3856AD364E35_10.0.26100.1150_NONE_090EAB20B35405F2\PRESENTATIONSETTINGS.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..SPACES-SPACEMANAGER_31BF3856AD364E35_10.0.26100.1591_NONE_E5DE07285A53F2D6\SPACEMAN.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-COMMANDPROMPT_31BF3856AD364E35_10.0.26100.1591_NONE_31216C35FEC422AE\CMD.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MSINFO32-EXE-COMMON_31BF3856AD364E35_10.0.26100.1591_NONE_2C59A493CF48778F\R\MSINFO32.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_REGASM_B03F5F7F11D50A3A_10.0.26100.1_NONE_BB53CCDAC90DDA7A\REGASM.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-HYPER-V-VFPEXT_31BF3856AD364E35_10.0.26100.1591_NONE_9C7590519BC81879\R\VFPCTRL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-ACLUIFILEFOLDERCOMTOOL_31BF3856AD364E35_10.0.26100.1_NONE_5F97775AA22929CB\CACLS.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-WMI-CORE_31BF3856AD364E35_10.0.26100.1000_NONE_5F95CC5803DFAFCD\WMIADAP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NGEN.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-MBR2GPT_31BF3856AD364E35_10.0.26100.1591_NONE_9271E9806DF3EC14\MBR2GPT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTEMPROPERTIESREMOTE_31BF3856AD364E35_10.0.26100.1_NONE_91C8EAE9745A351D\SYSTEMPROPERTIESREMOTE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SPEECHCOMMON-ONECORE_31BF3856AD364E35_10.0.26100.1591_NONE_196DBBEE022BB530\R\SPEECHMODELDOWNLOAD.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ATBROKER_31BF3856AD364E35_10.0.26100.1591_NONE_6B60AAF7CE5C0F38\R\ATBROKER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-COMMANDLINE-DSDIAG_31BF3856AD364E35_10.0.26100.1150_NONE_E81654FFADF307A4\DCDIAG.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SCRIPTING_31BF3856AD364E35_10.0.26100.1591_NONE_E4284E3CB060C8BF\R\CSCRIPT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SPEECH-USEREXPERIENCE_31BF3856AD364E35_10.0.26100.1591_NONE_B7C9EB31FBD37700\R\SPEECHUXWIZ.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..TTINGS-REMOVEDEVICE_31BF3856AD364E35_10.0.26100.1150_NONE_4F487E99A54CB5D2\SYSTEMSETTINGSREMOVEDEVICE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_10.0.26100.1301_NONE_CE938C0EFEDCDE06\R\FINGER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-TIME-TOOL_31BF3856AD364E35_10.0.26100.1_NONE_F4516E08D8DBD686\W32TM.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.FILEEXPLORER_CW5N1H2TXYEWY\FILEEXPLORER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-COMMANDLINE-DSDIAG_31BF3856AD364E35_10.0.26100.1150_NONE_E81654FFADF307A4\R\DCDIAG.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SERVICINGSTACK_31BF3856AD364E35_10.0.26100.1738_NONE_A5031B637767A4E7\CONTAINERWORKER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_10.0.26100.1150_NONE_8097A9DCA8EE24C4\TSDISCON.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-MSCORSVW_EXE_B03F5F7F11D50A3A_10.0.26100.1_NONE_7C88976E8785AD0A\MSCORSVW.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-P..NFIGURATION-CMDLINE_31BF3856AD364E35_10.0.26100.1_NONE_10A40AEA1DAC80E8\POWERCFG.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RUNAS_31BF3856AD364E35_10.0.26100.1_NONE_67309BF6FA5ABF27\RUNAS.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-T..ELDEBUGGER-RECORDER_31BF3856AD364E35_10.0.26100.1_NONE_6BAC5CBEAAE00B9D\TTTRACER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\DFSVC.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_CURL_31BF3856AD364E35_10.0.26100.1301_NONE_1A384873CD299392\CURL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.26100.1591_NONE_68327241782DD35B\R\APPVSTREAMINGUX.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..RVICES-ADAM-INSTALL_31BF3856AD364E35_10.0.26100.1150_NONE_B8BBAAA483060B58\R\ADAMUNINSTALL.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ARTCARD-TPM-MANAGER_31BF3856AD364E35_10.0.26100.1150_NONE_36FD183D90DA21CB\TPMVSCMGR.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-BROWSERCORE_31BF3856AD364E35_10.0.26100.1150_NONE_F6B51F53AE693DE3\R\BROWSERCORE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-CLIP_31BF3856AD364E35_10.0.26100.1_NONE_AF2434CFB8EECC10\CLIP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MSDT_31BF3856AD364E35_10.0.26100.712_NONE_51F923C23ACE47FD\MSDT.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..ONMENT-CORE-TCBBOOT_31BF3856AD364E35_10.0.26100.1742_NONE_9C21C77DF9054577\R\TCBLAUNCH.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BLB-ENGINE-MAIN_31BF3856AD364E35_10.0.26100.1591_NONE_7FA1F11EAFC6C01D\WBENGINE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MSCONFIG-EXE_31BF3856AD364E35_10.0.26100.1591_NONE_763A39AA4DC6E7D5\MSCONFIG.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-UTILMAN_31BF3856AD364E35_10.0.26100.1591_NONE_9E69AB15E1442616\UTILMAN.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-CREDWIZ_31BF3856AD364E35_10.0.26100.712_NONE_4C51727A891CED07\CREDWIZ.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_10.0.26100.1301_NONE_D8E83661333DA001\ARP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NTSCONTROL.APPXMAIN_31BF3856AD364E35_10.0.26100.1591_NONE_29E868B2EDFF462B\ACCOUNTSCONTROLHOST.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LPKSETUP_31BF3856AD364E35_10.0.26100.1591_NONE_BD195C301C7F4E60\R\LPREMOVE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FILEPICKER.APPXMAIN_31BF3856AD364E35_10.0.26100.1591_NONE_5E31B7C284234E98\R\FILEPICKER.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-O..ECTIONFLOW.APPXMAIN_31BF3856AD364E35_10.0.26100.1150_NONE_C8DD030624B7F968\OOBENETWORKCONNECTIONFLOW.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..IONINGSECUREPROCESS_31BF3856AD364E35_10.0.26100.1150_NONE_32BD5B6FCFAB5B78\R\PSP.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RELIABILITY-POSTBOOT_31BF3856AD364E35_10.0.26100.1591_NONE_E980CB58B559B151\R\RELPOST.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX35LINQ-ADDINPROCESS_31BF3856AD364E35_10.0.26100.1_NONE_2D8AD328B5479B73\ADDINPROCESS.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-D..D-SEARCHINTEGRATION_31BF3856AD364E35_10.0.26100.1591_NONE_2BCC571573C94745\IMESEARCH.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RASCLIENTTOOLS_31BF3856AD364E35_10.0.26100.1_NONE_768F227B459E9F20\RASPHONE.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\COMSVCCONFIG\V4.0_4.0.0.0__B03F5F7F11D50A3A\COMSVCCONFIG.EXE 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3392 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe 3392 2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_8723d29618ac7076fc7d7defe0140311_elex_nymaim_rhadamanthys_wannacry.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3392
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1