Analysis
- max time kernel
148s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 07:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe
- Size 52KB
- Sample260820-hvmecagj51
- SHA256 5bed3022c37954375c2955724e21fb8661e8723c4787d6935187be94a4a6d9fa
- MD5 7de9503c406ab6d0fcaec1114b7c4da6
- SHA1 1a408dce45539aa9037211b5a98be550543ad643
- SHA512 70132a302c164a6a206d3f69885e3ba9321791b47de5c8a17691dc795fa29690957a1470c110d012f001c1c49238600b49b34c604f5a21e25157924e7361660b
- SSDEEP 768:FlQ4hrvaEGU4aikqykezg2XpfY+jYioRolLVl5:fLhE1Dezg2ZfYroRD5
- TLSH T118337C13B9ED05B3DD518EB115BB0B376B3BB9120651118BAF08DD9E3DB22849D2237B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\V: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\W: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\H: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\M: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\N: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\T: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\U: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\J: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\K: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\L: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\P: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Q: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\X: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\G: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\O: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Y: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Z: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\D: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\I: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\R: 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\CMDL32.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FINGER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMEWDBLD.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RASAUTOU.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\STORDIAG.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TYPEPERF.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CONTROL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DIALER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EXPLORER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPDCT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSHTA.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\POWERCFG.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ROUTE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHPROTOCOLHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMESEARCH.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MCBUILDER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESADVANCED.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WIAACMGR.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWS.MEDIA.BACKGROUNDPLAYBACK.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WPDSHEXTAUTOPLAY.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WSCADMINUI.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BACKGROUNDTASKHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ISCSICPL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SNDVOL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TTTRACER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WWAHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CMSTP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHTM.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NEWDEV.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PRESENTATIONHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RMCLIENT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESHARDWARE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DFRGUI.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DTDUMP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NETSTAT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NOTEPAD.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIPRVSE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COMP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTVWR.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GPUPDATE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\HDWWIZ.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DISM.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FIND.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NDADMIN.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REG.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FIXMAPI.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GAMEPANEL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IPCONFIG.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\OPENFILES.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\THUMBNAILEXTRACTIONHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TOKENBROKERCOOKIES.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COM\MIGREGDB.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MAVINJECT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SCHTASKS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SVCHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TTDINJECT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTCREATE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINRTNETMUAHOSTSERVER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REGEDIT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BACKGROUNDTRANSFERHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\EXTEXPORT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAC.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KTAB.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\POLICYTOOL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MISC.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\FULLTRUSTNOTIFIER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\GOOGLE\UPDATE\DISABLEDGOOGLEUPDATE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZG.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\VSTO\10.0\VSTOINSTALLER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JCMD.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JP2LAUNCHER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IEINSTAL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\MSEDGEWEBVIEW2.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\MSEDGE_PWA_LAUNCHER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMPSHARE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVCLEANER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAFXPACKAGER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\GRAPH.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\WORDICON.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_128796\JAVAWS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\POLICYTOOL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\TNAMESERV.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVA.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MPCOPYACCELERATOR.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\IDENTITY_HELPER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATESETUP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOUC.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\BHO\IE_TO_EDGE_STUB.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\1.3.195.65\MICROSOFTEDGEUPDATEBROKER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVA.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PERFBOOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROLAYOUTRECOGNIZER\ACROLAYOUTRECOGNIZER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\WOW_HELPER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\MSEDGE_PWA_LAUNCHER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JP2LAUNCHER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\UNPACK200.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAWS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KINIT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PPTICO.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\COOKIE_EXPORTER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7Z.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\7-ZIP\7ZFM.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-006E-0409-1000-0000000FF1CE}\MISC.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACRORD32INFO.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\MSEDGE_PROXY.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\6.0.27\CREATEDUMP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAW.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\MSOHTMED.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\SSCICONS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSEIDENTITY.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\ELEVATION_SERVICE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OFFICEC2RCLIENT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVDLLSURROGATE64.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SETLANG.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\PLUG_INS\PI_BROKERS\64BITMAPIBROKER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\TABTIP32.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMIC.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JJS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\RMIREGISTRY.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\IECONTENTSERVICE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\DATABASECOMPARE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AUTOCHK_31BF3856AD364E35_10.0.26100.1_NONE_DEE795AA2A4DBD74\AUTOCHK.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..FRAMEWORKS-USERMODE_31BF3856AD364E35_10.0.26100.1591_NONE_38D18BB2A54A6D36\WUDFCOMPANIONHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ALSERVICES-WEBPROXY_31BF3856AD364E35_10.0.26100.1_NONE_2E6B5339C0DC1A38\TSWBPRXY.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SETHC_31BF3856AD364E35_10.0.26100.1591_NONE_08D4E4725982E790\R\EASEOFACCESSDIALOG.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_MICROSOFT-WINDOWS-IE-FEEDSBS_31BF3856AD364E35_11.0.26100.1_NONE_D11476BEF5CB0AEB\MSFEEDSSYNC.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYNCHOST_31BF3856AD364E35_10.0.26100.1150_NONE_05685D8FAC7C4F66\R\SYNCHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TABLETPC-INPUTPANEL_31BF3856AD364E35_10.0.26100.1591_NONE_AD4F10ED27892462\TABTIP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..TEELEVATEDINSTALLER_31BF3856AD364E35_10.0.26100.1150_NONE_21762269BB195F5B\R\WINDOWSUPDATEELEVATEDINSTALLER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-SHIELD-PROVIDER_31BF3856AD364E35_10.0.26100.1591_NONE_41B5BDF47D61C05C\R\SECURITYHEALTHSERVICE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RASAUTODIAL_31BF3856AD364E35_10.0.26100.1_NONE_1722516902407BE3\RASAUTOU.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-U..ETRY-CLIENT-WOWONLY_31BF3856AD364E35_10.0.26100.1591_NONE_324C8F3AF62CC63F\DTDUMP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-ASPNET_REGIIS_EXE_B03F5F7F11D50A3A_10.0.26100.1_NONE_6EBA2DC7C1074207\ASPNET_REGIIS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MAKECAB_31BF3856AD364E35_10.0.26100.1_NONE_EDC32A46D1CB7363\MAKECAB.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_COMPILER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FILEHISTORY-CORE_31BF3856AD364E35_10.0.26100.1591_NONE_50CCBCEB26D74098\FHMANAGEW.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-FONTVIEW_31BF3856AD364E35_10.0.26100.1150_NONE_E04B5DB66660EE87\FONTVIEW.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PRINTING-SPOOLER-CORE_31BF3856AD364E35_10.0.26100.1591_NONE_720B9E48718F9C5A\R\SPOOLSV.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..UP-DEVICEENCRYPTION_31BF3856AD364E35_10.0.26100.1591_NONE_7622B05853A7428C\BITLOCKERDEVICEENCRYPTION.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-TOOL-EXE_31BF3856AD364E35_10.0.26100.1_NONE_F70E66181FE2ECED\MANAGE-BDE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ERRORREPORTINGFAULTS_31BF3856AD364E35_10.0.26100.1591_NONE_0BC717C8ECD0287D\WERFAULTSECURE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..NCETOOLSCOMMANDLINE_31BF3856AD364E35_10.0.26100.1150_NONE_FD0ACB47AEBF06DB\R\LOGMAN.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHELL-CUSTOMSHELLHOST_31BF3856AD364E35_10.0.26100.1591_NONE_245703C14F08D5AA\R\CUSTOMSHELLHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_ASPNET_REGSQL_B03F5F7F11D50A3A_4.0.15912.355_NONE_CCA5D427D5C6DC80\ASPNET_REGSQL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-A..L-SYSTEMUWPLAUNCHER_31BF3856AD364E35_10.0.26100.1_NONE_0C53E49062AF0DD7\SYSTEMUWPLAUNCHER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINAPPSDK-CBS_31BF3856AD364E35_10.0.26100.1591_NONE_60AAD032A4073CBD\R\DEPLOYMENTAGENT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_COMPILER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-I..NTROLPANEL.APPXMAIN_31BF3856AD364E35_10.0.26100.1591_NONE_B67E058F470E99BC\SYSTEMSETTINGS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_10.0.26100.1301_NONE_CE938C0EFEDCDE06\ARP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.OOBENETWORKCONNECTIONFLOW_CW5N1H2TXYEWY\OOBENETWORKCONNECTIONFLOW.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.CLIENT.CORE_CW5N1H2TXYEWY\SCREENCLIPPINGHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DRIVERVERIFIER_31BF3856AD364E35_10.0.26100.1150_NONE_56532B8E4CA54ECD\VERIFIERGUI.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..RANDPRINTUI-NTPRINT_31BF3856AD364E35_10.0.26100.1301_NONE_8BD012A12D6AF1F7\NTPRINT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SMARTSCREEN_31BF3856AD364E35_10.0.26100.1150_NONE_59491CDDD00C2DBA\SMARTSCREEN.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CHARMAP_31BF3856AD364E35_10.0.26100.1591_NONE_8E19B8855461FE2C\R\CHARMAP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-REGISTRY-EDITOR_31BF3856AD364E35_10.0.26100.1591_NONE_8FEEB08B8BDF7DDB\REGEDT32.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SYSTEMPROPERTIESREMOTE_31BF3856AD364E35_10.0.26100.1_NONE_91C8EAE9745A351D\SYSTEMPROPERTIESREMOTE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ELDEBUGGER-RECORDER_31BF3856AD364E35_10.0.26100.1_NONE_6157B26C767F49A2\TTDINJECT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_USEREXPERIENCE-DESKTOP_31BF3856AD364E35_10.0.26100.1591_NONE_C815E77F1A5104DD\R\CBS\TEXTINPUTHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-N..SETUP-COMPATIBILITY_31BF3856AD364E35_10.0.26100.712_NONE_1C98FC309BB195C5\NETCFGNOTIFYOBJECTHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEVICECENSUS_31BF3856AD364E35_10.0.26100.1591_NONE_4B326AB0AA8DA2BF\R\DEVICECENSUS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ISOBURN_31BF3856AD364E35_10.0.26100.1_NONE_E3264F8001C7DC21\ISOBURN.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-COMMANDLINETOOLS_31BF3856AD364E35_10.0.26100.1150_NONE_8097A9DCA8EE24C4\LOGOFF.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-ISCSI_INITIATOR_UI_31BF3856AD364E35_10.0.26100.1_NONE_DF337D63F8FF3BA4\ISCSICPL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..D-SEARCHINTEGRATION_31BF3856AD364E35_10.0.26100.1591_NONE_2177ACC33F68854A\IMESEARCH.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WINLOGON_31BF3856AD364E35_10.0.26100.1301_NONE_0B8F997B84F03748\R\WINLOGON.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-XWIZARD-HOST-PROCESS_31BF3856AD364E35_10.0.26100.1_NONE_55E7B933A1108505\XWIZARD.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-PROCESSMODEL-CPT_31BF3856AD364E35_10.0.26100.1_NONE_B21ADD2E107E23B6\W3WP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS32.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-G..ATION-WINCOMPONENTS_31BF3856AD364E35_10.0.26100.1150_NONE_37ADCB75A8302256\R\WINDOWSACTIONDIALOG.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RPC-PING_31BF3856AD364E35_10.0.26100.1_NONE_9AADB670A9451E5D\RPCPING.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_NETFX4-NGEN_EXE_B03F5F7F11D50A3A_4.0.15912.0_NONE_FC8DF34CE61B153B\NGEN.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.ECAPP_8WEKYB3D8BBWE\MICROSOFT.ECAPP.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..RIENCEHOST.APPXMAIN_31BF3856AD364E35_10.0.26100.1301_NONE_970881BA6260E29A\R\STARTMENUEXPERIENCEHOST.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CSRSS_31BF3856AD364E35_10.0.26100.1_NONE_55D78C384CA248D1\CSRSS.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LPKINSTALL_31BF3856AD364E35_10.0.26100.1150_NONE_A51A55A6FAF616D3\LPKINSTALL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NDKPERF-SETUP_31BF3856AD364E35_10.0.26100.1150_NONE_862CCCB1155D1695\NDKPERFCMD.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-INSTALLER-EXECUTABLE_31BF3856AD364E35_10.0.26100.712_NONE_F5F8369BA361B124\R\MSIEXEC.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.CAPTUREPICKER_CW5N1H2TXYEWY\CAPTUREPICKER.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ROBLEMSTEPSRECORDER_31BF3856AD364E35_10.0.26100.1591_NONE_76B18C52FB009A32\R\PSR.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAPLAYER-LOGAGENT_31BF3856AD364E35_10.0.26100.1150_NONE_8727DCAE71F2C0A2\R\LOGAGENT.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-SENSECLIENT-SERVICE_31BF3856AD364E35_10.0.26100.1_NONE_A518656DF7C165FB\MSSENSE.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-TPM-TOOL_31BF3856AD364E35_10.0.26100.1591_NONE_A44E7056D0E44981\R\TPMTOOL.EXE 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4876 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe 4876 2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_7de9503c406ab6d0fcaec1114b7c4da6_elex_nymaim_rhadamanthys_wannacry.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4876
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1