Analysis
- max time kernel
148s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/08/2026, 15:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe
- Size 52KB
- Sample260820-s98w1aec85
- SHA256 da9d9fd23659e5e199015ebfda173a4d50e8759d705c5c6fa31a763dd5224733
- MD5 27332e162d0dfe8de5c106a08d1c8323
- SHA1 cd42f1e668938e0fe375d2556a8de1d535554f58
- SHA512 ab2f4b9a337466a44c4c95b6ca617d451293178fcb0c4e729f3fa8c99764f23513bc875733c4a18b81dbc15bca16f9c2ce9af1b0479a06294f77a0a09e43fd31
- SSDEEP 768:DlQ4hrvaEGU4aikqykezg2XpfYEjYioRo9Ztl5:5LhE1Dezg2ZfYJo/b5
- TLSH T1F6337C13F8ED05B3DD118AB124BB4B366B3BB9120651114BAF08DD9E7DB22849D3236B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\N: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\O: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\T: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\X: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Y: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Z: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\G: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\H: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\S: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\V: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\K: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\Q: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\R: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\U: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\W: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\D: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\I: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\J: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\M: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened (read-only) \??\P: 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\SETUPUGC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SPEECH_ONECORE\COMMON\SPEECHMODELDOWNLOAD.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TASKMGR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CONTROL.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DEVICEPAIRINGWIZARD.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHST3G.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSDT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSHTA.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\UNREGMP2.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WSCRIPT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DISKPART.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHWINAPP.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LODCTR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RUNONCE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MUIUNATTEND.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BACKGROUNDTRANSFERHOST.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COLORCPL.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EHSTORAUTHN.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCAD32.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PERFMON.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TAR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MFPMP.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSRA.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RECOVER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\USERACCOUNTCONTROLSETTINGS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FSQUIRT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCCONF.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WHOAMI.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GAMEBARPRESENCEWRITER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PATHPING.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PICKERHOST.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\AGENTACTIVATIONRUNTIMESTARTER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ISOBURN.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MAGNIFY.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHPROTOCOLHOST.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COMPUTERDEFAULTS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MAVINJECT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MMC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NTPRINT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PKGMGR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WIAACMGR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\APPIDTEL.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EUDCEDIT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EXPAND.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RUNAS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMINFO.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TRACERPT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BYTECODEGENERATOR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CMDKEY.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DWWIN.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMEJP\IMJPSET.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NETBTUGC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\POQEXEC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RPCPING.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TCPSVCS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\AUDITPOL.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CAMERASETTINGSUIHOST.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CURL.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FINDSTR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MTSTOCOM.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_ISV.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SETHC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WAITFOR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CERTENROLLCTRL.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OSMCLIENTICON.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\MSEDGE_PWA_LAUNCHER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\PWAHELPER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\NAMECONTROLSERVER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\OFFICEAPPGUARDWIN32.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\DW\DW20.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\DBCICONS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\XLICONS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\INTERNET EXPLORER\IELOWUTIL.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JJS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVDLLSURROGATE32.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\POWERPNT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\FILECOMPARE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\MSMPENG.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_128796\JAVA.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OFFICEC2RCLIENT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JABSWITCH.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\CNFNOT32.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\OUTLOOK.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SDXHELPER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\MISC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\MSSENSE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ADELRCP.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\MSOICONS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\WORDICON.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATEBROKER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MOZILLA MAINTENANCE SERVICE\UNINSTALL.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\PPTICO.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\PRIVATE_BROWSING.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JSTATD.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\NATIVE2ASCII.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\ORBD.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PDFREFLOW.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\COMMON.DBCONNECTION.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROCEF\RDRCEF.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATEONDEMAND.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATESETUP.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\RMIREGISTRY.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\PACK200.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PPTICO.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\MSOHTMED.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\COOKIE_EXPORTER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\INSTALLER\SETUP.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVADOC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\PLUG_INS\PI_BROKERS\64BITMAPIBROKER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\MSEDGE_PROXY.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS PHOTO VIEWER\IMAGINGDEVICES.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JDB.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0409-1000-0000000FF1CE}\MISC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE_PROXY.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\ELEVATED_TRACING_SERVICE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVAWS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\PACK200.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOTD.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX64\MICROSOFT ANALYSIS SERVICES\AS OLEDB\140\SQLDUMPER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSECM.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNSCFG.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPRPH.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JARSIGNER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KINIT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-IIS-SHAREDLIBRARIES_31BF3856AD364E35_10.0.26100.1_NONE_1831C57751BFB3CC\IISRESET.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PRINTING-SPOOLER-CORE_31BF3856AD364E35_10.0.26100.1591_NONE_720B9E48718F9C5A\SPOOLSVWORKER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_10.0.26100.1301_NONE_CE938C0EFEDCDE06\TCPSVCS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-A..ENCE-INFRASTRUCTURE_31BF3856AD364E35_10.0.26100.1591_NONE_7B25A93731217002\R\SDBINST.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-U..OUNTCONTROLSETTINGS_31BF3856AD364E35_10.0.26100.1591_NONE_29B9B764BD0322B9\R\USERACCOUNTCONTROLSETTINGS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-VERCLSID_31BF3856AD364E35_10.0.26100.1_NONE_C32F23E8B061A8A0\VERCLSID.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CSC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..NFRASTRUCTUREBGHOST_31BF3856AD364E35_10.0.26100.1_NONE_6DE688B2D1A76706\BACKGROUNDTASKHOST.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-UNATTENDEDJOIN_31BF3856AD364E35_10.0.26100.1_NONE_B0088CFFD56138B1\DJOIN.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WCF-M_SM_CFG_INS_EXE_31BF3856AD364E35_10.0.26100.1_NONE_FD15047085B284F0\SMCONFIGINSTALLER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-APPLICATION..EGISTRATIONVERIFIER_31BF3856AD364E35_10.0.26100.1150_NONE_22D7B78874FA20B2\R\APPHOSTREGISTRATIONVERIFIER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SECURITYCENTER-CORE_31BF3856AD364E35_10.0.26100.1591_NONE_C055032B96806F80\WSCADMINUI.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.26100.1591_NONE_68327241782DD35B\APPVNICE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..X-DIRECTXDIAGNOSTIC_31BF3856AD364E35_10.0.26100.1591_NONE_BF8393590DCAD014\R\DXDIAG.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..DARYAUTHFACTOR-TASK_31BF3856AD364E35_10.0.26100.1150_NONE_67ED785BF55A7A21\R\DEVICECREDENTIALDEPLOYMENT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-PNP-DRVINST_31BF3856AD364E35_10.0.26100.1591_NONE_F11DD8B719F1A6F5\R\DRVINST.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..-DEPLOYMENT-PACKAGE_31BF3856AD364E35_10.0.26100.1_NONE_5BC14811EC1C13BC\TFTP.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TIERINGENGINE_31BF3856AD364E35_10.0.26100.1150_NONE_4B5F1683145608DD\TIERINGENGINESERVICE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-COMMANDPROMPT_31BF3856AD364E35_10.0.26100.1591_NONE_31216C35FEC422AE\CMD.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-I..ETEXPLORER-OPTIONAL_31BF3856AD364E35_11.0.26100.1_NONE_D3F029E4B58D022B\IEXPLORE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGBROWSERS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SENSORS-RUNTIMEBROKER_31BF3856AD364E35_10.0.26100.1591_NONE_4483428C4F7FB3A1\SENSORRUNTIMEBROKER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..CESFRAMEWORK-CTFMON_31BF3856AD364E35_10.0.26100.1591_NONE_38F087FA4098616B\CTFMON.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-ERRORREPORTINGCORE_31BF3856AD364E35_10.0.26100.1591_NONE_C68B578EEA4BD528\R\WERMGR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ADDINPROCESS.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..SCANNERPREVIEW-HOST_31BF3856AD364E35_10.0.26100.1150_NONE_2E44A4DC7EF60E78\R\CAMERABARCODESCANNERPREVIEW.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..NSEMANAGER-SHELLEXT_31BF3856AD364E35_10.0.26100.1150_NONE_4E317F44E4F64723\R\LICENSEMANAGERSHELLEXT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ROPERTIESPROTECTION_31BF3856AD364E35_10.0.26100.1_NONE_60A5FF2E85104E26\SYSTEMPROPERTIESPROTECTION.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-COMPONENT_31BF3856AD364E35_10.0.26100.1591_NONE_CDEC79755D491FDB\R\SETUP.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-CONTROL_31BF3856AD364E35_10.0.26100.1_NONE_A0B44BF0476B30ED\CONTROL.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ASPNET_STATE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COMMANDPROMPT_31BF3856AD364E35_10.0.26100.1591_NONE_26CCC1E3CA6360B3\R\CMD.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-G..ATION-WINCOMPONENTS_31BF3856AD364E35_10.0.26100.1150_NONE_37ADCB75A8302256\WINDOWSACTIONDIALOG.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ELDEBUGGER-RECORDER_31BF3856AD364E35_10.0.26100.1_NONE_6157B26C767F49A2\TTDINJECT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..ES-INPUTREDIRECTION_31BF3856AD364E35_10.0.26100.1591_NONE_9FE4B2D813F9A989\RDPINPUT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-SENSECLIENT-SERVICE_31BF3856AD364E35_10.0.26100.1_NONE_A518656DF7C165FB\SENSEIDENTITY.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-A..ROBLEMSTEPSRECORDER_31BF3856AD364E35_10.0.26100.1591_NONE_810636A52F615C2D\PSR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-VMSP_31BF3856AD364E35_10.0.26100.1_NONE_80D7A0E325078A11\VMSP.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RECDISC-MAIN_31BF3856AD364E35_10.0.26100.1150_NONE_20634AE8638B2E34\RECDISC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..MINALSERVICESCLIENT_31BF3856AD364E35_10.0.26100.1000_NONE_E9C96C85D0FDDDDD\R\MSTSC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-WMPDMC-UX_31BF3856AD364E35_10.0.26100.1_NONE_EB5719295FED7363\WMPDMC.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-SENSECLIENT-SERVICE_31BF3856AD364E35_10.0.26100.1_NONE_A518656DF7C165FB\SENSESAMPLEUPLOADER.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-OPENFILES_31BF3856AD364E35_10.0.26100.1_NONE_EE6EB9B387518683\OPENFILES.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONTAINERDIAGNOSTICSTOOL_31BF3856AD364E35_10.0.26100.1150_NONE_234860E0E753C908\HCSDIAG.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CSVDE_31BF3856AD364E35_10.0.26100.1150_NONE_F7257BCE926EA30A\R\CSVDE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-UPDATE-UUS-CORE-UX_31BF3856AD364E35_10.0.26100.1591_NONE_8F2563A7AC59897B\R\MONOTIFICATIONUXSTUB.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WPF-PRESENTATIONHOSTEXE_31BF3856AD364E35_10.0.26100.1150_NONE_0BDB83C7D007C6BC\PRESENTATIONHOST.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-IE-IEXPRESS_31BF3856AD364E35_11.0.26100.1150_NONE_441B414B1810724C\WEXTRACT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MIGRATIONENGINE_31BF3856AD364E35_10.0.26100.1591_NONE_F467D2D98B46D418\MIGHOST.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..TTINGS-REMOVEDEVICE_31BF3856AD364E35_10.0.26100.1150_NONE_4F487E99A54CB5D2\SYSTEMSETTINGSREMOVEDEVICE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SPEECHCOMMON-ONECORE_31BF3856AD364E35_10.0.26100.1591_NONE_0F19119BCDCAF335\R\SPEECHMODELDOWNLOAD.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONTAINERDIAGNOSTICSTOOL_31BF3856AD364E35_10.0.26100.1150_NONE_234860E0E753C908\R\HCSDIAG.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-M..OMMANDLINEUTILITIES_31BF3856AD364E35_10.0.26100.1_NONE_7A109607CFE12F00\SUBST.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MULTIPOINT-LOGCOLLECTOR_31BF3856AD364E35_10.0.26100.1_NONE_9D1627FD03AED8D9\LOGCOLLECTOR.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-IE-HTMLAPPLICATION_31BF3856AD364E35_11.0.26100.1_NONE_9493BCCC1124C937\MSHTA.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX4-ASPNET_WP_EXE_B03F5F7F11D50A3A_4.0.15912.365_NONE_068E99C8DD0D8394\ASPNET_WP.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_DUAL_KDNIC.INF_31BF3856AD364E35_10.0.26100.1150_NONE_0D22CB5713B04A04\R\KDNICCTRL.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-HOST-SERVICE_31BF3856AD364E35_10.0.26100.1742_NONE_934DAED75BCEA2EA\VMCOMPUTE.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..ONENTPACKAGESUPPORT_31BF3856AD364E35_10.0.26100.1150_NONE_FBA3BB9888BF82A5\R\COMPPKGSRV.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-DEFENDER-SERVICE_31BF3856AD364E35_10.0.26100.1_NONE_C299CB2EBF592E77\DLPUSERAGENT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-REMOTEASSISTANCE-EXE_31BF3856AD364E35_10.0.26100.1591_NONE_D3181252B1ECA58B\R\MSRA.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ATIVE-SERVERBOX-ISV_31BF3856AD364E35_10.0.26100.1150_NONE_90FE1FFFAE58C8C8\RMACTIVATE_SSP_ISV.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-UPDATE-UUS-CORE_31BF3856AD364E35_10.0.26100.1591_NONE_944DE837A97599AB\USOCLIENT.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_USEREXPERIENCE-DESKTOP_31BF3856AD364E35_10.0.26100.1591_NONE_C815E77F1A5104DD\CBS\WEBEXPERIENCEHOSTAPP.EXE 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 6080 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe 6080 2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-20_27332e162d0dfe8de5c106a08d1c8323_elex_nymaim_rhadamanthys_wannacry.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:6080
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1