Analysis
- max time kernel
148s - max time network
81s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/09/2026, 22:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe
- Size 44KB
- Sample260912-18s36aba39
- SHA256 bb251ffb3eab47718aadeafe93136bd00fde062570c08fa809f2f051a803749d
- MD5 85e8404b6cbdeb627087d414558b6df5
- SHA1 140aeca33e8a7bfe771fd9913c1b0df90223d097
- SHA512 6767e645ce7373964ea5f0b90a5082cfef455f9d56e14e2eb73e76ffef5a5497f12a2090f652abffc05083d995b3417581a5a21a4f6e799e5351734ecdd61cba
- SSDEEP 768:p1zYgAsu/X8mMOvvGY6iEKy1gvopWDYioRoU8mFZ:zpWUmDjqgwpToZUZ
- TLSH T11A137B13BEE008B7FAA2467039F60B16677FFD110590985B9B287EDE2E31690D936353
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\CLEANMGR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DXDIAG.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ICACLS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SETX.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPROTECTION.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\UNREGMP2.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WECUTIL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FIXMAPI.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NET.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PICKERHOST.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PROVLAUNCH.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULTSECURE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ATTRIB.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CHARMAP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EHSTORAUTHN.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FONDUE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NET1.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CREDWIZ.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DFRGUI.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSDT.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NOTEPAD.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SRDELAYED.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\COMPUTERDEFAULTS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DDODIAG.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DLLHST3G.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RUNDLL32.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SETHC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WERFAULT.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DTDUMP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WAITFOR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CALC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\INSTNM.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_SSP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESHARDWARE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\XCOPY.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\POWERCFG.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TZUTIL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CONTROL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DVDPLAY.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RESMON.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIADAP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WLANEXT.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BITSADMIN.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EVENTCREATE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GETMAC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ICSUNATTEND.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LAUNCHWINAPP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ODBCCONF.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\POQEXEC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SDIAGNHOST.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GPRESULT.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PRINTUI.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ROBOCOPY.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SETUPUGC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TSWPFWRP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CHOICE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CTTUNESVR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DPLAYSVR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GPUPDATE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IEUNATT.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\8.0.15\CREATEDUMP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JDEPS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\TNAMESERV.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\NAMECONTROLSERVER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSEGPPARSER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPCONFIG.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\WORDCONV.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\DW\DW20.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\LYNCICON.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\BROWSER\WCCHROMEEXTN\WCCHROMENATIVEMESSAGINGHOST.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\PIPANEL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH\JAVAWS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IELOWUTIL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\POLICYTOOL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.LOADER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOADFSB.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OSMCLIENTICON.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\NOTIFICATION_HELPER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SERVERTOOL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\ACCICONS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\MSEDGE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_DISABLE\1.3.195.65\MICROSOFTEDGEUPDATESETUP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\DLPUSERAGENT.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER\NISSRV.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\SETUP_WM.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\ELEVATION_SERVICE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\ELEVATED_TRACING_SERVICE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\IDLJ.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\CLIENT\APPVLP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\DW\DWTRIG20.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPLAYER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\ELEVATION_SERVICE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\MSEDGEWEBVIEW2.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-001F-0C0A-1000-0000000FF1CE}\MISC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\CRASHREPORTER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\PLUG_INS\PI_BROKERS\32BITMAPIBROKER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\PWAHELPER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\ELEVATION_SERVICE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\INSTALLER\SETUP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\CHROME_PROXY.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\XLICONS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE_INSTALLER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSEAP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\BHO\IE_TO_EDGE_STUB.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\KTAB.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\DBCICONS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSENDR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATESETUP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SMART TAG\SMARTTAGINSTALL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\OHUB32.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\ORACLE\JAVA\JAVAPATH_TARGET_122484\JAVAWS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\PWAHELPER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\MSEDGE_PROXY.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JARSIGNER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JJS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOTD.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\IDENTITY_HELPER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\BHO\IE_TO_EDGE_STUB.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\JAVA.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\POLICYTOOL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSOUC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPREP-CHXAPP.APPXMAIN_31BF3856AD364E35_10.0.26100.1150_NONE_D3D0C423C229A48E\R\CHXSMARTSCREEN.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-COMMANDLINE-DSDIAG_31BF3856AD364E35_10.0.26100.1150_NONE_E81654FFADF307A4\DCDIAG.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINUTIL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\SERVICEMODELREG.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPMANAGEMENT-UEVAGENT_31BF3856AD364E35_10.0.26100.1591_NONE_986BA09695018480\R\UEVAGENTPOLICYGENERATOR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BTH-USER_31BF3856AD364E35_10.0.26100.1_NONE_620CE84C3DBAADFF\FSQUIRT.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..DIALOGHOST.APPXMAIN_31BF3856AD364E35_10.0.26100.1150_NONE_AB86CA35F5EA21F3\CREDDIALOGHOST.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CLOUDNOTIFICATIONS_31BF3856AD364E35_10.0.26100.1591_NONE_2DC797084143CFAF\R\CLOUDNOTIFICATIONS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CTTUNESVR_31BF3856AD364E35_10.0.26100.1150_NONE_8BE227BACE421D8D\R\CTTUNESVR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\WINDOWS.CBSPREVIEW_CW5N1H2TXYEWY\CAMERABARCODESCANNERPREVIEW.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\WINDOWS.PRINTDIALOG_CW5N1H2TXYEWY\PRINTDIALOG.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_ASPNET_REGBROWSERS_B03F5F7F11D50A3A_4.0.15912.0_NONE_6650E9DF0164E801\ASPNET_REGBROWSERS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONTAINERDIAGNOSTICSTOOL_31BF3856AD364E35_10.0.26100.1150_NONE_234860E0E753C908\HCSDIAG.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-E..TAPROTECTIONCLEANUP_31BF3856AD364E35_10.0.26100.1591_NONE_717110DB66A82F37\R\EDPCLEANUP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.26100.1591_NONE_68327241782DD35B\SYNCAPPVPUBLISHINGSERVER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPMANAGEMENT-UEVAGENT_31BF3856AD364E35_10.0.26100.1591_NONE_986BA09695018480\R\UEVAPPMONITOR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-EASHARED-IMEBROKER_31BF3856AD364E35_10.0.26100.1150_NONE_25A595B3A76AB6CF\IMEBROKER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\REGSVCS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_EVENTVIEWERSETTINGS_31BF3856AD364E35_10.0.26100.1_NONE_F1EB80676C3FBE87\EVENTVWR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPX-DEPLOYMENT-SERVER_31BF3856AD364E35_10.0.26100.1742_NONE_FCF4914266C3A69D\APPLYTRUSTOFFLINE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AUDIT-COMPONENT_31BF3856AD364E35_10.0.26100.1_NONE_A3ABE7A4DF6B292A\AUDIT.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\CSC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\APPLAUNCH.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.PRINTQUEUEACTIONCENTER_CW5N1H2TXYEWY\PRINTQUEUEACTIONCENTER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..ENCE-INFRASTRUCTURE_31BF3856AD364E35_10.0.26100.1591_NONE_70D0FEE4FCC0AE07\SDBINST.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COM-DTC-RUNTIME_31BF3856AD364E35_10.0.26100.1150_NONE_B53A535C0FECE405\MSDTC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..AGEMENT-COMMANDLINE_31BF3856AD364E35_10.0.26100.1150_NONE_CB65497B42FC406D\DISM.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..IONDATA-CMDLINETOOL_31BF3856AD364E35_10.0.26100.1150_NONE_24124D3C551588CE\R\BCDEDIT.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\ILASM.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\NGEN.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFTWINDOWS.CLIENT.CBS_CW5N1H2TXYEWY\FESEARCHHOST.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-CONSOLE-HOST-CORE_31BF3856AD364E35_10.0.26100.1591_NONE_09563E96D43BE8D8\R\CONHOST.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\WFSERVICESREG.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CVTRES.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\SHELLEXPERIENCEHOST_CW5N1H2TXYEWY\SHELLEXPERIENCEHOST.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-CLIENT-LI..M-SERVICE-MIGRATION_31BF3856AD364E35_10.0.26100.1742_NONE_32A8C94CC5F2EEF2\R\CLIPUP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\REGASM.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ASPNET_REGSQL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-ONECORE-PNP-DRVINST_31BF3856AD364E35_10.0.26100.1591_NONE_F11DD8B719F1A6F5\R\DRVINST.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\MSCORSVW.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DFSVC.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\CVTRES.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.NARRATORQUICKSTART_8WEKYB3D8BBWE\NARRATORQUICKSTART.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINHLP32.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPMANAGEMENT-UEVAGENT_31BF3856AD364E35_10.0.26100.1591_NONE_986BA09695018480\R\UEVTEMPLATEBASELINEGENERATOR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONTAINER-MANAGER_31BF3856AD364E35_10.0.26100.1591_NONE_2E9FF92C8DAE3783\R\CMPROXYD.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.ACCOUNTSCONTROL_CW5N1H2TXYEWY\ACCOUNTSCONTROLHOST.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..NAGEMENT-APPVCLIENT_31BF3856AD364E35_10.0.26100.1591_NONE_68327241782DD35B\R\APPVNICE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPMANAGEMENT-UEVAGENT_31BF3856AD364E35_10.0.26100.1591_NONE_986BA09695018480\UEVTEMPLATECONFIGITEMGENERATOR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..AGEMENT-COREDPUSSVR_31BF3856AD364E35_10.0.26100.1150_NONE_373500BC10348045\COREDPUSSVR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\PARENTALCONTROLS_CW5N1H2TXYEWY\WPCUAPAPP.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..MENT-USERDATASOURCE_31BF3856AD364E35_10.0.26100.1150_NONE_01782765EBE4AF77\R\USERDATASOURCE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-APPX-DEPLOYMENT-SERVER_31BF3856AD364E35_10.0.26100.1742_NONE_FCF4914266C3A69D\R\APPLYTRUSTOFFLINE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ASSIGNEDACCESS-GUARD_31BF3856AD364E35_10.0.26100.1150_NONE_CE90AA676FE2A555\R\ASSIGNEDACCESSGUARD.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\UUS\AMD64\MOUSOCOREWORKER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.SECUREASSESSMENTBROWSER_CW5N1H2TXYEWY\SECUREASSESSMENTBROWSER.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-HYPER-V-D..S-VMSWITCH-NETSETUP_31BF3856AD364E35_10.0.26100.1742_NONE_200D0EE10B67FC30\NVSPINFO.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ADVANCEDTASKMANAGER_31BF3856AD364E35_10.0.26100.1742_NONE_4A8C1DF49B9AFB5A\R\LAUNCHTM.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ADVANCEDTASKMANAGER_31BF3856AD364E35_10.0.26100.1742_NONE_4A8C1DF49B9AFB5A\R\TASKMGR.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\SERVICEMODELREG.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V2.0.50727\ASPNET_REGIIS.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V3.5\DATASVCUTIL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_CURL_31BF3856AD364E35_10.0.26100.1301_NONE_1A384873CD299392\R\CURL.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..EXTSERVICE.APPXMAIN_31BF3856AD364E35_10.0.26100.1_NONE_4B95A6089B289B29\MICROSOFT.ASYNCTEXTSERVICE.EXE 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-12_85e8404b6cbdeb627087d414558b6df5_amadey_elex_rhadamanthys_wannacry.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:304