c1eeb4f3372958fc9a373b7f9bf9ab43178ff261bfa570f1e499f4e98a74ed19

Analysis

max time kernel
12s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 22:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe
Size 2.1MB
Sample260912-2x2rlabd45
SHA256 c1eeb4f3372958fc9a373b7f9bf9ab43178ff261bfa570f1e499f4e98a74ed19
MD5 7b5416bd321bf7c6c595466b02bb6d3a
SHA1 5124a447dfaf283caf4c9662e65ce44764c38e47
SHA512 688a6e2c284a2ad1ea7d029c561677b910f81aaedd836511e574d1d68a0dd9ee68b7d3e0f1cbdd384590c4a9833e678cbf6bbf8896142093701d9cdc3e09846a
SSDEEP 49152:ktpU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvcp:ktpUgTH28
TLSH
T139A55212654A2F2CD54FD4B8DB4B89252A277C8A0F346BFF4685BD313A75AF42F28107
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/5052-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000500000001b86a-4.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5052-9-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2744-14-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5104-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x001300000001c493-19.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/5976-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/3924-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 4 IoCs

pid	Process
3924	MSWDM.EXE
5976	MSWDM.EXE
5096	2026-09-12_7B5416BD321BF7C6C595466B02BB6D3A_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE
2744	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe
File opened for modification	C:\Windows\dev20AD.tmp	2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-12_7B5416BD321BF7C6C595466B02BB6D3A_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5976	MSWDM.EXE
5976	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 3924	5052	2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe	89
PID 5052 wrote to memory of 5976	5052	2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe	90
PID 5976 wrote to memory of 5096	5976	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3924
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\dev20AD.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_7b5416bd321bf7c6c595466b02bb6d3a_amadey_elex_ipamor_rhadamanthys_wannacry.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:5976
- - C:\Users\Admin\AppData\Local\Temp\2026-09-12_7B5416BD321BF7C6C595466B02BB6D3A_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5096
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\dev20AD.tmp!C:\Users\Admin\AppData\Local\Temp\2026-09-12_7B5416BD321BF7C6C595466B02BB6D3A_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE!
    3⤵
    PID:5104

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-09-12_7B5416BD321BF7C6C595466B02BB6D3A_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-09-12_7B5416BD321BF7C6C595466B02BB6D3A_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE
Size 2.1MB
SHA256 c5ba5438bf2c8af4c7601057ae05546948b793a5a3cf805238730a4fd8e5103f
MD5 1a03e6c7abc59f6de6a21290b3d3b3b0
SHA1 e6db206299dc20ee11b7a5463a57c30fdd651fd3
SHA512 2e5b5e8489984644ef75c79164a5a175a01441c8e09eeea66b875b6618ef1a3c454ad58337553d18593e3ddb2b538233f0bc6f0689071fb826912f2f3c976eac
SSDEEP 49152:ktpU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvcE:ktpUgTH2h
TLSH
T15DA55212654A2F2CD54FD4B8DB4B89252A277C8A0F346BFF4685BD313A75AF42F28107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 2.1MB
SHA256 0943e4d27c1102eaa9d0a6e9eeb3f0f7609625f69a9593c8294dacd5dfec264d
MD5 0ac09ff054c4154bb42f940112984d3d
SHA1 c5998e79c4a5dc9d1a3a038062d2ae97f6dc1ab1
SHA512 f01d369fdf5566a640bd77e18b8fd0877e2f7fadf8f45f4af6e7fc99292666d4e435bca46021a36b5effede01fbdb8b7ef8942e487a6d170322c4c0e4d299ac4
SSDEEP 49152:ktpU8ggw1g+1CART5eBiyKS3EI3wybn20DCYIHvco:ktpUgTH25
TLSH
T1CDA54212654A2F2CD54FD4B8DB4B89252A277C8A0F346BFF4685BD313A75AF42F28107
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dev20AD.tmp

Path C:\Windows\dev20AD.tmp
Size 14KB
SHA256 d7f887b1125daab225292049ca91fcf66c467aa12afa0ee0fdc18b7eea16a9ee
MD5 b4dd59e3c4c963355dc7882f548063a2
SHA1 4d335fd23f4d948e11a5e1c8722d8301d2596116
SHA512 1de82d9a057405d0854f9149117fff9f883486f080240c1a8a61bcecea7f031fdb26ac28a1d738a297138728dcd95e4c02b94477a0ebcdc468f194eaf0006d2c
SSDEEP 192:W9sB1zFNst1xohoLWHOO7jrUNpWP1oynJ+y7ihX8e28d/o:rB1z0t1x3WHTApA13+y7+X8m
TLSH
T10B52E742DBA404E5FBBB1B303AFA59535576BE214895EE0E467077DE1D30A00EA96323
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2744-14-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/3924-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5052-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5052-9-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5104-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/5976-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download