Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 02:05
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-09-29_465a59bb45ba63bb3ef08651e6e8e6c0_amadey_elex_ipamor_rhadamanthys_wannacry.exe
Resource
win10v2004-20260911-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-29_465a59bb45ba63bb3ef08651e6e8e6c0_amadey_elex_ipamor_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260911-en
4 signatures
150 seconds
General
- Target 2026-09-29_465a59bb45ba63bb3ef08651e6e8e6c0_amadey_elex_ipamor_rhadamanthys_wannacry.exe
- Size 93KB
- Sample260930-chvx3acd23
- SHA256 9f7fc48d498e67b68b9225ae6dfc69f24bed0e22ec1b7b30f99b1022110b934b
- MD5 465a59bb45ba63bb3ef08651e6e8e6c0
- SHA1 4bdbb01569ef4698bc09b9e94ac6f40407b9ca1b
- SHA512 f44c023520fb35e9438b3c7500e4328c93f218e8c0de91209e67bf825c10b623b39f33f659b9fe907ebcfd78e1d6e004f51f12c9750869b1eb4d11a262875025
- SSDEEP 1536:H5QIi+G5qH4u2eziPLRGpzA9RojCJ37S++/pVomCEi1U:ZQVG4urzuVGp8rojCJ37N+hVomCP1U
- TLSH T152934A1769A0807AF995013F14B50A1E9ABADD35CD339907FB60FA7B2C3119BDD17213
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- Detects executables packed with ASPack 3 IoCs
resource yara_rule behavioral2/memory/5052-0-0x0000000000400000-0x0000000000418000-memory.dmp INDICATOR_EXE_Packed_ASPack behavioral2/files/0x000d00000001c563-6.dat INDICATOR_EXE_Packed_ASPack behavioral2/memory/5052-7-0x0000000000400000-0x0000000000418000-memory.dmp INDICATOR_EXE_Packed_ASPack - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE" 2026-09-29_465a59bb45ba63bb3ef08651e6e8e6c0_amadey_elex_ipamor_rhadamanthys_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE" 2026-09-29_465a59bb45ba63bb3ef08651e6e8e6c0_amadey_elex_ipamor_rhadamanthys_wannacry.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\dev89C8.tmp 2026-09-29_465a59bb45ba63bb3ef08651e6e8e6c0_amadey_elex_ipamor_rhadamanthys_wannacry.exe File created C:\WINDOWS\MSWDM.EXE 2026-09-29_465a59bb45ba63bb3ef08651e6e8e6c0_amadey_elex_ipamor_rhadamanthys_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-29_465a59bb45ba63bb3ef08651e6e8e6c0_amadey_elex_ipamor_rhadamanthys_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-29_465a59bb45ba63bb3ef08651e6e8e6c0_amadey_elex_ipamor_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-29_465a59bb45ba63bb3ef08651e6e8e6c0_amadey_elex_ipamor_rhadamanthys_wannacry.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:5052
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\MSWDM.EXE
- Size 55KB
- SHA256 d664a0d9f0b5702c55421a0f2064978d43de852e286518292a34cf46c9aad0ce
- MD5 56e67849f420f7b9b56667c122f54875
- SHA1 d538e906fa58c88d93c4959d514c4cd9cf997295
- SHA512 ef42cd5202ee16f2e6bc2acac2c98ca4399c99f6c0b74c1b80d93eedf9d3b487f53cd0318eaf132ef02a88a3a79735694c3bdc3cfa0c2aface0fb9ee77a68ce3
- SSDEEP 1536:H5QIi+G5qH4u2eziPLRGpzA9RojCJ37Sd:ZQVG4urzuVGp8rojCJ37g
- TLSH T1AC437C27BCA0817FC8C6457914B54F16AFFBDD3202219807EB906A8E3D726EEDD25217
- MD5 SHA1 SHA512 SSDEEP TLSH