Analysis
- max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/09/2026, 09:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 1.8MB
- Sample260930-lm9rfstycx
- SHA256 ba6019b8b4132ae2fea2c7affe52d078d6c75feecc2bd72efee606770b2366f7
- MD5 9022bfc154e6274124e03e3db5b971d5
- SHA1 1ff9915d99c2a8736e4ae01f3af24c6a5c179c64
- SHA512 b8651b412da169278e8e9f9a7b562e353f5eca2497f3e3d173e20bc15c9ca4bed1783e7ebf18a699be9ae1efe638c02e086cc9a1f7862f9bf30d155bc5c6bb27
- SSDEEP 49152:7bTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYm4:76ZxvWbrtUTrUHO24
- TLSH T1D895EF152790CD61F36FC07683E16E79B6B329213B33D986AE8855312BF2E1FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 23 IoCs
resource yara_rule behavioral1/memory/4708-1-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-2-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-7-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-51-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-141-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-164-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-155-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-165-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-107-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-50-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-12-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/4708-583-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-727-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-678-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-726-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-644-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-1604-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-760-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-673-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-677-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-643-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-667-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral1/memory/3128-642-0x0000000002240000-0x00000000032FA000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 25 IoCs
resource yara_rule behavioral1/memory/4708-1-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-2-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-7-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-51-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-141-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-164-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-155-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-165-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-107-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-50-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-12-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/4708-595-0x0000000000400000-0x000000000044B000-memory.dmp UPX behavioral1/memory/4708-583-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-727-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-678-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-726-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-644-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-1604-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-1613-0x0000000000400000-0x000000000044B000-memory.dmp UPX behavioral1/memory/3128-760-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-673-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-677-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-643-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-667-0x0000000002240000-0x00000000032FA000-memory.dmp UPX behavioral1/memory/3128-642-0x0000000002240000-0x00000000032FA000-memory.dmp UPX - Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation WdExt.exe Key value queried \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation launch.exe - Executes dropped EXE 5 IoCs
pid Process 3128 WdExt.exe 4892 launch.exe 4084 wtmps.exe 2344 launch.exe 964 mscaps.exe - Loads dropped DLL 2 IoCs
pid Process 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 3128 WdExt.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WdExt.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe -
resource yara_rule behavioral1/memory/4708-1-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-2-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-7-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-51-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-141-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-164-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-155-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-165-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-107-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-50-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-12-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/4708-583-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-727-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-678-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-726-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-644-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-1604-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-760-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-673-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-677-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-643-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-667-0x0000000002240000-0x00000000032FA000-memory.dmp upx behavioral1/memory/3128-642-0x0000000002240000-0x00000000032FA000-memory.dmp upx - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e58b5ce 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\Windows\SYSTEM.INI 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe File created C:\Windows\e58c222 WdExt.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1392 cmd.exe 3932 cmd.exe 3400 cmd.exe 208 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WdExt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WdExt.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtmps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 3128 WdExt.exe 3128 WdExt.exe 3128 WdExt.exe 3128 WdExt.exe 4892 launch.exe 4892 launch.exe 4892 launch.exe 4892 launch.exe 4892 launch.exe 4892 launch.exe 4892 launch.exe 4892 launch.exe 4892 launch.exe 4892 launch.exe 4892 launch.exe 4892 launch.exe 2344 launch.exe 2344 launch.exe 2344 launch.exe 2344 launch.exe 2344 launch.exe 2344 launch.exe 2344 launch.exe 2344 launch.exe 2344 launch.exe 2344 launch.exe 2344 launch.exe 2344 launch.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 4708 wrote to memory of 776 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 9 PID 4708 wrote to memory of 780 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 10 PID 4708 wrote to memory of 432 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 14 PID 4708 wrote to memory of 2732 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 51 PID 4708 wrote to memory of 728 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 52 PID 4708 wrote to memory of 1500 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 53 PID 4708 wrote to memory of 3244 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 55 PID 4708 wrote to memory of 3416 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 57 PID 4708 wrote to memory of 3608 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 58 PID 4708 wrote to memory of 3720 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 59 PID 4708 wrote to memory of 3780 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 60 PID 4708 wrote to memory of 3868 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 61 PID 4708 wrote to memory of 4028 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 62 PID 4708 wrote to memory of 4480 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 65 PID 4708 wrote to memory of 2856 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 78 PID 4708 wrote to memory of 4604 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 81 PID 4708 wrote to memory of 1068 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 82 PID 4708 wrote to memory of 4012 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 87 PID 4708 wrote to memory of 1164 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 88 PID 4708 wrote to memory of 3932 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 90 PID 4708 wrote to memory of 1392 4708 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 92 PID 3932 wrote to memory of 3128 3932 cmd.exe 95 PID 3128 wrote to memory of 776 3128 WdExt.exe 9 PID 3128 wrote to memory of 780 3128 WdExt.exe 10 PID 3128 wrote to memory of 432 3128 WdExt.exe 14 PID 3128 wrote to memory of 2732 3128 WdExt.exe 51 PID 3128 wrote to memory of 728 3128 WdExt.exe 52 PID 3128 wrote to memory of 1500 3128 WdExt.exe 53 PID 3128 wrote to memory of 3244 3128 WdExt.exe 55 PID 3128 wrote to memory of 3416 3128 WdExt.exe 57 PID 3128 wrote to memory of 3608 3128 WdExt.exe 58 PID 3128 wrote to memory of 3720 3128 WdExt.exe 59 PID 3128 wrote to memory of 3780 3128 WdExt.exe 60 PID 3128 wrote to memory of 3868 3128 WdExt.exe 61 PID 3128 wrote to memory of 4028 3128 WdExt.exe 62 PID 3128 wrote to memory of 4480 3128 WdExt.exe 65 PID 3128 wrote to memory of 2856 3128 WdExt.exe 78 PID 3128 wrote to memory of 4604 3128 WdExt.exe 81 PID 3128 wrote to memory of 1068 3128 WdExt.exe 82 PID 3128 wrote to memory of 4012 3128 WdExt.exe 87 PID 3128 wrote to memory of 1164 3128 WdExt.exe 88 PID 3128 wrote to memory of 3932 3128 WdExt.exe 90 PID 3128 wrote to memory of 3932 3128 WdExt.exe 90 PID 3128 wrote to memory of 3068 3128 WdExt.exe 91 PID 3128 wrote to memory of 1392 3128 WdExt.exe 92 PID 3128 wrote to memory of 1392 3128 WdExt.exe 92 PID 3128 wrote to memory of 528 3128 WdExt.exe 93 PID 3128 wrote to memory of 3952 3128 WdExt.exe 94 PID 3128 wrote to memory of 208 3128 WdExt.exe 96 PID 208 wrote to memory of 4892 208 cmd.exe 98 PID 4892 wrote to memory of 3400 4892 launch.exe 100 PID 3400 wrote to memory of 4084 3400 cmd.exe 102 PID 4084 wrote to memory of 964 4084 wtmps.exe 104 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:776
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:780
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:432
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2732
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:728
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:1500
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3244
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4708 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:3068
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"4⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3128 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "5⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 31286⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "7⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"8⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe9⤵
- Executes dropped EXE
PID:964
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "3⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:1392 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV14⤵PID:528
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3416
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3608
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3720
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3780
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵PID:3868
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4028
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4480
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca1⤵PID:2856
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4604
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:1068
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵PID:4012
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵PID:1164
-
C:\Windows\system32\BackgroundTaskHost.exe"C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider1⤵PID:3952
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2344
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\0E58B5ED_Rar\2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 1.7MB
- SHA256 cc25804389dd7edda30d473e9066c5b432070089ebb6ce29aa4d2e03c62363e8
- MD5 1ceea869fb4282479dca857eb3c92d14
- SHA1 f0c38f4222235d6780b5885897020be7e3760fec
- SHA512 ec8bfa9f08c10deb282686e56f3ec4c6cffecc8a5cec748cb9736e0552ea1c01eae6954bef388e02017c96b88b8cd62c19d71533ddf0ec2f8e7fdb7ee210e4a4
- SSDEEP 24576:OXdVtTj2i6BT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UNm:mbTC0xKCnFnQXBbrtgb/iQvu0UHOaYm4
- TLSH T11D85EE252790CD61F36FC07683D16E79B9B329213B33D886AE4855316BF2E2FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\0E58C435_Rar\WdExt.exe
- Size 1.7MB
- SHA256 53a33d4d6d3b57b1fa9cf530f902e39536c2010eab458a6fcc1a1bbd077b8957
- MD5 d3ccce092e2a36578a8ad9116a512b31
- SHA1 433778528e56afa05efbe0d6208d399b59008c5f
- SHA512 693f4b31e95c13bc901819fae796ab9b4ddaebcb721ab349834e0029cc795438ca80551c59debdc95a02617a93874ced43e0548c38516a631c025a189815fc95
- SSDEEP 24576:OXdVtTj2i6XT+jdxQCfgOFD3WSwd2QtBBw6xxhVxQtmibjOhZaiRu/4oMaop0UN4:mbTCaxKCnFnQXBbrtgb/iQvu0UHOaYmy
- TLSH T1FE85EE252790CD61F36FC07683D16E79B9B329213B33D886AE4855316BF2E2FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\E9A0.tmp
- Size 406B
- SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
- MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
- SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
- SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
- TLSH T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
- Size 276KB
- SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
- MD5 75c1467042b38332d1ea0298f29fb592
- SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
- SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
- SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
- TLSH T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
- Size 172KB
- SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
- MD5 daac1781c9d22f5743ade0cb41feaebf
- SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
- SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
- SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
- TLSH T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
- Size 1.8MB
- SHA256 ebb0efd94fcc5a5523b796e3d77d66d9bba1668957c4829da5570b2f1e4805de
- MD5 a43791c2ed01c80bb48c784d4869f536
- SHA1 3dca5038b067af62bc418f5bec2a6d0a415d987b
- SHA512 e94d84876691ce858ee2bff75b8859ecf502766b1034589ee93b65864d577b19153be84516704d6aeb6bfd95f2f6ea0d379a57f1f185aa27c7ea9b746e5abb26
- SSDEEP 49152:7bTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYmy:76ZxvWbrtUTrUHO2y
- TLSH T14995EE152790CD61F36FC07683E16E79B6B329213B33D986AE8855312BF2E1FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
- Size 129B
- SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
- MD5 d1073c9b34d1bbd570928734aacff6a5
- SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
- SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
- TLSH T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 102B
- SHA256 00e5f00b8ea8adfa2ebc74110fa32c920b25ce8d447dc65f367f5eae12458942
- MD5 aca8fb2d8abe1a36a06584a491e51af1
- SHA1 fd989834258db1e2637365f1dd47bd0e1aa0194f
- SHA512 717f665916a1347a7b2671afd8b328539d70d15d5c0bb6a788fa20d65dfa000f2ed00a40b791d4b3d9960071b98f47fb79cb8f0e0d16eda610666d3de12bc090
- TLSH T111B0121543CBCF0D144060D7077691CCC0744D983F947714DF01C84C314080DFDC2A01
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 358B
- SHA256 9ccdfe0d63a5c8003f6d50aaf8345956e120b6f1184f986eb7808a86779460ef
- MD5 71a9b4b8a10866a9ffb54f3babfd7590
- SHA1 9129532bff00a27b89a5901fc188cc3328465d05
- SHA512 14183e28beeca2803e80626f3c8c29eab14f297f206aae80b740582626e402e528ab505e4c6ec15bde7fd6893dae252806ec922d0eaf406dba049d41f7a18aa2
- TLSH T16DE0C00452EDC799B148728B0674C0EDC0B6AFF46F4827178621CD84A392E0C7962501
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
- Size 126B
- SHA256 c6ca0a8b48b181b4da9cbc73b39bf93a9e2dd4b191188a9c81b7ca3469806aa6
- MD5 3882cd95a9600b631bff1bcc56a65315
- SHA1 2b530e31fce58875efb34f8b215878d9c593c902
- SHA512 a57052e0dab8643b22118fabcc704055e37b43f33a4d9d027233e2d6323596cdb3386a3392a19ac7b420b4177738ffeba0507eead3ef924a4f1982178582e9c3
- TLSH T193B09B1313C9CB4E745260570779545D50784DC13E947505C6118498314180DFC5A545
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 388KB
- SHA256 c67ed34d9254b31e611ee830125c3f2572a1e686f82deb69e1580fb9a4614cd0
- MD5 e1e47695a0b98432911311352b63eaed
- SHA1 836142e550301e0fc13c1a047aae5a2f4481d7cd
- SHA512 da49234ee2e1d8f9956ba59d4a49fe04d3ab154f5dd60cf7a6c72e9d42defe8a4b0aeb38845444fe3a8d9c80976467d2101f7c992a48f98f6a9317d0e61ca961
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyz:/
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 388KB
- SHA256 93db7c9699594caa19490280842fbebec3877278c92128b92e63d75fcd01397a
- MD5 8d7db101a7211fe3309dc4dc8cf2dd0a
- SHA1 6c2781eadf53b3742d16dab2f164baf813f7ac85
- SHA512 8b139d447068519997f7bbc2c7c2fe3846b89ae1fba847258277c9ab92a93583b28fae7ffa444768929ed5852cc914c0270446cbf0bd20aca49bde6b6f809c83
- SSDEEP 12288:PDCOy/psISIHbl9f/mnmO/5Se71RpNJmq3CrP:RyRznmnp5SedNJBCL
- TLSH T1E3843A12B7A98025D6F30A74263DB536A4397C750F50EEEB73250B6DA830FC1DB79A12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 257B
- SHA256 357482b42746ec06df000a42d2966dbae6e420ff5aa96c883ed0d26a94b9aa7a
- MD5 2ded20f28b82e9a9bd61c022b9107de2
- SHA1 24139a08cf0d7a399f5ee0b1347d9c90a19b743b
- SHA512 f20452b839330f3c7a6e442b7316661d179c77ad6fa233873e9bac5cadde0e9982cdd749e094200c6a9d4a70d5336ac564aa3881fac04c880a0cf73effb69f5f
- TLSH T138D05E0E4BDD15AD949A007E3178E4C27339AF11D8320F4C50396B8164296D9BF7E2AD
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mscaps.exe
- Size 200KB
- SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
- MD5 78d3c8705f8baf7d34e6a6737d1cfa18
- SHA1 9f09e248a29311dbeefae9d85937b13da042a010
- SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
- SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
- TLSH T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
- MD5 SHA1 SHA512 SSDEEP TLSH