Analysis
- max time kernel
149s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/09/2026, 09:40
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe
- Size 1.8MB
- Sample260930-lm9rfstycx
- SHA256 ba6019b8b4132ae2fea2c7affe52d078d6c75feecc2bd72efee606770b2366f7
- MD5 9022bfc154e6274124e03e3db5b971d5
- SHA1 1ff9915d99c2a8736e4ae01f3af24c6a5c179c64
- SHA512 b8651b412da169278e8e9f9a7b562e353f5eca2497f3e3d173e20bc15c9ca4bed1783e7ebf18a699be9ae1efe638c02e086cc9a1f7862f9bf30d155bc5c6bb27
- SSDEEP 49152:7bTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYm4:76ZxvWbrtUTrUHO24
- TLSH T1D895EF152790CD61F36FC07683E16E79B6B329213B33D986AE8855312BF2E1FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
sality
C2
-
http://89.119.67.154/testo5/
-
http://kukutrustnet777.info/home.gif
-
http://kukutrustnet888.info/home.gif
-
http://kukutrustnet987.info/home.gif
Signatures
- Modifies firewall policy service 3 TTPs 6 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" WdExt.exe - UAC bypass 3 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Windows security bypass 2 TTPs 12 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe - Detects executables packed with Sality Polymorphic Code Generator or Simple Poly Engine or Sality 27 IoCs
resource yara_rule behavioral2/memory/4988-16-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-1-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-8-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-9-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-13-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-14-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-12-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-11-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-10-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-15-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-6-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-31-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-32-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/4988-61-0x0000000002470000-0x000000000352A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-87-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-89-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-90-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-99-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-88-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-91-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-93-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-85-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-92-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-94-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-171-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-172-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine behavioral2/memory/3464-187-0x00000000023C0000-0x000000000347A000-memory.dmp INDICATOR_EXE_Packed_SimplePolyEngine - UPX dump on OEP (original entry point) 29 IoCs
resource yara_rule behavioral2/memory/4988-16-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-1-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-8-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-9-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-13-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-14-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-12-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-11-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-10-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-15-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-6-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-31-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-32-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/4988-75-0x0000000000400000-0x000000000044B000-memory.dmp UPX behavioral2/memory/4988-61-0x0000000002470000-0x000000000352A000-memory.dmp UPX behavioral2/memory/3464-87-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-89-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-90-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-99-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-88-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-91-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-93-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-85-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-92-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-94-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-171-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-172-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-187-0x00000000023C0000-0x000000000347A000-memory.dmp UPX behavioral2/memory/3464-201-0x0000000000400000-0x000000000044B000-memory.dmp UPX - Executes dropped EXE 5 IoCs
pid Process 3464 WdExt.exe 1400 launch.exe 1816 launch.exe 3600 wtmps.exe 3428 mscaps.exe - Loads dropped DLL 2 IoCs
pid Process 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 3464 WdExt.exe - Windows security modification 2 TTPs 14 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" WdExt.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" WdExt.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" WdExt.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Defender Extension = "\"C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Defender\\launch.exe\"" launch.exe - Checks whether UAC is enabled 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mscaps.exe wtmps.exe File opened for modification C:\Windows\SysWOW64\mscaps.exe wtmps.exe -
resource yara_rule behavioral2/memory/4988-16-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-1-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-8-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-9-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-13-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-14-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-12-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-11-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-10-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-15-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-6-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-31-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-32-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/4988-61-0x0000000002470000-0x000000000352A000-memory.dmp upx behavioral2/memory/3464-87-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-89-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-90-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-99-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-88-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-91-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-93-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-85-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-92-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-94-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-171-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-172-0x00000000023C0000-0x000000000347A000-memory.dmp upx behavioral2/memory/3464-187-0x00000000023C0000-0x000000000347A000-memory.dmp upx - Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\e59b905 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe File opened for modification C:\Windows\SYSTEM.INI 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe File created C:\Windows\e59c876 WdExt.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 4 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4524 cmd.exe 4964 cmd.exe 2928 cmd.exe 5556 cmd.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname WdExt.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain WdExt.exe - System Location Discovery: System Language Discovery 1 TTPs 9 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wtmps.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WdExt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language launch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe - Suspicious behavior: EnumeratesProcesses 32 IoCs
pid Process 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 3464 WdExt.exe 3464 WdExt.exe 3464 WdExt.exe 3464 WdExt.exe 1400 launch.exe 1400 launch.exe 1400 launch.exe 1400 launch.exe 1400 launch.exe 1400 launch.exe 1400 launch.exe 1400 launch.exe 1400 launch.exe 1400 launch.exe 1816 launch.exe 1816 launch.exe 1816 launch.exe 1816 launch.exe 1816 launch.exe 1816 launch.exe 1816 launch.exe 1816 launch.exe 1816 launch.exe 1816 launch.exe 1816 launch.exe 1816 launch.exe 1400 launch.exe 1400 launch.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Token: SeDebugPrivilege 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe - Suspicious use of WriteProcessMemory 48 IoCs
description pid Process procid_target PID 4988 wrote to memory of 1188 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 15 PID 4988 wrote to memory of 3128 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 46 PID 4988 wrote to memory of 3212 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 47 PID 4988 wrote to memory of 3468 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 48 PID 4988 wrote to memory of 3348 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 55 PID 4988 wrote to memory of 4380 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 57 PID 4988 wrote to memory of 4428 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 58 PID 4988 wrote to memory of 4492 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 59 PID 4988 wrote to memory of 4764 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 61 PID 4988 wrote to memory of 4316 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 62 PID 4988 wrote to memory of 4272 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 63 PID 4988 wrote to memory of 5216 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 64 PID 4988 wrote to memory of 4520 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 76 PID 4988 wrote to memory of 4544 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 79 PID 4988 wrote to memory of 2932 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 81 PID 4988 wrote to memory of 3240 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 82 PID 4988 wrote to memory of 3244 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 83 PID 4988 wrote to memory of 4964 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 88 PID 4988 wrote to memory of 4524 4988 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe 90 PID 4964 wrote to memory of 3464 4964 cmd.exe 92 PID 3464 wrote to memory of 1188 3464 WdExt.exe 15 PID 3464 wrote to memory of 3128 3464 WdExt.exe 46 PID 3464 wrote to memory of 3212 3464 WdExt.exe 47 PID 3464 wrote to memory of 3468 3464 WdExt.exe 48 PID 3464 wrote to memory of 3348 3464 WdExt.exe 55 PID 3464 wrote to memory of 4380 3464 WdExt.exe 57 PID 3464 wrote to memory of 4428 3464 WdExt.exe 58 PID 3464 wrote to memory of 4492 3464 WdExt.exe 59 PID 3464 wrote to memory of 4764 3464 WdExt.exe 61 PID 3464 wrote to memory of 4316 3464 WdExt.exe 62 PID 3464 wrote to memory of 4272 3464 WdExt.exe 63 PID 3464 wrote to memory of 5216 3464 WdExt.exe 64 PID 3464 wrote to memory of 4520 3464 WdExt.exe 76 PID 3464 wrote to memory of 4544 3464 WdExt.exe 79 PID 3464 wrote to memory of 2932 3464 WdExt.exe 81 PID 3464 wrote to memory of 3240 3464 WdExt.exe 82 PID 3464 wrote to memory of 3244 3464 WdExt.exe 83 PID 3464 wrote to memory of 4964 3464 WdExt.exe 88 PID 3464 wrote to memory of 4964 3464 WdExt.exe 88 PID 3464 wrote to memory of 4736 3464 WdExt.exe 89 PID 3464 wrote to memory of 4524 3464 WdExt.exe 90 PID 3464 wrote to memory of 4524 3464 WdExt.exe 90 PID 3464 wrote to memory of 4452 3464 WdExt.exe 91 PID 3464 wrote to memory of 2928 3464 WdExt.exe 93 PID 2928 wrote to memory of 1400 2928 cmd.exe 95 PID 1400 wrote to memory of 5556 1400 launch.exe 98 PID 5556 wrote to memory of 3600 5556 cmd.exe 100 PID 3600 wrote to memory of 3428 3600 wtmps.exe 101 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" WdExt.exe
Processes
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:1188
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:3128
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s webthreatdefusersvc1⤵PID:3212
-
C:\Windows\System32\ShellHost.exe"C:\Windows\System32\ShellHost.exe"1⤵PID:3468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3348
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4380
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:4428
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UdkSvcGroup -s UdkUserSvc1⤵PID:4492
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:4764
-
C:\Windows\system32\ctfmon.exe/QuitInfo:0000000000000270;0000000000000274;1⤵PID:4316
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{973D20D7-562D-44B9-B70B-5A0F49CCDF3F}1⤵PID:4272
-
C:\Windows\System32\SecurityHealthSystray.exe"C:\Windows\System32\SecurityHealthSystray.exe"1⤵PID:5216
-
C:\Windows\System32\smartscreen.exeC:\Windows\System32\smartscreen.exe -Embedding1⤵PID:4520
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:4544
-
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:2932
-
C:\Users\Admin\AppData\Local\Temp\2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-30_9022bfc154e6274124e03e3db5b971d5_coinminer_elex_jaku_nymaim_rhadamanthys_wannacry.exe"3⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4988 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:4736
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe"5⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3464 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "6⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe" /i 34647⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat" "8⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5556 -
C:\Users\Admin\AppData\Local\Temp\wtmps.exe"C:\Users\Admin\AppData\Local\Temp\wtmps.exe"9⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\mscaps.exe"C:\Windows\system32\mscaps.exe" /C:\Users\Admin\AppData\Local\Temp\wtmps.exe10⤵
- Executes dropped EXE
PID:3428
-
-
-
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat" "4⤵
- Executes a command shell one-liner
- System Location Discovery: System Language Discovery
PID:4524 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵PID:4452
-
-
-
-
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca1⤵PID:3240
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵PID:3244
-
C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe"1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:1816
Network
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify System Firewall
1Disable or Modify Tools
3Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\E67E.tmp
- Size 406B
- SHA256 27e678bf5dc82219d6edd744f0b82567a26e40f8a9dcd6487205e13058e3ed1f
- MD5 37512bcc96b2c0c0cf0ad1ed8cfae5cd
- SHA1 edf7f17ce28e1c4c82207cab8ca77f2056ea545c
- SHA512 6d4252ab5aa441a76ce2127224fefcb221259ab4d39f06437b269bd6bfdaae009c8f34e9603ec734159553bc9f1359bdd70316cd426d73b171a9f17c41077641
- TLSH T1C5E0A238F30DCC2AE1D032092011CE86F23C128AE6A1FBA82AB421A3B00350CC2346E3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SeC154.tmp
- Size 768B
- SHA256 301a9064fe6952d3319f23593287b6144c0d278cad9085c63fc697792d082338
- MD5 0568726f4465e3d99ab773c9f6e6e6b0
- SHA1 611f634753b8584848d2241b69cb22caf9d8282a
- SHA512 aa49684a26f95d0349c2a5746e28164c0590fd6730e1faf728006bfefcf403bc2ef5b501964c4301564ec58c786a43e3fe60a02d097d63d5fdb3397b433ecdf7
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\wtmps.exe
- Size 276KB
- SHA256 3b20c853d4ca23240cd338b8cab16f1027c540ddfe9c4ffdca1624d2f923b373
- MD5 75c1467042b38332d1ea0298f29fb592
- SHA1 f92ea770c2ddb04cf0d20914578e4c482328f0f8
- SHA512 5c47c59ad222e2597ccdf2c100853c48f022e933f44c279154346eacf9e7e6f54214ada541d43a10424035f160b56131aab206c11512a9fd6ea614fbd3160aa0
- SSDEEP 6144:Xaz/zwzFEN3MmUGvSQagFwDeSv3BU9T4/XGOUYM/mVz:Iz8qamFVa1D69T4RMmVz
- TLSH T16354121B18B78123F4665570A9E107C18F7E5A0732A58B2FCF61CC3E46E09698967EF3
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Defender\launch.exe
- Size 172KB
- SHA256 6a7093440420306cf7de53421a67af8a1094771e0aab9535acbd748d08ed766c
- MD5 daac1781c9d22f5743ade0cb41feaebf
- SHA1 e2549eeeea42a6892b89d354498fcaa8ffd9cac4
- SHA512 190a7d5291e20002f996edf1e04456bfdff8b7b2f4ef113178bd42a9e5fd89fe6d410ae2c505de0358c4f53f9654ac1caaa8634665afa6d9691640dd4ee86160
- SSDEEP 3072:ng2TyMj3tEcWMkc5tTBfZOVxtDH2g3zd3jceABCODJRCyA:n7xqcWxc5tTBsJWKFGUOfCl
- TLSH T10E04BE193A9089B2C0BFD0B7C0D5BB28F77732321322D94B679C96750D62776F6122DA
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Messenger\Extension\WdExt.exe
- Size 1.8MB
- SHA256 3d12bb2ad69bddaf51eed951d053e409bd43796715cf51809ec86d046a7cc4e2
- MD5 0a9e11600a7c639a75ee4950fda0e86d
- SHA1 27776cd27828024364fcd190d08a544e5c60e161
- SHA512 ba44f06847b34a4d6757ca0b11aa19d16fab7fda33eb46d31fd580d7f1778766a599cf90b7f68385d981380246324514f4475f1baad6781eb22394a8c1aff00d
- SSDEEP 49152:7bTCwMrtxKCnFnQXBbrtgb/iQvu0UHOaYmR:76ZxvWbrtUTrUHO2R
- TLSH T1DA95EE152790CD61F36FC07683E16E79B6B329213B33D986AE8855312BF2E1FE381195
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin0.bat
- Size 129B
- SHA256 b3c704b1a728004fc5e25899d72930a7466d7628dd6ddd795b3000897dfa4020
- MD5 d1073c9b34d1bbd570928734aacff6a5
- SHA1 78714e24e88d50e0da8da9d303bec65b2ee6d903
- SHA512 4f2b9330e30fcc55245dc5d12311e105b2b2b9d607fbfc4a203c69a740006f0af58d6a01e2da284575a897528da71a2e61a7321034755b78feb646c8dd12347f
- TLSH T1B6B09B1243C8C70E7C67B1974B75544C517446C57B447509DB45C48D325191CFCDD556
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 126B
- SHA256 e97fb8a540ef6be821ff15beefcce5503d95f266f364dafc7a44d5df54ad587c
- MD5 6b4ef2f20aca4a8b6d594e2829006ae0
- SHA1 3fec91f1c1ff52c12df39488039a0247a5e54198
- SHA512 95aac2d2572e3261c8f9e835c3bab99ad20488f9b0223304b76d465ce632ba555c96a25e901ce12c3e6866d20cabb8efa422ff6e5b53dd1d19deff50599f8db7
- TLSH T1ACB0922603D9CB4EBC626097477A94AD907C8AC63E98BA05CA118489324681CFDAA94A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin1.bat
- Size 358B
- SHA256 9ccdfe0d63a5c8003f6d50aaf8345956e120b6f1184f986eb7808a86779460ef
- MD5 71a9b4b8a10866a9ffb54f3babfd7590
- SHA1 9129532bff00a27b89a5901fc188cc3328465d05
- SHA512 14183e28beeca2803e80626f3c8c29eab14f297f206aae80b740582626e402e528ab505e4c6ec15bde7fd6893dae252806ec922d0eaf406dba049d41f7a18aa2
- TLSH T16DE0C00452EDC799B148728B0674C0EDC0B6AFF46F4827178621CD84A392E0C7962501
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\Admin2.bat
- Size 102B
- SHA256 4e7d460b8dc9f2c01b4c5a16fb956aced10127bc940e8039a80c6455901ea1f0
- MD5 3ca08f080a7a28416774d80552d4aa08
- SHA1 0b5f0ba641204b27adac4140fd45dce4390dbf24
- SHA512 0c64aa462ff70473ef763ec392296fe0ea59b5340c26978531a416732bc3845adf9ca7b673cb7b4ba40cc45674351206096995c43600fccbbbe64e51b6019f01
- TLSH T114B0121243CBCF0D148060D70775A1CCC0740C983F947714DF11C84C314080DFDC6A41
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 382KB
- SHA256 5c130fd7e962456900bb9a9c88425a9aacc7d879cf61c142ed9e43413b812556
- MD5 8f95063ace2b2e5b9e74b3dbbb05981f
- SHA1 cb617fde7807a68991bcc00e69374882f2af06d7
- SHA512 82d7a0a613729c4ae3cb6a63f7e221303de2bf9577516b365792c082bd1946a0e5f6b809b83df353a24492f308d114a5db86a87d94cc8a9260db4bc5853c53f8
- SSDEEP 96:/yyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyyb:f
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Temp\mydll.dll
- Size 382KB
- SHA256 f0a24c3d4e5f5948dd84a9db1206e07b904c6c12ff9e20de2a2ad7d6b04c6946
- MD5 311930917a26dd0cc3754133b6ffc342
- SHA1 3c6baf292592dc733d71c2b984a7b75070b43aff
- SHA512 b8401339f12ebf39f9ec6ffad3d6db7188387d9fe997d74f11a0d324389758b777b14f4f4a732879259955c428db6d01644f541c9f21db90e2c7eb94b15ca2f0
- SSDEEP 6144:ED1coZXbdacDWZyehpRHy9H4dIBXCN2x/DMVP1tF+jBSVJ6:EDhZLdN9eNXdIlCNuorJ6
- TLSH T106842942AAE95420D2F357306A7DBB39212E78785BA0ECDFB24057FDA420AC19F75353
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SYSTEM.INI
- Size 255B
- SHA256 ef567205c136f26359b7beca19a972964ccdae1fbdf09e3963c02970586a244d
- MD5 0867eb98c8b20090f62331eb04850c94
- SHA1 36883dedfcf00d8c9bb5c04066b0f15cbb0f774b
- SHA512 1fa577c765d5882a4acd8a5525eb28afe9dedc2f400ef96f9e1371b34d01f546fdc31099a159625cc6582af6a7c785eec20ea2f54b555f7c24d5f4b446d8ad57
- TLSH T101D05E0E4BDD15AD9046006E317CD0C272399F11E8320F4C50396B41642C6E9BF7E2AE
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\SysWOW64\mscaps.exe
- Size 200KB
- SHA256 2c4c9ec8e9291ba5c73f641af2e0c3e1bbd257ac40d9fb9d3faab7cebc978905
- MD5 78d3c8705f8baf7d34e6a6737d1cfa18
- SHA1 9f09e248a29311dbeefae9d85937b13da042a010
- SHA512 9a3c3175276da58f1bc8d1138e63238c8d8ccfbfa1a8a1338e88525eca47f8d745158bb34396b7c3f25e4296be5f45a71781da33ad0bbdf7ad88a9c305b85609
- SSDEEP 3072:34LGpbMkFAIk2GOytDDE1wYa+6NjQYryupFsjzuoAxWhZWkZu4pUBRrwCP8T:FbnDk2HcMZYQYcSovhc7AAcCPe
- TLSH T15114F15B2CB38933F462497542E046FA4FFDAD1332F664EFCF2849C11DA09659528AF2
- MD5 SHA1 SHA512 SSDEEP TLSH