Analysis
- max time kernel
148s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
12/10/2026, 19:57
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe
- Size 513KB
- Sample261012-ypcwqaew2v
- SHA256 dcd94f1f91f0d8320be3cd26ceb90aa4bee042b850efcc76ee63897773bde49e
- MD5 64d8d77642aecefd93a2e8baff855f91
- SHA1 eadeed9ae44a5a2fc1e85a5669f940a0cfecd9a0
- SHA512 23d8f5fac9d4fc4a5416a4bede427ab24815e907ba825c5cb0afc60541edd906b1be490dbc7ced9d65a7ac42e324ada0049afb4a530640d11da7a8b3bf003c62
- SSDEEP 6144:xGkNeugsYW02QnZlmR75Yi2X3IQCn3fjA9VZFzUxXOdy/KkicWM+5nXwBeOX:xGruf026ZlmR70Y/k9VS+LPMRw
- TLSH T1A6B4391639FCC73BE3D25530CE6CFB90B0F5B9684F21489736D41A1C2A76992E31AA1D
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\S: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\V: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\Y: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\Z: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\D: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\L: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\M: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\O: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\I: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\K: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\P: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\R: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\T: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\X: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\H: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\N: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\U: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\W: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\G: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\J: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened (read-only) \??\Q: 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe - Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\RASPHONE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESPROTECTION.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SEARCHFILTERHOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CAMERASETTINGSUIHOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MSFEEDSSYNC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMUWPLAUNCHER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TTTRACER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MAKECAB.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PING.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SUDO.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TCPSVCS.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TOKENBROKERCOOKIES.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\VERIFIERGUI.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DFRGUI.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TAPIUNATTEND.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\GETMAC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SPATIALAUDIOLICENSESRV.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMINFO.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WBEM\WMIPRVSE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WHERE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINRSHOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\ATTRIB.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\EXPLORER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\IMETC\IMTCPROP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\LABEL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SDCHANGE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WINDOWSPOWERSHELL\V1.0\POWERSHELL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CMDL32.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CMSTP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CREDWIZ.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NETSH.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PKGMGR.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REKEYWIZ.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\BACKGROUNDTRANSFERHOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DOSKEY.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FIXMAPI.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FSQUIRT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\INSTALLSHIELD\SETUP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NDADMIN.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\OPOSHOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSA.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\OPENFILES.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RDPSAPROXY.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RMACTIVATE_ISV.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SETHC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WLANEXT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\FTP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\MOBSYNC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NOTEPAD.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\PRINT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\REGINI.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\WUSA.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DISKUSAGE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DRIVERQUERY.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\IME\SHARED\IMCCPHR.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\NTPRINT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\RASAUTOU.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\UTILMAN.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\CTFMON.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\DWWIN.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SNDVOL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\SYSTEMPROPERTIESDATAEXECUTIONPREVENTION.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\SysWOW64\TPMINIT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRAM FILES\WINDOWS MAIL\WAB.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\APPVSHNOTIFY.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\7.0.16\CREATEDUMP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEINSTAL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\PACK200.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\SSCICONS.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\SENSESAMPLEUPLOADER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\BROWSER\WCCHROMEEXTN\WCCHROMENATIVEMESSAGINGHOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATEONDEMAND.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\DOTNET\SHARED\MICROSOFT.NETCORE.APP\6.0.27\CREATEDUMP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\INSTALLER\CHRMSTP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\NOTIFICATION_HELPER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\XLICONS.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\XLICONS.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\1.3.185.27\MICROSOFTEDGEUPDATECOMREGISTERSHELL64.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEUPDATE_BK\MICROSOFTEDGEUPDATE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\COMMON FILES\MICROSOFT SHARED\CLICKTORUN\OFFICEC2RCLIENT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\CHROME_PWA_LAUNCHER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\GOOGLE\CHROME\APPLICATION\140.0.7339.81\INSTALLER\SETUP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JABSWITCH.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\SELFCERT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\SOURCE ENGINE\OSE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPRPH.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\COMMON FILES\MICROSOFT SHARED\INK\PIPANEL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JCONSOLE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JAVAWS.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\JP2LAUNCHER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\JRE\BIN\SSVAGENT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PROTOCOLHANDLER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS DEFENDER ADVANCED THREAT PROTECTION\CLASSIFICATION\SENSECE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\READER_SL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS DEFENDER\MPCMDRUN.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEDIAGCMD.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\IEXPLORE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\EXTCHECK.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\JAVAH.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SERVERTOOL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\ADDINS\MICROSOFT POWER QUERY FOR EXCEL INTEGRATED\BIN\MICROSOFT.MASHUP.CONTAINER.NETFX40.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\APPSHARINGHOOKCONTROLLER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\WINDOWS MEDIA PLAYER\WMPNSCFG.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\SERIALVER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\PERFBOOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\MSEDGE_PROXY.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\NOTIFICATION_HELPER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGEWEBVIEW\APPLICATION\122.0.2365.106\ELEVATION_SERVICE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\WINDOWS MEDIA PLAYER\WMLAUNCH.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\KEYTOOL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\WINWORD.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESX86\MICROSOFT OFFICE\OFFICE16\DCF\SPREADSHEETCOMPARE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\WINDOWS\INSTALLER\{90160000-000F-0000-1000-0000000FF1CE}\ACCICONS.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\MSEDGE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\INTERNET EXPLORER\EXTEXPORT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\OFFICEAPPGUARDWIN32.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\VFS\PROGRAMFILESCOMMONX64\MICROSOFT SHARED\OFFICE16\MSOXMLED.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROTEXTEXTRACTOR.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGE\APPLICATION\139.0.3405.125\MSEDGEWEBVIEW2.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\122.0.2365.106\INSTALLER\SETUP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\NOTIFICATION_HELPER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JDK-1.8\BIN\POLICYTOOL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\JAVA\JRE-1.8\BIN\KINIT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MICROSOFT OFFICE\ROOT\OFFICE16\MSQRY32.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES\MOZILLA FIREFOX\MAINTENANCESERVICE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\ADOBE\ACROBAT READER DC\READER\ACROLAYOUTRECOGNIZER\ACROLAYOUTRECOGNIZER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\PROGRAM FILES (X86)\MICROSOFT\EDGECORE\139.0.3405.125\ELEVATED_TRACING_SERVICE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe - Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\WINDOWS\SYSTEMAPPS\MICROSOFT.WINDOWS.FILEEXPLORER_CW5N1H2TXYEWY\FILEEXPLORER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-A..LITY-EOAEXPERIENCES_31BF3856AD364E35_10.0.26100.1591_NONE_80585F5752DD6955\R\EOAEXPERIENCES.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-TCPIP-UTILITY_31BF3856AD364E35_10.0.26100.1301_NONE_CE938C0EFEDCDE06\R\NETSTAT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-AUDIO-VOLUMECONTROL_31BF3856AD364E35_10.0.26100.1591_NONE_6C3D16DFEBE198E3\SNDVOL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-BCDBOOT-CMDLINETOOL_31BF3856AD364E35_10.0.26100.1150_NONE_FD3D350BEE0E4F11\BCDBOOT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..-UPPRINTERINSTALLER_31BF3856AD364E35_10.0.26100.1150_NONE_4EF2FCA3D76B94B2\R\UPPRINTERINSTALLER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-USERINIT_31BF3856AD364E35_10.0.26100.1591_NONE_77E8B53C81B6CF4F\USERINIT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.5\ADDINPROCESS.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-INTERNATIONAL-UNATTEND_31BF3856AD364E35_10.0.26100.1591_NONE_5BD9BD7B9DA089D6\MUIUNATTEND.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PACKAGEINSPECTOR_31BF3856AD364E35_10.0.26100.1_NONE_6775B02F27BC2B3E\PACKAGEINSPECTOR.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-W..EBVIEWHOST.APPXMAIN_31BF3856AD364E35_10.0.26100.1150_NONE_A661F954CA482F71\R\WIN32WEBVIEWHOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-A..CATION-CREDUIBROKER_31BF3856AD364E35_10.0.26100.1591_NONE_70CFC556F1A01EB7\CREDENTIALUIBROKER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-B..VIRONMENT-SERVICING_31BF3856AD364E35_10.0.26100.1150_NONE_C1FBD1A9557E5B13\BFSVC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-C..-DISPOSABLECLIENTVM_31BF3856AD364E35_10.0.26100.1591_NONE_815687268BC7E515\R\WINDOWSSANDBOXCLIENT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DEVICEENROLLER_31BF3856AD364E35_10.0.26100.1591_NONE_5D054CD1BD51EFF3\DEVICEENROLLER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-O..ONALFEATURES-FONDUE_31BF3856AD364E35_10.0.26100.1150_NONE_E59C5DAB3C0F4ED2\R\FONDUE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-T..MINALSERVICESCLIENT_31BF3856AD364E35_10.0.26100.1000_NONE_E9C96C85D0FDDDDD\R\MSTSC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_VMCONNECT_31BF3856AD364E35_10.0.26100.1591_NONE_2BF6278FFA2525B6\R\VMCONNECT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_WINDOWS-GAMING-XBOX..E-SERVICE-COMPONENT_31BF3856AD364E35_10.0.26100.1591_NONE_EF25A80363F3D9EA\R\XBLGAMESAVETASK.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-ERRORREPORTINGFAULTS_31BF3856AD364E35_10.0.26100.1591_NONE_0BC717C8ECD0287D\WERFAULTSECURE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-LDIFDE_31BF3856AD364E35_10.0.26100.1150_NONE_BCCE913AB8BC643D\R\LDIFDE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-RUNLEGACYCPLELEVATED_31BF3856AD364E35_10.0.26100.1150_NONE_ACF35F94A536BE18\RUNLEGACYCPLELEVATED.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-U..-CLIENT-AGGREGATORS_31BF3856AD364E35_10.0.26100.1591_NONE_1057FC96A520E997\AGGREGATORHOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-I..LLSHIELD-WOW64-MAIN_31BF3856AD364E35_10.0.26100.1_NONE_6B60ACBAF3301F6C\SETUP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_NETFX4-CSC_EXE_B03F5F7F11D50A3A_4.0.15912.0_NONE_C07BC1454A24C3D8\CSC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V2.0.50727\ASPNET_REGIIS.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-AUDIO-VOLUMECONTROL_31BF3856AD364E35_10.0.26100.1301_NONE_61F509CBB778BAF7\R\SNDVOL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CTTUNESVR_31BF3856AD364E35_10.0.26100.1150_NONE_8BE227BACE421D8D\CTTUNESVR.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX-DFSVC_B03F5F7F11D50A3A_10.0.26100.1_NONE_6694132CB1B96A0B\DFSVC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-SETX_31BF3856AD364E35_10.0.26100.1_NONE_B3BF2881B5FDBF6E\SETX.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_HYPERV-COMPUTE-CONT..UTIONSERVICE-SHARED_31BF3856AD364E35_10.0.26100.1150_NONE_F1B736C7DE0A2B05\R\CEXECSVC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..-JAPANESE-UTILITIES_31BF3856AD364E35_10.0.26100.1591_NONE_88F13A0C22218100\R\IMJPDCT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MEDIAFOUNDATION_31BF3856AD364E35_10.0.26100.1591_NONE_381F2A62BCC881C7\MFPMP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PING-UTILITIES_31BF3856AD364E35_10.0.26100.1150_NONE_4518F57E3FC4B0D8\PING.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ROPERTIESPROTECTION_31BF3856AD364E35_10.0.26100.1_NONE_60A5FF2E85104E26\SYSTEMPROPERTIESPROTECTION.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURESTARTUP-CPL_31BF3856AD364E35_10.0.26100.1591_NONE_F346527B3B1F36F2\R\BITLOCKERWIZARDELEV.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-RECOVER_31BF3856AD364E35_10.0.26100.1_NONE_8D5BA08151885BF2\RECOVER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-S..ARTCARD-TPM-MANAGER_31BF3856AD364E35_10.0.26100.1150_NONE_36FD183D90DA21CB\R\RMTTPMVSCMGRSVR.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SNIPPINGTOOL-APP_31BF3856AD364E35_10.0.26100.1150_NONE_35AB52A6398CDC65\R\SNIPPINGTOOL.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\X86_NETFX4-NGEN_EXE_B03F5F7F11D50A3A_4.0.15912.100_NONE_F29D806B561540F6\NGEN.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK\V4.0.30319\EDMGEN.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-COMPUTERDEFAULTS_31BF3856AD364E35_10.0.26100.1150_NONE_A25DF22273335338\R\COMPUTERDEFAULTS.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-P..IONINGSECUREPROCESS_31BF3856AD364E35_10.0.26100.1150_NONE_32BD5B6FCFAB5B78\R\PSP.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MAPI-MMGA_31BF3856AD364E35_10.0.26100.712_NONE_82C18832EFD3E8D9\R\MMGASERVER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-G..ATION-WINCOMPONENTS_31BF3856AD364E35_10.0.26100.1150_NONE_37ADCB75A8302256\WINDOWSACTIONDIALOG.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-PERFORMANCETOOLSGUI_31BF3856AD364E35_10.0.26100.1591_NONE_37C9B95250FAC754\RESMON.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SHUTDOWN-EVENT-TRACKER_31BF3856AD364E35_10.0.26100.1_NONE_FFC7C01130849273\SHUTDOWN.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-GAMING-GA..RNAL-PRESENCEWRITER_31BF3856AD364E35_10.0.26100.1150_NONE_9E0E1EC5A1C14E55\GAMEBARPRESENCEWRITER.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-CONTAINERS-CCG_31BF3856AD364E35_10.0.26100.1591_NONE_F83C41B7A549FF24\CCG.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-MANAGEDWINDOWSVM_31BF3856AD364E35_10.0.26100.1591_NONE_4C3489B778790277\R\MANAGEDWINDOWSVM.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NARRATOR_31BF3856AD364E35_10.0.26100.1591_NONE_59DDD41753BFCF7D\NARRATOR.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-NDKPERF-SETUP_31BF3856AD364E35_10.0.26100.1150_NONE_862CCCB1155D1695\NDKPERFCMD.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITYCENTER-CORE_31BF3856AD364E35_10.0.26100.1591_NONE_B60058D9621FAD85\WSCADMINUI.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SETUP-MBR2GPT_31BF3856AD364E35_10.0.26100.1591_NONE_9271E9806DF3EC14\R\MBR2GPT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SXS_31BF3856AD364E35_10.0.26100.1150_NONE_4A33EC93078DA3BD\R\SXSTRACE.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\ADDINPROCESS32.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-D..OMERFEEDBACKMANAGER_31BF3856AD364E35_10.0.26100.1591_NONE_77F3B6BE3E383E20\IMECFMUI.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-DATAEXCHANGEHOST_31BF3856AD364E35_10.0.26100.1301_NONE_8550D029188C257C\R\DATAEXCHANGEHOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_MICROSOFT-WINDOWS-SECURITY-SECEDIT_31BF3856AD364E35_10.0.26100.1_NONE_ABDAD67B1A4B2829\SECEDIT.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-DRIVERVERIFIER_31BF3856AD364E35_10.0.26100.1_NONE_C1B42DCA39A8C2CA\VERIFIERGUI.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-MEDIAPLAYER-SETUP_31BF3856AD364E35_10.0.26100.1_NONE_B53C1C347378366D\SETUP_WM.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\WOW64_MICROSOFT-WINDOWS-W..OMMAND-LINE-UTILITY_31BF3856AD364E35_10.0.26100.1_NONE_A8F2281169C44E9B\WMIC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\MICROSOFT.NET\FRAMEWORK64\V3.0\WINDOWS COMMUNICATION FOUNDATION\SMSVCHOST.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe File opened for modification C:\WINDOWS\WINSXS\AMD64_NETFX4-CSC_EXE_B03F5F7F11D50A3A_4.0.15912.0_NONE_78CE8A6E35A89AD2\CSC.EXE 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\ 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3004 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeRestorePrivilege 3004 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe Token: 35 3004 2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_64d8d77642aecefd93a2e8baff855f91_elex_wannacry.exe"1⤵
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3004
Network
MITRE ATT&CK Enterprise v16
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1