1c115377857aeb731877859bc4ddc4ac817a14899a6776d969bb46dfa0f690b1

Analysis

max time kernel
12s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe
Size 95KB
Sample261014-rr89daes41
SHA256 1c115377857aeb731877859bc4ddc4ac817a14899a6776d969bb46dfa0f690b1
MD5 ae2584612de026ede8f0836a2f9bce9e
SHA1 5a16b42ca0e6d9c8254ae61dcabeaa0178dd6f46
SHA512 1eb9a149d02016c934efabd289e88bfccc86c5ae8ce9eb8a7d6a069ae32cc2cf92c9a63239879ea904efe047578b9cf35400b009189728d196965de49e537ec0
SSDEEP 1536:7mpLeICAsvW2++ijLR9pzvRojCJa71+yomCEi1G:MLldsvWL+6V9pdojCJa7AyomCP1G
TLSH
T1329307037A90CF76E18F0175D4721AF957A39E21CD109FD7E394BE597CB328AAA21243
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery persistence

Malware Config

Signatures

Detects executables packed with ASPack 8 IoCs

resource	yara_rule
behavioral2/memory/1208-0-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000e00000001c4ce-8.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1208-11-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/4916-14-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/2636-18-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/files/0x000d00000001c4d0-19.dat	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1356-20-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack
behavioral2/memory/1360-21-0x0000000000400000-0x0000000000414000-memory.dmp	INDICATOR_EXE_Packed_ASPack

Executes dropped EXE 4 IoCs

pid	Process
1360	MSWDM.EXE
1356	MSWDM.EXE
1388	2026-10-14_AE2584612DE026EDE8F0836A2F9BCE9E_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE
4916	MSWDM.EXE

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\WDM = "MSWDM.EXE"	MSWDM.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WDM = "MSWDM.EXE"	MSWDM.EXE

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\WINDOWS\MSWDM.EXE	2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe
File opened for modification	C:\Windows\devA280.tmp	2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	MSWDM.EXE
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	MSWDM.EXE

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-14_AE2584612DE026EDE8F0836A2F9BCE9E_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSWDM.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1356	MSWDM.EXE
1356	MSWDM.EXE

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1360	1208	2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe	89
PID 1208 wrote to memory of 1356	1208	2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe	90
PID 1356 wrote to memory of 1388	1356	MSWDM.EXE	91

C:\Users\Admin\AppData\Local\Temp\2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208
- C:\WINDOWS\MSWDM.EXE
  "C:\WINDOWS\MSWDM.EXE"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  PID:1360
- C:\WINDOWS\MSWDM.EXE
  -r!C:\Windows\devA280.tmp!C:\Users\Admin\AppData\Local\Temp\2026-10-14_ae2584612de026ede8f0836a2f9bce9e_amadey_elex_ipamor_rhadamanthys_wannacry.exe! !
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1356
- - C:\Users\Admin\AppData\Local\Temp\2026-10-14_AE2584612DE026EDE8F0836A2F9BCE9E_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:1388
- - C:\WINDOWS\MSWDM.EXE
    -e!C:\Windows\devA280.tmp!C:\Users\Admin\AppData\Local\Temp\2026-10-14_AE2584612DE026EDE8F0836A2F9BCE9E_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE!
    3⤵
    PID:2636

C:\Windows\MSWDM.EXE
MSWDM.EXE
1⤵
- Executes dropped EXE
- Adds Run key to start application
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-10-14_AE2584612DE026EDE8F0836A2F9BCE9E_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-10-14_AE2584612DE026EDE8F0836A2F9BCE9E_AMADEY_ELEX_IPAMOR_RHADAMANTHYS_WANNACRY.EXE
Size 95KB
SHA256 a8cd0901127e0696c5e74a500e4c6f2323c2f146da050f2dc3ed2f662a375603
MD5 fb86f8a2c8dd1c0eee910db7fcef83ae
SHA1 8373dc241af805b140dcbf36561b65c2946ebd9c
SHA512 dc18c6b05d1447b31f3ee6519c7f7318df7159eadcd91ac386cedd95cdfd2e0613ead86e34e31b23b398c8a7628f0291c03a7d0f6dc075cab68493f6ecb2717c
SSDEEP 1536:7mpLeICAsvW2++ijLR9pzvRojCJa71+yomCEi1k:MLldsvWL+6V9pdojCJa7AyomCP1k
TLSH
T13C9307037A90CF76E18F0175D4721AF957A39E21CD109FD7E394BE597CB328AAA21243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSWDM.EXE

Path C:\Windows\MSWDM.EXE
Size 80KB
SHA256 621aec3483ad6b493ce2c5821418c47bd0d4834fb2921b8eed67c1dee6ab115e
MD5 14c8b332a87634290d7283095f0f5850
SHA1 c45d49fce36836e5616acc25bc813d7e70d58f34
SHA512 5d4a4a99ac342c91027ff6cbce157aef6555228704f21a1b8f7110112d1b1530ddc0d07e21100f3042724d89d3e760a9a86759c2b9d70635fc822d0def99a22f
SSDEEP 768:ecvKJWKXRvRVLd1WOXCAsvgkQHGWHx2+E/ksdiPiB9koiR7xpzVJLVoEuaojCJaN:7mpLeICAsvW2++ijLR9pzvRojCJa71+Y
TLSH
T1F883F6137991CF3AD08F01B6C0621AF957A78E11CD109FD3E394BE697CB329A6E25243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

devA280.tmp

Path C:\Windows\devA280.tmp
Size 15KB
SHA256 24a2472e3bd5016cb22ce14cefee112d5bc18354bf099e8e66ad9846aea15088
MD5 b0cec9f342bf95700b602ee376446577
SHA1 b955b1b64280bb0ea873538029cf5ea44081501b
SHA512 05ebecfc8d3e2e7885d3cacc65bfd97db710c2cbc0fb76b19b7d6cc82b327b25df953a20affc8d84002167dd8ac7710622279d3579c6605e742a98fe7095aa4e
SSDEEP 192:WN8CeeT+a2j12sUr/XKRbU+86HOO7+Bb2NpWP1oynJ+y7ihXar28d/o:xeT+a2jfUrfKRa6HiqpA13+y7+Xa1
TLSH
T15A62F7029FA804A1FBFB0B307EFA5D539576BD200964EF0E46707BAA5D70600E952767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1208-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1208-11-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1356-20-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1360-21-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2636-18-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/4916-14-0x0000000000400000-0x0000000000414000-memory.dmp

Download