e2d369a2ef8b8affa35bdd217120965cfed3e5f2c5a623a2b3a40691e509f7f5

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 01:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe
Size 11.4MB
Sample260810-b54caadd89
SHA256 e2d369a2ef8b8affa35bdd217120965cfed3e5f2c5a623a2b3a40691e509f7f5
MD5 f213a2f7b76005c1e9bd6e37c27a3b43
SHA1 857004ec29f98eb01acda5d1fcd9214d4cebbb75
SHA512 0868618468c2d7407e4b48d70a4d54ede8c8b33c39bb1dc1f764345c254d1649251d771c1285e1497e2c9b4f3efb405b3f03fdc2ea6a9275a9cb03e3e565fcd3
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+E/+EF+Ei+E9:n
TLSH
T1E5C60A09FD4744F1D92B51B00DCBE3BF8A60BB25C4228EBAFB4ECB5BB923B215418555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1280	svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
3448	svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
3720	svchost_ABBCBBAACBBABBAABCCABCACBCABCCBBCBABABABBACACCCBCCABBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACBBACCAAABCABACBACBABAAABBCACCCBABBAABCBBCCBCAACCCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe"	2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBACCBBCCBBBBABCAACACBACABBCCCBBCBCABBCCCCBBAABACACBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCBBAACBBABBAABCCABCACBCABCCBBCBABABABBACACCCBCCABBAB.exe"	svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4196	sc.exe
4684	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2100	cmd.exe
2412	cmd.exe
4240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCBBAACBBABBAABCCABCACBCABCCBBCBABABABBACACCCBCCABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3672	2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe
3672	2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe
3672	2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe
3672	2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe
1280	svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
1280	svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
1280	svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
1280	svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3672	2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe
Token: SeDebugPrivilege	1280	svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2100	3672	2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe	92
PID 2100 wrote to memory of 5516	2100	cmd.exe	94
PID 3672 wrote to memory of 2412	3672	2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe	95
PID 2412 wrote to memory of 4196	2412	cmd.exe	97
PID 3672 wrote to memory of 4240	3672	2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe	98
PID 4240 wrote to memory of 4684	4240	cmd.exe	100
PID 1280 wrote to memory of 5004	1280	svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f213a2f7b76005c1e9bd6e37c27a3b43_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACBCCAACBAAACBCBBBAAACACBBCABACBCCBCACCCABCAABACBBAAACABCCBAAABBCCABABBCACCCABACBBCCCAACBAAABBCBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2100
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABAACBCCAACBAAACBCBBBAAACACBBCABACBCCBCACCCABCAABACBBAAACABCCBAAABBCCABABBCACCCABACBBCCCAACBAAABBCBCAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCACCBACBABBCBCBACBCBCBCCABCACCBACCACACCCBBCAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe" start= auto displayName= "UserDataSvc_BACCACCBACBABBCBCBACBCBCBCCABCACCBACCACACCCBBCAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCACCBACBABBCBCBACBCBCBCCABCACCBACCACACCCBBCAABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe" start= auto displayName= "UserDataSvc_BACCACCBACBABBCBCBACBCBCBCCABCACCBACCACACCCBBCAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4196
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCACCBACBABBCBCBACBCBCBCCABCACCBACCACACCCBBCAABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACCACCBACBABBCBCBACBCBCBCCABCACCBACCACACCCBBCAABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5004

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
1⤵
- Executes dropped EXE
PID:3448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBAACBBABBAABCCABCACBCABCCBBCBABABABBACACCCBCCABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCBBAACBBABBAABCCABCACBCABCCBBCBABABABBACACCCBCCABBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8d56aa416beb72241dd2d8f0b78d7b9cc56b6d5ca77cd3159fe07e6b227a3e10
MD5 73488b4a4d1728cc69a2ab5f3c44a871
SHA1 cfeae2a42fedfbe62dc85d5d562b8dced56ddd00
SHA512 ef09d33764fe10a2f623093af558bfebc78a8d40af7592c1b853b2f87b721d5303e2dc452073d50f188529cf8eaad47a48bb9016c0b83a6543aa4b2f40d9c737
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cdfb2fd065d100e5548ff3bd0934f5629d40f622830a475ae2b3a6d89dd711dd
MD5 0570ad5066197844bd6e96390f2f20e4
SHA1 96addbe954fe85d127c609b5212743a5b30826cb
SHA512 9ad17ef5439f6cf3c6c6dd362fae90982555646128b201f656f3dc49c53827bac1d8fdac4c30899562443fa9536719b9888d4f8ba25dcf6afa038334906ac1ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0e479b45c7d3027979675374e1ad5ceeb6805c1a95a9dfb0284528d1fc3d79e2
MD5 ffc5d948509b0d2a7bbca4898e1ddcff
SHA1 c03c7112ae9f9e02eb6a0c4bd94294a855932062
SHA512 92c646f4b2575514672dcecc960916ea84f6be38bc9a71690a3466dbb06fafd004882000e789fe11f97c05e3d9293a6fc8e99b3c3dcba9dd0736a224561b7dc9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fbf718fed10b13519157cf8c4325875c637b789c5ee90e6a6e0c014b7bffe32c
MD5 1339a6c20444946db7d2d7d9a4ad965d
SHA1 abcba7fe93ec01ecef4f30bf8f3456539e3bf505
SHA512 d2fa784700bf13bff96d4505da785c2101f45663385a3353187b0ae7bb2f6e8b93ffb469c55633aff3d49d1d08ad14259bbb2bcb1d5a2a895632c80e74baf4f8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1947b3a20323f2e147eb1055b48bd4682351551c17d6057f15460e018cc062ef
MD5 b0a0aff08533528ed0efc613db7a30db
SHA1 893ff28e694414c26f8ae8cb5ad9248235a7859f
SHA512 0cd07fe757835fdbf84f76c44329f34866997467659e4f90532962ca9f3241480c0f8339f4cb7eff39d3463690d37aae8bb7a6e379de2a273cb7452aac16757b
MD5 SHA1 SHA512

Submit Download

svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCABCAAABBBAACABCAAABACAAAAACBAABAABBCACCACABBAACCAB.exe
Size 11.4MB
SHA256 e2d369a2ef8b8affa35bdd217120965cfed3e5f2c5a623a2b3a40691e509f7f5
MD5 f213a2f7b76005c1e9bd6e37c27a3b43
SHA1 857004ec29f98eb01acda5d1fcd9214d4cebbb75
SHA512 0868618468c2d7407e4b48d70a4d54ede8c8b33c39bb1dc1f764345c254d1649251d771c1285e1497e2c9b4f3efb405b3f03fdc2ea6a9275a9cb03e3e565fcd3
SSDEEP 49152:U+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+Ei+EF+E/+EF+Ei+E9:n
TLSH
T1E5C60A09FD4744F1D92B51B00DCBE3BF8A60BB25C4228EBAFB4ECB5BB923B215418555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1280-22-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/1280-35-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/3448-65-0x0000000000030000-0x0000000000051000-memory.dmp

Download

memory/3672-6-0x0000000000970000-0x0000000000991000-memory.dmp

Download