b8b3a69445d63dddab1cc983a88c0cc8d3f618a681907d24bc69c7a3851f387b

Analysis

max time kernel
148s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe
Size 42.0MB
Sample260810-eavnfaam7t
SHA256 b8b3a69445d63dddab1cc983a88c0cc8d3f618a681907d24bc69c7a3851f387b
MD5 f407ca43d5b75d7b959e0ae75395b01e
SHA1 b114f10166d3e6e6b17b918b63faff38c50f3d9d
SHA512 8a57dac31ebe0a3a84a222a25039cc9da706701632b01237c7b86d637a2e5d6495ac4360bb4098a6ea660216849d96facc47c49cc80f78347f3bd1c2642dbc3c
SSDEEP 196608:kFlfFlfFlyFlfFlfFlyFlfFlfFlyFlfFlfFlyFlfFlfFlyFlfFlfFlyFlfFlfFlc:i33q33q33q33q33q33q33q33J
TLSH
T178A7E14AFC8640B0DD7A64704CDBE27B4936BF3AC0168A99F9CA7B067B37E21540F456
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral1/files/0x000700000002454b-21.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2192	svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
1808	svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
2008	svchost_BCACBCCBCCBBCCCBABCBCBBBCCCABCCBAABAAACCBBCCABABAACCCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCCCBBACBBCCAABBCAAACCCBACBABAAAACCAABAABBABABBBCACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe"	2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCBCAAACABCCCCABCBAACBABBABBCABCABCBBCAABCBBCCCBBABCAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBCCBCCBBCCCBABCBCBBBCCCABCCBAABAAACCBBCCABABAACCCCB.exe"	svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1448	sc.exe
1876	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1644	cmd.exe
812	cmd.exe
4972	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBCCBCCBBCCCBABCBCBBBCCCABCCBAABAAACCBBCCABABAACCCCB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5088	2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe
5088	2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe
5088	2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe
5088	2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe
2192	svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
2192	svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
2192	svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
2192	svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5088	2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe
Token: SeDebugPrivilege	2192	svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3364	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 4972	5088	2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe	96
PID 4972 wrote to memory of 4888	4972	cmd.exe	98
PID 2192 wrote to memory of 4440	2192	svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe	100
PID 4440 wrote to memory of 4780	4440	notepad.exe	101
PID 5088 wrote to memory of 1644	5088	2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe	103
PID 1644 wrote to memory of 1876	1644	cmd.exe	105
PID 5088 wrote to memory of 812	5088	2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe	106
PID 812 wrote to memory of 1448	812	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f407ca43d5b75d7b959e0ae75395b01e_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCBBCAABABACBBBCCCABBBAAACCBBABCBCAABCCBBACBCBBABCBBACBCBBCCABCCCAAAAACAAACCCCACACACBACABABCAAACCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABCBBCAABABACBBBCCCABBBAAACCBBABCBCAABCCBBACBCBBABCBBACBCBBCCABCCCAAAAACAAACCCCACACACBACABABCAAACCBBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCAACABABBCABCCACCBCACAABCCCABCBBACBACCCAAACBBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe" start= auto displayName= "UserDataSvc_CCCAACABABBCABCCACCBCACAABCCCABCBBACBACCCAAACBBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCAACABABBCABCCACCBCACAABCCCABCBBACBACCCAAACBBCBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe" start= auto displayName= "UserDataSvc_CCCAACABABBCABCCACCBCACAABCCCABCBBACBACCCAAACBBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCAACABABBCABCCACCBCACAABCCCABCBBACBACCCAAACBBCBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:812
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCAACABABBCABCCACCBCACAABCCCABCBBACBACCCAAACBBCBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4780

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
1⤵
- Executes dropped EXE
PID:1808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBCCBCCBBCCCBABCBCBBBCCCABCCBAABAAACCBBCCABABAACCCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBCCBCCBBCCCBABCBCBBBCCCABCCBAABAAACCBBCCABABAACCCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3c641f4458be21e81d89ca161d770b5e31bf194ea6e286cef261858057c92bf
MD5 9c090d9890da247cb1b24412a990d402
SHA1 bf847b7c5e275ebbb252568629efac40edd1fcf3
SHA512 f10b681e9d6580b48902c591d38cc321d53e0f7b9965d267c035943d75fd7f1b57b93be88d909b386181a4d7421c3530fc4f88a0f7605ca3f0cdce1d0a57bf4b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dd106727dbd6a12ea4f18906de0ad889db5d8d4c4067fa9f80abf0b3fe571813
MD5 1b654d77a311cbeece75e6dfec2d2c23
SHA1 653875703e66e9a6f048cd0a4af007f6893617d9
SHA512 bd6fee1d061dbae7f5f3259adbf9d3e4a7da10213b44a08d2784c1fc6061d97558159fe4baa405a605f4f4fa950c0b717791cedd39223abf5ae17d7204ee44cc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 266a00d313180ba78cddb97df8279f37cb7046b1636b8618e36b977bab5555a1
MD5 3f67aa66a45f65e511ad6feb24d82d35
SHA1 a9a75f29a33af3781ebf12977e184aeb4773cc87
SHA512 9155ff5fd2c43ccc76176429a88d3bde2f7b62138f185a1e3e61a78091dd96c2632b14f4ca20339ec62d4313fdd4822bac3b905b2b0b642f7d82d5b2f116fc50
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6727af7a0faf3bb6c8339ac3a9ae749121a63e90d4e46a1884baa73af23cce99
MD5 415e4b6ca87a110f54b569086071377f
SHA1 bce194bf0b6a514b4910c5272b9092bb17f64ba3
SHA512 994c281bb3f3d78791a6c4dcb748260e948a044a7dfea75df7418ade3981ef9b11e006990204dce17ef79ecfc826dc19338ac1f0b08fadc55e4f4124bf26ca15
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a401d223a38e91a31dd11b15238ad4cadfb2a14c55e0fd5ade5df2c6d9d3f732
MD5 8db8d4f9a3ec26c76b34344d400ce30e
SHA1 8c80e1f55a87bcc51957f694c10a4f255eb355d2
SHA512 04db63e30fe560928e1918951c6e28ef2ce2eb4a94ecd5c7217c7c5dfbf86cebdcbf3789035a419b358dbf54426c04e0e8e30d9cb989b540c64fa1b97058af52
MD5 SHA1 SHA512

Submit Download

svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCBAABAAACAAABBABACBBCCCAACAAACACCBBBCBBBACACBBBBBABA.exe
Size 42.0MB
SHA256 b8b3a69445d63dddab1cc983a88c0cc8d3f618a681907d24bc69c7a3851f387b
MD5 f407ca43d5b75d7b959e0ae75395b01e
SHA1 b114f10166d3e6e6b17b918b63faff38c50f3d9d
SHA512 8a57dac31ebe0a3a84a222a25039cc9da706701632b01237c7b86d637a2e5d6495ac4360bb4098a6ea660216849d96facc47c49cc80f78347f3bd1c2642dbc3c
SSDEEP 196608:kFlfFlfFlyFlfFlfFlyFlfFlfFlyFlfFlfFlyFlfFlfFlyFlfFlfFlyFlfFlfFlc:i33q33q33q33q33q33q33q33J
TLSH
T178A7E14AFC8640B0DD7A64704CDBE27B4936BF3AC0168A99F9CA7B067B37E21540F456
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-75-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/2008-80-0x0000000000490000-0x00000000004B1000-memory.dmp

Download

memory/2192-39-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/2192-26-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4440-60-0x00000000054A0000-0x00000000054A1000-memory.dmp

Download

memory/5088-0-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/5088-7-0x0000000000430000-0x0000000000451000-memory.dmp

Download