5c3dd851c4f13bc3240596cab0f71d0ad02b4ffa29bfcde0e5e77d0d8f0e11ce

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
Size 6.8MB
Sample260811-dvmmwsfj21
SHA256 5c3dd851c4f13bc3240596cab0f71d0ad02b4ffa29bfcde0e5e77d0d8f0e11ce
MD5 4617bc445582ceeb6b69ac8f06812e1c
SHA1 078cc01900328318d790b8844210dafc4d6425f0
SHA512 d2532811779b7cc61c8c02045d1b296e23406ccb81d7c439307e95ce1244851770681bf03f0338b7ccfa2e68684b9d2e10de8dfc747c748c18cb20f3febd6076
SSDEEP 49152:U+ES+E2+ES+EhXp69+ES+E2+ES+EhXp69+ES+E2+ES+EhXp69+ES+E2+ES+EhXpz:H
TLSH
T114765C06FAC64471E97701B04DEBD2BE8572BD218B218DEBE748A71F6932FD15834326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4000	svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe
2592	svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe
4612	svchost_CCABBBBCCCCBBBABBCABBBAAAABBCACAAAACABBCACACCCABBCCABBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCBCCBAACBABAACACCABCBCCCAACBCAACACBCCCAABCBCBABCBCBCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe"	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BAACBBCCCCABACACAABAAAABACAAACCCBCBCCBACAACAABBBBBBCCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABBBBCCCCBBBABBCABBBAAAABBCACAAAACABBCACACCCABBCCABBC.exe"	svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4820	sc.exe
628	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3032	cmd.exe
1396	cmd.exe
1700	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABBBBCCCCBBBABBCABBBAAAABBCACAAAACABBCACACCCABBCCABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4168	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3676	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
3676	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
3676	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
3676	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
4000	svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe
4000	svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe
4000	svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe
4000	svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3676	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	4000	svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4528	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3676 wrote to memory of 3032	3676	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe	97
PID 3032 wrote to memory of 4168	3032	cmd.exe	99
PID 4000 wrote to memory of 4756	4000	svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe	100
PID 4756 wrote to memory of 2404	4756	notepad.exe	101
PID 3676 wrote to memory of 1396	3676	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe	103
PID 1396 wrote to memory of 4820	1396	cmd.exe	105
PID 3676 wrote to memory of 1700	3676	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe	106
PID 1700 wrote to memory of 628	1700	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABBCBAABAABCAAABBABCCCCBABABAAABABAABCBABBABCCCCACABBCCABBAACABCACACBBACBAAACBCACCBCBCBABBAABBBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBABBCBAABAABCAAABBABCCCCBABABAAABABAABCBABBABCCCCACABBCCABBAACABCACACBBACBAAACBCACCBCBCBABBAABBBAACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCABBACACACBBACABCBBACBAABABCACBBCCCBCBCCCACBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe" start= auto displayName= "UserDataSvc_BABCABBACACACBBACABCBBACBAABABCACBBCCCBCBCCCACBCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCABBACACACBBACABCBBACBAABABCACBBCCCBCBCCCACBCCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe" start= auto displayName= "UserDataSvc_BABCABBACACACBBACABCBBACBAABABCACBBCCCBCBCCCACBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCABBACACACBBACABCBBACBAABABCACBBCCCBCBCCCACBCCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCABBACACACBBACABCBBACBAABABCACBBCCCBCBCCCACBCCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2404

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe
1⤵
- Executes dropped EXE
PID:2592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBBCCCCBBBABBCABBBAAAABBCACAAAACABBCACACCCABBCCABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBBBCCCCBBBABBCABBBAAAABBCACAAAACABBCACACCCABBCCABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 381aa3e8f22397d689535c972ebcbecd462d2c17778eb10903273f6cff3f4278
MD5 0908f96d6a6cc0640c2229f1af4dcd5e
SHA1 51eea514380df7a2324b48758a4005c661343eb3
SHA512 eab84be9d95c9e85afe6c5c1270852b97257170d38148c5a0a2802581612fdf2b31e1a811c829b83ea8aa2bebf44c2aea7bd4b8723fe5cdb4c1a5ef6ed7468d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3237918829bc544d276024f4af2029ef04d81ef14b62e3917a54bccee406aeac
MD5 f5b5f28ef931f4c396a2b57017d88619
SHA1 ff2c82de973b407f95f3800f0ef078e107069236
SHA512 1bdfd2d1b9e362f78effe0e6809c749387fd2a0e450de2d00378c05f6c745405a243a1c7eb9b9f791517d7b796277f13791a84bb76696a79c83d182fbeb5f569
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0837ac17a1af93308303e48fca4d7eed8fa49d1cc570e7238792516dcc1179e4
MD5 4f0c3eee9b3af69931d484a35a3740fe
SHA1 1e4e5a8a57df8cd67935cee42086abb41cce6a68
SHA512 141d8ed482175a93334ab546b2da24a07ded048c5a82af57182d323af0db9f14098198876d48a2cd3b8d9bb283587a928d53906f3cabdd1f2c4d8e15ffd1eadf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 16ff0f10540d0ee490c5e81bbd070232e32d562c76ddcf79f5dce6d550aec3c4
MD5 945ff538bc8cba3892a03038cba47d41
SHA1 0adac12fe2b67b94ff29d86bb1e788164ab6bf95
SHA512 ffb6cb786bf3ff06b3833263cc181a9e16b45913cf612a43c86774e2a3786b668a1d3f8703f8d5e98124132407c8e929e06e6dfc1342549f9994dfcb6e3ca06f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 22939c204ec5df67c6556a42e5982625516dc7c1d730d83daaa2b674782942c4
MD5 db31eb208bd02472c781a8bb29e2e66a
SHA1 f15881dd1d5b68225bcd23c7add1f9b7943ac498
SHA512 4bc42c71b94f0543bd22d6bbb099ccf80fa0152d1da3352c0ca818029f5ee4ff6c58e7b83cd2f3151e2fc37f74db2a87187f67aa91b66a63710c0ef521a19647
MD5 SHA1 SHA512

Submit Download

svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACCCAAACCBCBBACABAACABABBCCCCBCCBCACBAABBBACAAABAAC.exe
Size 6.8MB
SHA256 5c3dd851c4f13bc3240596cab0f71d0ad02b4ffa29bfcde0e5e77d0d8f0e11ce
MD5 4617bc445582ceeb6b69ac8f06812e1c
SHA1 078cc01900328318d790b8844210dafc4d6425f0
SHA512 d2532811779b7cc61c8c02045d1b296e23406ccb81d7c439307e95ce1244851770681bf03f0338b7ccfa2e68684b9d2e10de8dfc747c748c18cb20f3febd6076
SSDEEP 49152:U+ES+E2+ES+EhXp69+ES+E2+ES+EhXp69+ES+E2+ES+EhXp69+ES+E2+ES+EhXpz:H
TLSH
T114765C06FAC64471E97701B04DEBD2BE8572BD218B218DEBE748A71F6932FD15834326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2592-74-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/2592-81-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/3676-6-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/4000-25-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/4000-38-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/4612-79-0x0000000000680000-0x00000000006A1000-memory.dmp

Download

memory/4756-59-0x0000000004E90000-0x0000000004E91000-memory.dmp

Download