5c3dd851c4f13bc3240596cab0f71d0ad02b4ffa29bfcde0e5e77d0d8f0e11ce

Analysis

max time kernel
150s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
Size 6.8MB
Sample260811-dvmmwsfj21
SHA256 5c3dd851c4f13bc3240596cab0f71d0ad02b4ffa29bfcde0e5e77d0d8f0e11ce
MD5 4617bc445582ceeb6b69ac8f06812e1c
SHA1 078cc01900328318d790b8844210dafc4d6425f0
SHA512 d2532811779b7cc61c8c02045d1b296e23406ccb81d7c439307e95ce1244851770681bf03f0338b7ccfa2e68684b9d2e10de8dfc747c748c18cb20f3febd6076
SSDEEP 49152:U+ES+E2+ES+EhXp69+ES+E2+ES+EhXp69+ES+E2+ES+EhXp69+ES+E2+ES+EhXpz:H
TLSH
T114765C06FAC64471E97701B04DEBD2BE8572BD218B218DEBE748A71F6932FD15834326
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3860	svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
5612	svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
2480	svchost_AAAABBABAABCBBBCCCACACACAAABCBBCCCAAACBACCCCBAABAACCBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABAAACBCCAAABCCABBABCBABBBBCAAABBBBBBCCCACBCAACAABBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe"	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACBCBCAACBCCCCBABBBAAABBBBAAACABACBBACCAABBABABBCCBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAABBABAABCBBBCCCACACACAAABCBBCCCAAACBACCCCBAABAACCBAC.exe"	svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2272	sc.exe
4552	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4652	cmd.exe
2704	cmd.exe
5436	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAABBABAABCBBBCCCACACACAAABCBBCCCAAACBACCCCBAABAACCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3000	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
3000	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
3000	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
3000	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
3860	svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
3860	svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
3860	svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
3860	svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
2480	svchost_AAAABBABAABCBBBCCCACACACAAABCBBCCCAAACBACCCCBAABAACCBAC.exe
2480	svchost_AAAABBABAABCBBBCCCACACACAAABCBBCCCAAACBACCCCBAABAACCBAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3000	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	3860	svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
Token: SeDebugPrivilege	2480	svchost_AAAABBABAABCBBBCCCACACACAAABCBBCCCAAACBACCCCBAABAACCBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 4652	3000	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe	92
PID 4652 wrote to memory of 1212	4652	cmd.exe	94
PID 3860 wrote to memory of 4412	3860	svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe	95
PID 3000 wrote to memory of 2704	3000	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe	96
PID 2704 wrote to memory of 2272	2704	cmd.exe	98
PID 3000 wrote to memory of 5436	3000	2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe	99
PID 5436 wrote to memory of 4552	5436	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_4617bc445582ceeb6b69ac8f06812e1c_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCBAAACBCCBBCCCACCCACCBCACACCBCACAABACCBCCBBBBAABCCCCABACCCBAAAAACAAABACBAACBABCABAAAACCACBCACAAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBCBAAACBCCBBCCCACCCACCBCACACCBCACAABACCBCCBBBBAABCCCCABACCCBAAAAACAAABACBAACBABCABAAAACCACBCACAAAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBACACCACAACBCCBACBCCBBCABACCACABAACCAACCCBCBAABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe" start= auto displayName= "UserDataSvc_BBBACACCACAACBCCBACBCCBBCABACCACABAACCAACCCBCBAABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBACACCACAACBCCBACBCCBBCABACCACABAACCAACCCBCBAABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe" start= auto displayName= "UserDataSvc_BBBACACCACAACBCCBACBCCBBCABACCACABAACCAACCCBCBAABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBACACCACAACBCCBACBCCBBCABACCACABAACCAACCCBCBAABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5436
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBACACCACAACBCCBACBCCBBCABACCACABAACCAACCCBCBAABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4412

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
1⤵
- Executes dropped EXE
PID:5612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBABAABCBBBCCCACACACAAABCBBCCCAAACBACCCCBAABAACCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAABBABAABCBBBCCCACACACAAABCBBCCCAAACBACCCCBAABAACCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5cd91bb0f0bf50bd0d134c0030cacaaea8f0e3d5f7ef0d3ffe5eb12ce01779c
MD5 573612b9e38555fed197e9712d0d0aa3
SHA1 4e9deba87f3206b9069acf6dfc0b8ae520d6f73c
SHA512 5c7095c2e162ec24c4d36fb18890e49aa9f464e1ed8c78ee126f45cd90f22f615169a0d3b6ddc0f8f7858a027e6bf8742e451886316e8a5090ab5d384979aa8b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3237918829bc544d276024f4af2029ef04d81ef14b62e3917a54bccee406aeac
MD5 f5b5f28ef931f4c396a2b57017d88619
SHA1 ff2c82de973b407f95f3800f0ef078e107069236
SHA512 1bdfd2d1b9e362f78effe0e6809c749387fd2a0e450de2d00378c05f6c745405a243a1c7eb9b9f791517d7b796277f13791a84bb76696a79c83d182fbeb5f569
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b7b8db113dc1d421c51b4e83cdbf36c775d6a77ccba0fb6b4a8da56f6b02c225
MD5 55021aa95f2c9f6cadd6749ba8df4a12
SHA1 9817aa13a49087a990513b3e944626723c2fbc97
SHA512 f99ce0acfa847746487987ae5299ceb61bca4abb620a85fbf92fcd5ec48ae4afaa379b8bc888750fd3b06eee3c9bd53cbb50114192c4bb63cc5803b5101ebbd4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 22939c204ec5df67c6556a42e5982625516dc7c1d730d83daaa2b674782942c4
MD5 db31eb208bd02472c781a8bb29e2e66a
SHA1 f15881dd1d5b68225bcd23c7add1f9b7943ac498
SHA512 4bc42c71b94f0543bd22d6bbb099ccf80fa0152d1da3352c0ca818029f5ee4ff6c58e7b83cd2f3151e2fc37f74db2a87187f67aa91b66a63710c0ef521a19647
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 298b824eb095fa841b33985539762591308b77d5a60301dac9e72580d6d96534
MD5 0626552a0e330370355bafabebd56bff
SHA1 a58e4e81408e21228a2e88e54f914b93a483e95e
SHA512 f846d8f79995ab404d734357f3e7b4f0ab83f740070e1b05faaea331d3b18251558f218728447b4cd37f343e0646f99b4219171cc4a136d1554a9c23f7b3a09a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 16ff0f10540d0ee490c5e81bbd070232e32d562c76ddcf79f5dce6d550aec3c4
MD5 945ff538bc8cba3892a03038cba47d41
SHA1 0adac12fe2b67b94ff29d86bb1e788164ab6bf95
SHA512 ffb6cb786bf3ff06b3833263cc181a9e16b45913cf612a43c86774e2a3786b668a1d3f8703f8d5e98124132407c8e929e06e6dfc1342549f9994dfcb6e3ca06f
MD5 SHA1 SHA512

Submit Download

svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBBBAABCBBCBBABBACCBABBABBACBCAABBBACAABACAACCCAACA.exe
Size 6.8MB
SHA256 5c3dd851c4f13bc3240596cab0f71d0ad02b4ffa29bfcde0e5e77d0d8f0e11ce
MD5 4617bc445582ceeb6b69ac8f06812e1c
SHA1 078cc01900328318d790b8844210dafc4d6425f0
SHA512 d2532811779b7cc61c8c02045d1b296e23406ccb81d7c439307e95ce1244851770681bf03f0338b7ccfa2e68684b9d2e10de8dfc747c748c18cb20f3febd6076
SSDEEP 49152:U+ES+E2+ES+EhXp69+ES+E2+ES+EhXp69+ES+E2+ES+EhXp69+ES+E2+ES+EhXpz:H
TLSH
T114765C06FAC64471E97701B04DEBD2BE8572BD218B218DEBE748A71F6932FD15834326
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 99afd8bf6352d06ae2be61e058e40770322866109d3265eaac2c7cf4e37e16b8
MD5 eaec714153f0384f6ef17aedcb326cc7
SHA1 3945b8a3926a5eb03ae098840f1c307a3af37e80
SHA512 1d33006c2dc01764171ef947c40d3c6270ec412cb9d2c20fdf1d861839a60cc6f2626dc2256f32a0de8cd6339acc8c4c86d51fa1578bf777be930e2e673da7bf
TLSH
T1F8110A51D4F9A463F9326CDF832E9F830CD8368F585C6BA4571843186395C32DD558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2480-81-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3000-6-0x0000000000A60000-0x0000000000A81000-memory.dmp

Download

memory/3860-22-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/3860-35-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/5612-66-0x0000000000810000-0x0000000000831000-memory.dmp

Download