6bc0d02eddf5f25446c5ee9e38aaa9e5d4244cbacf52580b75f2183c5105a52c

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 22:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe
Size 16.7MB
Sample260813-2qecqazerc
SHA256 6bc0d02eddf5f25446c5ee9e38aaa9e5d4244cbacf52580b75f2183c5105a52c
MD5 50ef8a3237de581a7013c9302a568193
SHA1 07cd4356aad017ec6ead8449d512fa78cabac70b
SHA512 7c218f98c50bd68cc05a58702e53883bbbc322335942204a50753280b92cefee8849e8d3988e58dd7311a04443f0903cc70d9fa1b3f747c8fdc431f64465e7fc
SSDEEP 49152:U+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+EQ:OW1PszZ
TLSH
T198073A09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5776	svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
1728	svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
764	svchost_BABBBAACCCABCBCABACBBBCABCBCCCCBAACCCACCACCCBCBCBBBAAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBAABBABAACAACBCCAACBABABAABAAABABACAAABBCAABBAAACCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe"	2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABCCBBCABBBCABBBCBAAABACCAABBBCCABCABACCCCACAACCCCBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBBAACCCABCBCABACBBBCABCBCCCCBAACCCACCACCCBCBCBBBAAAC.exe"	svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3660	sc.exe
2872	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
476	cmd.exe
2304	cmd.exe
3300	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBBAACCCABCBCABACBBBCABCBCCCCBAACCCACCACCCBCBCBBBAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5364	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1172	2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe
1172	2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe
1172	2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe
1172	2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe
5776	svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
5776	svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
5776	svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
5776	svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe
Token: SeDebugPrivilege	5776	svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1172 wrote to memory of 3300	1172	2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe	92
PID 3300 wrote to memory of 5364	3300	cmd.exe	94
PID 1172 wrote to memory of 476	1172	2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe	95
PID 476 wrote to memory of 3660	476	cmd.exe	97
PID 1172 wrote to memory of 2304	1172	2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe	98
PID 2304 wrote to memory of 2872	2304	cmd.exe	100
PID 5776 wrote to memory of 5516	5776	svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_50ef8a3237de581a7013c9302a568193_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAABABACACBBBCCBACBACBCBBCAACABBABBCCABBCBACAACABABCCBBCAAACCCABBCBABAAACABCCBBBABACACABCCCCACCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACCAABABACACBBBCCBACBACBCBBCAACABBABBCCABBCBACAACABABCCBBCAAACCCABBCBABAAACABCCBBBABACACABCCCCACCCCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5364
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBABBBABAAABCAABBAAABBAABBCCCABBAAAABACCBCAAAACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe" start= auto displayName= "UserDataSvc_CCBABBBABAAABCAABBAAABBAABBCCCABBAAAABACCBCAAAACBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBABBBABAAABCAABBAAABBAABBCCCABBAAAABACCBCAAAACBBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe" start= auto displayName= "UserDataSvc_CCBABBBABAAABCAABBAAABBAABBCCCABBAAAABACCBCAAAACBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBABBBABAAABCAABBAAABBAABBCCCABBAAAABACCBCAAAACBBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2304
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBABBBABAAABCAABBAAABBAABBCCCABBAAAABACCBCAAAACBBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5776
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5516

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
1⤵
- Executes dropped EXE
PID:1728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAACCCABCBCABACBBBCABCBCCCCBAACCCACCACCCBCBCBBBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBAACCCABCBCABACBBBCABCBCCCCBAACCCACCACCCBCBCBBBAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2d3746e5f53939490481e7021cb6f8e74975f1f3b599b24a78860908b8e9903c
MD5 c722b95ffd0066b9a6fffc70860d6872
SHA1 1c60ad85be677def9c85ddf7e154e8b42502df53
SHA512 2339a9e4a3d5043f385d45284ea180285f8ad14f8075b2eb085cf5cf31a45710764ccf0ab889a07204267b2dac68e1730960a9b79577c8a92bd35dd8a53e8953
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eb7e8d0d22075e1955a04c2e22e94ddc84d0a747231c203d65e1c3d22592eb8a
MD5 1cb912e5f30c319e6853ff0347bf4d52
SHA1 5cdc847d50896c6fbc66434b00f040e5229b2e9b
SHA512 19d7dbf50b85e6eb10749d4005a12c4b1ae66f94c595aa2cf233c1175b3d2aaf9e5b7ee305b55faccda08f6d78908d80e1480f600cb054337998cf7c7b74997c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1c740fe474c6ce20cbf4b73de3ecaed9ba4f71c532230abc0068ad45744a9db3
MD5 b058c0c316c1f01b6dc8fdd15fda91a4
SHA1 2ae358a02907158d41f1fda69ac65f99d90e5ba9
SHA512 d19a6c6fda57b57f703f9a1a94a0383a7f27616d04e7f62732bdccfecd7afe577ed3e2ab54f5f0252613bbe9e6cef413a15b7971a9f367c32e5aa5b9a832648c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 04dc5445451743b463145d160001563d1d0ee38154a1e6cd8ebd80d960daf259
MD5 16a96d955aaa770a900c9d904e28818b
SHA1 06c9431c49c5f4ddb5724208cfd1f7868291d2e6
SHA512 0821267b17b7508410ab487abae781ab344febd603f486fe13e16dc76f4b42a6f591dabc2d352a4dc6f7968188e2204ee1ec03b8f44272fb1b63c6c37a948ed0
MD5 SHA1 SHA512

Submit Download

svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBCABAACCABABACCCCBCBACACCABCBBCBBBBBBCCAAACABBCAA.exe
Size 16.7MB
SHA256 6bc0d02eddf5f25446c5ee9e38aaa9e5d4244cbacf52580b75f2183c5105a52c
MD5 50ef8a3237de581a7013c9302a568193
SHA1 07cd4356aad017ec6ead8449d512fa78cabac70b
SHA512 7c218f98c50bd68cc05a58702e53883bbbc322335942204a50753280b92cefee8849e8d3988e58dd7311a04443f0903cc70d9fa1b3f747c8fdc431f64465e7fc
SSDEEP 49152:U+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+EQ:OW1PszZ
TLSH
T198073A09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1172-0-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/1172-7-0x0000000000F00000-0x0000000000F21000-memory.dmp

Download

memory/1728-67-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/5776-23-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download

memory/5776-36-0x0000000000B50000-0x0000000000B71000-memory.dmp

Download