25a2d277315f4ef6955f21e4eaa71afb4a010931cd9aba477f67585806578b57

Analysis

max time kernel
149s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 03:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe
Size 12.0MB
Sample260813-dkfftsal3w
SHA256 25a2d277315f4ef6955f21e4eaa71afb4a010931cd9aba477f67585806578b57
MD5 e43fef6b2d13e85b1a4ee5a183d91c71
SHA1 867017ce4a9a8261414a453b3e8340b8863ba77d
SHA512 4db52c106f92b8e9cca7fd9f2997a6d6193be3c0c7921a6449c996610e72bc23bb7a877c97300e5d17067239ab1b6753b07763634303a7ef2c909e9a61f4e428
SSDEEP 98304:0KRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aZ:0qVqVqVqVqVqVqVqVq6
TLSH
T11FD68D02E7D50075F5B335304A7BA27A697EBA214B35C89FA344066E5D32FC09E3936B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3980	svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
1416	svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
3940	svchost_ACBBAABBCACBBCACACBBBCBBCCABCACBCACCBAACBCCCBABCCCAABAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACACACACBBCBCACCACBCCBCABAACBAAAACACBCCCBAAABABACBBBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe"	2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBACAACCAABBAACAACACCCBCBCBAAAACBBBBBAABABCCCAAABAAAACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBAABBCACBBCACACBBBCBBCCABCACBCACCBAACBCCCBABCCCAABAB.exe"	svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1480	sc.exe
2436	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1940	cmd.exe
4928	cmd.exe
2368	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBAABBCACBBCACACBBBCBBCCABCACBCACCBAACBCCCBABCCCAABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6000	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4104	2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe
4104	2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe
4104	2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe
4104	2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe
3980	svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
3980	svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
3980	svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
3980	svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4104	2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe
Token: SeDebugPrivilege	3980	svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4104 wrote to memory of 1940	4104	2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe	96
PID 1940 wrote to memory of 6000	1940	cmd.exe	98
PID 4104 wrote to memory of 4928	4104	2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe	101
PID 4928 wrote to memory of 2436	4928	cmd.exe	103
PID 4104 wrote to memory of 2368	4104	2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe	104
PID 2368 wrote to memory of 1480	2368	cmd.exe	106
PID 3980 wrote to memory of 1092	3980	svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_e43fef6b2d13e85b1a4ee5a183d91c71_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAABBAACBCCBACCCABBABBAABBABCBAABAAABCCAABCACBCAAABBACCABACAACAACCCCBCBAAAACCAAABACCCAACCAAABCCCCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1940
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACACAABBAACBCCBACCCABBABBAABBABCBAABAAABCCAABCACBCAAABBACCABACAACAACCCCBCBAAAACCAAABACCCAACCAAABCCCCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBCCCBAACCBABCAAABCBAAABCACBCBBCACBAABCBCAAABCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe" start= auto displayName= "UserDataSvc_BCBCCCBAACCBABCAAABCBAAABCACBCBBCACBAABCBCAAABCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBCCCBAACCBABCAAABCBAAABCACBCBBCACBAABCBCAAABCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe" start= auto displayName= "UserDataSvc_BCBCCCBAACCBABCAAABCBAAABCACBCBBCACBAABCBCAAABCCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBCCCBAACCBABCAAABCBAAABCACBCBBCACBAABCBCAAABCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2368
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBCCCBAACCBABCAAABCBAAABCACBCBBCACBAABCBCAAABCCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1480

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
1⤵
- Executes dropped EXE
PID:1416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABBCACBBCACACBBBCBBCCABCACBCACCBAACBCCCBABCCCAABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBAABBCACBBCACACBBBCBBCCABCACBCACCBAACBCCCBABCCCAABAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RepairUpdate.exe

Path C:\Users\Admin\Desktop\RepairUpdate.exe
Size 36.5MB
SHA256 da958a39ed6300beb8714917e732973fdbedb825ad0c765467b247e68a471885
MD5 e5c1828389357ce9383aed1f4af1ed79
SHA1 ef004c8556b502a789ec63e57d06e7a2e44b2960
SHA512 c8cffc4809c6bed25e4c38c0452edc1b8fb4481755cf1a7a4ea64b926f9f356f8124f202d708be3ec3c36d641520560b6a0ee95fadc06d0b9cb1f77315a8f52a
SSDEEP 196608:0qVqVqVqVqVqVqVqVqLqVqVqVqVqVqVqVqVqLqVqVqVqVqVqVqVqVqp:FAAAAAAAAmAAAAAAAAmAAAAAAAAp
TLSH
T167879D02E7D50075F5B335304A7BA27A697EBA214B35C89FA344066E5D32FC09E3936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RepairUpdate.exe

Path C:\Users\Admin\Desktop\RepairUpdate.exe
Size 9.2MB
SHA256 3734a1a7bbd5eb46fdab16cf76796e41cda50816d452c9fdb3c30a29ca1d3364
MD5 bb4e5b96adaadec0b2de11d2e1787920
SHA1 7c9c14c98003f05c67494b1d3b191f15f294ac04
SHA512 9f20f5233086cdb08631c311a8328575eb2416a6e471aee8d6c7abdd7f368ef9e29afd14203f681fc67c6356f03e6f392c44a31c3d779289bb7892d1684d45d2
SSDEEP 98304:0KRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5an:0qVqVqVqVqVqVqC
TLSH
T16EA68D02E7D50075F5B335304A6FA27A697DBB214B35C89FA3444A2E5932FC09E3936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 184f30fa159e7cfe48ed541dc7e2b3d730f57c90aa136bbbe1eb9f18b55878c6
MD5 c0d7e843dd84045313942a68557d7fd1
SHA1 1b6f4088fabf05bdb4b70d695a69bceeb5484d69
SHA512 641f2622145bc5be7241b1788d819a26b4902aa68c8ea3586c26b5955e0f2df7005036429d99065f1497cf8b53596ccbea65e725eeb3a5ee5f47a1929b2c22c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf9adec8aa8f3bd4a6d5f4364f024e31ba2ed8fa69c199bac791d6c33579e655
MD5 5e6488aa5973d1220b0b5f47212f00b4
SHA1 5803d97f434699d645fe0284e6a50e3e77c2acc2
SHA512 03482dd6359e17d0a6b7a93de97c907f264392f84e6bf5b032a00d34ed9b4d329e32f17dc205ba1621589b770914cf6f9ab55166be4c846d2d8f87d3419223a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0f99811ee4e4795fcf026a703e8faf4208871404eae3537dee8cd21213397744
MD5 51655a85b6b81cb264db48d6c8cac40a
SHA1 10045b15f09c0adfab250e9577f3cc93d7a34763
SHA512 9a1484eba695e726e2f8466aaa6ef5bf3aebb0f8e4f6e54b666e95605dec31eb3bbab6db740c3f138a9a1d39c24f9190e0bd6468fcdfad1320158143df2331f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1dff3fc7c3aef93788e3f56690577a40e8a88c7406282becd69a6624905df9e8
MD5 891bc0a28e04f5fe1e310a1e05afed0b
SHA1 a7b4f583dfb0ab6317ff554657597471fd741533
SHA512 842b880161a91719373f995dcc5dada8b1cf01a6e1b16898e81546d9307f52c7034126b41de8bab932e75d59e554d4972233b71de81b37cca6eec7584a1b6732
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2dad614d8e55583e05d7a1bfe149613ab09b89abb1a57f5c2294e84f505906eb
MD5 6b69c139b1dbe3261ca498df77e11341
SHA1 898959a5b4343c31b10803abb1c9c1ec14ade0bb
SHA512 fbe9b007ae7d1c84649ff957acc6c57ef1d2bbeff4ea93700b6a7a70a2de403e0e225858406e647c0c9e585e84fe5f4c8740fb64b06a28d299cd04afdc6742d0
MD5 SHA1 SHA512

Submit Download

svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABAACABAACAACBAAAACABABBCCCCCCAABBCBBCAACBBAABCCAABAB.exe
Size 12.0MB
SHA256 25a2d277315f4ef6955f21e4eaa71afb4a010931cd9aba477f67585806578b57
MD5 e43fef6b2d13e85b1a4ee5a183d91c71
SHA1 867017ce4a9a8261414a453b3e8340b8863ba77d
SHA512 4db52c106f92b8e9cca7fd9f2997a6d6193be3c0c7921a6449c996610e72bc23bb7a877c97300e5d17067239ab1b6753b07763634303a7ef2c909e9a61f4e428
SSDEEP 98304:0KRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aqKRuy5aZ:0qVqVqVqVqVqVqVqVq6
TLSH
T11FD68D02E7D50075F5B335304A7BA27A697EBA214B35C89FA344066E5D32FC09E3936B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3980-34-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/3980-52-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/3980-73-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/4104-35-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4104-0-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4104-61-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4104-23-0x0000000000990000-0x00000000009B1000-memory.dmp

Download

memory/4104-12-0x0000000000990000-0x00000000009B1000-memory.dmp

Download