f3ecf95bee45559e0bc7ecc685c64a0433a65b3488bf008f35aa232e4032252b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 04:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe
Size 16.0MB
Sample260813-e19v2s1grc
SHA256 f3ecf95bee45559e0bc7ecc685c64a0433a65b3488bf008f35aa232e4032252b
MD5 840ff292c7e2d28aacdd996483a44429
SHA1 2d71b0737790ab4eb46044f3ab60ccc92f229bf3
SHA512 cc737f96fc6a7473ffc4157143d919e65f3fd5cfc655ee4c57d0cdeb1f62f588afbc975468116ea9e5ae35d54574cd327076cf9aa6c2718df0449620a767c22d
SSDEEP 98304:KKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5a2:KqjqjqjqjqjqjqjqjqjqE
TLSH
T12E079E06F6820071E97730708A9FE37A9979B721473189DFE7488A7E5A33EC0653875B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3796	svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
1732	svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
812	svchost_ACCABABAACBBCCBBBABBACCCCAACABCCBCBBACBBCBBBCCBBAABBCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBACCBBCCCBACCCBACCAABABCBAABCAABAACCBCACAABCCBCCAAACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe"	2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AAAAACBBBBAACBCBACABCBCCCCBABAAABCABCACCCBACCBBAABBACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABABAACBBCCBBBABBACCCCAACABCCBCBBACBBCBBBCCBBAABBCAB.exe"	svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2888	sc.exe
4508	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2184	cmd.exe
2604	cmd.exe
4840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABABAACBBCCBBBABBACCCCAACABCCBCBBACBBCBBBCCBBAABBCAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4976	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1584	2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe
1584	2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe
1584	2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe
1584	2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe
3796	svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
3796	svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
3796	svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
3796	svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1584	2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe
Token: SeDebugPrivilege	3796	svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1700	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 2184	1584	2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe	99
PID 2184 wrote to memory of 4976	2184	cmd.exe	101
PID 3796 wrote to memory of 3940	3796	svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe	102
PID 1584 wrote to memory of 2604	1584	2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe	103
PID 2604 wrote to memory of 2888	2604	cmd.exe	105
PID 1584 wrote to memory of 4840	1584	2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe	106
PID 4840 wrote to memory of 4508	4840	cmd.exe	108
PID 3940 wrote to memory of 2628	3940	notepad.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_840ff292c7e2d28aacdd996483a44429_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACBBCCCCCBBBAABCCAACCBBAAAACCAABACACCCBABAABCCAABCCCAABCBABCCCBBCBCCBBBAAAAAABAABBBCBCACCCCACABCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABACBBCCCCCBBBAABCCAACCBBAAAACCAABACACCCBABAABCCAABCCCAABCBABCCCBBCBCCBBBAAAAAABAABBBCBCACCCCACABCAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACACBACBBABBABAABACBACCBACACCABCCBABAABCABBBCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe" start= auto displayName= "UserDataSvc_BCACACBACBBABBABAABACBACCBACACCABCCBABAABCABBBCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACACBACBBABBABAABACBACCBACACCABCCBABAABCABBBCABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe" start= auto displayName= "UserDataSvc_BCACACBACBBABBABAABACBACCBACACCABCCBABAABCABBBCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACACBACBBABBABAABACBACCBACACCABCCBABAABCABBBCABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACACBACBBABBABAABACBACCBACACCABCCBABAABCABBBCABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3940
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2628

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
1⤵
- Executes dropped EXE
PID:1732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABABAACBBCCBBBABBACCCCAACABCCBCBBACBBCBBBCCBBAABBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABABAACBBCCBBBABBACCCCAACABCCBCBBACBBCBBBCCBBAABBCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dac2f82e35d88fae5eb6ceef0d983f83b566ffbf6d1792b9726ba1304120d32d
MD5 40f890ab72d12fb48b28027df67dfc2c
SHA1 23a3a9ce7abc6cc8f5ceb883bf8f19da2f8921ba
SHA512 0e0b271d9afe3a0697d3dda77c343b7a984f38232c336a7a4934dccb551396afa9777833d4c67a0ca75616d61c05b94781cccbada6363b09bc2cc20b7973f637
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7324627e3b5741babcd0ecf2ae7f916786541f832a0b7f40f85e15a2ec191f68
MD5 e61b08fb8077bca4521fedd3319aa00a
SHA1 9fbe901d927c9ab73d25b9c29b3fe6be88a01f39
SHA512 beb6580111397543b0eb9378eb554733d8743280d94f97c4bbfa0988752a432243abc62e51c7183bd6f077de0484237b0a42e4b36fa91d3661bd0216c191685f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 24d0eeda3d1d0adcb95a653d6d2fa77aad59a76d937577c68b4534f5a92e7fcf
MD5 d9989d0de9cfe096a7911ff9dab62fde
SHA1 7bb489dbd1b8f663adc2ca62c3c531cda6d3864d
SHA512 c84c7acbdc65a2b4aa06cb9a8ac09dc1baac2253bb42502180ec090d9b66a20977d5da274ede7097904814ebd00adacac563f782b4f3b75f9ddfa42a6c41676d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d9ac35b05168411398a63ee3ff2ac7f3c34d38dc4d405d7e88b38019a9dc0530
MD5 e66693230940fc9b364c16b8be4def5f
SHA1 202735243bbd06b14299afa9d180a91fd463c432
SHA512 703a753f4bce18f59dfe001f8b4aadaf6a07c95dfc03d07e617e650ff762a6e2886651d15b0b58aa4ae4d801f22960a2fae0b078a69daaad1bfe9461f42cc657
MD5 SHA1 SHA512

Submit Download

svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACAAAAACACBACCCBACCABCBCACCCCABCABBBBBBCCCCCACAACBBC.exe
Size 16.0MB
SHA256 f3ecf95bee45559e0bc7ecc685c64a0433a65b3488bf008f35aa232e4032252b
MD5 840ff292c7e2d28aacdd996483a44429
SHA1 2d71b0737790ab4eb46044f3ab60ccc92f229bf3
SHA512 cc737f96fc6a7473ffc4157143d919e65f3fd5cfc655ee4c57d0cdeb1f62f588afbc975468116ea9e5ae35d54574cd327076cf9aa6c2718df0449620a767c22d
SSDEEP 98304:KKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5a2:KqjqjqjqjqjqjqjqjqjqE
TLSH
T12E079E06F6820071E97730708A9FE37A9979B721473189DFE7488A7E5A33EC0653875B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1584-25-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/1584-38-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/1584-64-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/1584-0-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/1584-12-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/3796-55-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/3796-37-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/3796-78-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/3940-88-0x0000000002D80000-0x0000000002D81000-memory.dmp

Download