b9eaf77b0ba4fe90c145ab6061e8d9f3b7bef505e66ef208e9a42ac841d7be6a

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe
Size 19.3MB
Sample260813-e8g51agg86
SHA256 b9eaf77b0ba4fe90c145ab6061e8d9f3b7bef505e66ef208e9a42ac841d7be6a
MD5 73da1402093532217347c47614d921db
SHA1 6162039805cfed899029f08c6ad53b4144b6ad71
SHA512 fc7e25ae1eaa268c0932176b30b8db03f2250b50c2ebce69012f6d592f617778f5518c96dbba722b727d5b92c8a8484c94d862cd5674b06b6d71b6923a9c2526
SSDEEP 98304:ir6r6r0r6r6r0r6r6r0r6r6r0r6r6r0r6r6r0r6r6r0r6r6r0r6r6rI:H
TLSH
T1BE175B1F26F80076D96F8276D6D28266C670B43127225EEFA250C73D9F6B9D1A43DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3420	svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
3892	svchost_CCBAACBBBCBBCABCCBBCBAACBCCCCAABCBAACCBCBBBACACCCBABACA.exe
3732	svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAACAABCACBCABAAACACBBCCABCBCCBCCBCCCACBCACACACABCBACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe"	2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCAAAACBAABCBACCCCCBAAAACBCCCCCCBCCCACBCBCCCACCCCCBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAACBBBCBBCABCCBBCBAACBCCCCAABCBAACCBCBBBACACCCBABACA.exe"	svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3488	sc.exe
2372	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1388	cmd.exe
2276	cmd.exe
5148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAACBBBCBBCABCCBBCBAACBCCCCAABCBAACCBCBBBACACCCBABACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1716	2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe
1716	2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe
1716	2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe
1716	2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe
3420	svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
3420	svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
3420	svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
3420	svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
3892	svchost_CCBAACBBBCBBCABCCBBCBAACBCCCCAABCBAACCBCBBBACACCCBABACA.exe
3892	svchost_CCBAACBBBCBBCABCCBBCBAACBCCCCAABCBAACCBCBBBACACCCBABACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1716	2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	3420	svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
Token: SeDebugPrivilege	3892	svchost_CCBAACBBBCBBCABCCBBCBAACBCCCCAABCBAACCBCBBBACACCCBABACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 1388	1716	2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe	93
PID 1388 wrote to memory of 5608	1388	cmd.exe	95
PID 3420 wrote to memory of 1092	3420	svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe	96
PID 1716 wrote to memory of 2276	1716	2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe	99
PID 2276 wrote to memory of 3488	2276	cmd.exe	101
PID 1716 wrote to memory of 5148	1716	2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe	102
PID 5148 wrote to memory of 2372	5148	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_73da1402093532217347c47614d921db_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACAACCCCCBCABAABBCCCCBACACABCCCBBCAACBBCBBCCBCACABBCACAACABCAABBACABACACBBBBAACABACABABABBBCBBBACAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACAACCCCCBCABAABBCCCCBACACABCCCBBCAACBBCBBCCBCACABBCACAACABCAABBACABACACBBBBAACABACABABABBBCBBBACAACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABBCCBBCCCCBBACCBABBCABACABBCAACBCBCBBBBAAACBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe" start= auto displayName= "UserDataSvc_BAABBCCBBCCCCBBACCBABBCABACABBCAACBCBCBBBBAAACBBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABBCCBBCCCCBBACCBABBCABACABBCAACBCBCBBBBAAACBBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe" start= auto displayName= "UserDataSvc_BAABBCCBBCCCCBBACCBABBCABACABBCAACBCBCBBBBAAACBBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABBCCBBCCCCBBACCBABBCABACABBCAACBCBCBBBBAAACBBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5148
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABBCCBBCCCCBBACCBABBCABACABBCAACBCBCBBBBAAACBBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBBBCBBCABCCBBCBAACBCCCCAABCBAACCBCBBBACACCCBABACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBBBCBBCABCCBBCBAACBCCCCAABCBAACCBCBBBACACCCBABACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
1⤵
- Executes dropped EXE
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8898224fab44a67ede20209e6cd354c75119b3bf1498e5e42a7b2ec856ece460
MD5 9685967117f6b1a1b607f58af36d16df
SHA1 3438f9776081bfce0d4eacb5f6b3beaeac367884
SHA512 8dfc5c8c280d7011bba928e848d4f727e5232e12280a801e21733e545f213049da2db8746e7bc153fe606fa51f6d97226df18c5dba7ed3c7d72366a76f8bf9ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a786e5bde9daefe7548f5c5b816d24951d9a6d12303db2fdebe8dd876c51feb
MD5 d1e45dfb0bc2ddd609eb701c557fd8a2
SHA1 4cc32fc64a091d0e79ee9f6fcd614c009a5e1bdb
SHA512 d6b0b7ee17eb54c30265407e3218b38cb8d8473cfd17d78acd9b7f5fed188f598df46f11543ef7777c5c8f987bc6b23badec7ec83bcac6daaa71def8b7229625
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 050e3512c599113359bbc3872e7374d525b8f2154d66c4adc4f954da1620d038
MD5 39edec2b076b0d536d205a3ae309aed3
SHA1 0a302edde477e0238307024b6a370f30eb8ad8f1
SHA512 222b4e49e275a9463e35aae11adc669f57a76a2e553c6ac124b69cccd404845740774c3f16c5e0ac010e3b2d86b61482d3a97aab76c23f47d0df5dc21942079d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c455e35b0ad2c79e5e91bbe8c8d8e7df660e12f7a11e4ea0975ff8337f196c19
MD5 30827ba8fe0f77228ee26e4d181d1ade
SHA1 ed469d2805a052fb5824cf2566b476fd763ec3a6
SHA512 cd104b323286165915887e1b3c02664299c66bad1d6f4980c852cb7290b1607ff8ec63fd26b88f4f6861f5e9819b14ae8a9d90f54ecf00efd0390631d06cb8e8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0338fea413ed8fa2910de6d0c25130f2c36a75ee5d8c60184ed7185c9c995ddb
MD5 aa33afa8c2dcd2c84300f8985ad9d1ff
SHA1 9a3211e41bc08cbdcaa4da67aaf530cfed3778f0
SHA512 2748aa8038adcf1a058273f4320b7687b8d710671b00d0de2148c63560cc0936a28b0824bfef5ad07f0dceb5be03c6512271c678019cd0c08ba3b38670115495
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9deba4c3b0813eb46dd241c20c0496e25c1d2fdaae397a7e14a04df5ccf28fa6
MD5 88316a9c59651fdb4beaa318a5d334ea
SHA1 ff05267290559c84a291ac1a8014848a984b35e0
SHA512 fb18e4d08ac515b603063b9ee6c400c3dd2a4c991677406ac41407ff7802429b7fd031bc83581599c632458f3b7dd30a45460a22d9c29667d4150e2a8d2dee51
MD5 SHA1 SHA512

Submit Download

svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBAACBCCABACBAAAAACBBAACCAAABBBBABBBBABBBAACCBBBBACB.exe
Size 19.3MB
SHA256 b9eaf77b0ba4fe90c145ab6061e8d9f3b7bef505e66ef208e9a42ac841d7be6a
MD5 73da1402093532217347c47614d921db
SHA1 6162039805cfed899029f08c6ad53b4144b6ad71
SHA512 fc7e25ae1eaa268c0932176b30b8db03f2250b50c2ebce69012f6d592f617778f5518c96dbba722b727d5b92c8a8484c94d862cd5674b06b6d71b6923a9c2526
SSDEEP 98304:ir6r6r0r6r6r0r6r6r0r6r6r0r6r6r0r6r6r0r6r6r0r6r6r0r6r6rI:H
TLSH
T1BE175B1F26F80076D96F8276D6D28266C670B43127225EEFA250C73D9F6B9D1A43DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4434b8b0e9e731c08e8a32eec7fc8b309685db73255b8d3fa1e95e063be768ac
MD5 392623077a55c9f40163db97ddc1c030
SHA1 23df8c705fd24fb0838e1d7e8c71dcde8bbb89c2
SHA512 c325510818bc0722c41741faed723f68f13a3abc5418c2c90a3e45c5c092d10f112b9a6ff193e5a3045bfca4a6f01a16aa0d8cc8549edc411c8d5215582431b6
TLSH
T1E511C850A8E6D8B7FD326CCB963B8AC20894279BAD54BA18230C411AB7DDD624D558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1716-0-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/1716-7-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/3420-33-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/3420-23-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/3732-81-0x00000000006B0000-0x00000000006D1000-memory.dmp

Download

memory/3892-79-0x0000000000950000-0x0000000000971000-memory.dmp

Download