26a2c523dc0987c3f723eb6234f924bc1fe5f48fde15ebcfa9d5f7978cd3adaa

Analysis

max time kernel
149s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
Size 991KB
Sample260814-d589msfa28
SHA256 26a2c523dc0987c3f723eb6234f924bc1fe5f48fde15ebcfa9d5f7978cd3adaa
MD5 a49de439406f4fb1ee412fe94acc73a5
SHA1 dc80c16f9d87c06f34ed82c43b2a31debeeeaded
SHA512 3170a853a3ff18c16af108ca3117b5fcb2c2ab825677602100d99d9bd5742d06e924e7e7212a57d38ac485ed8e528ce61776fcd9df75fbdd5f3873a5db0a40b4
SSDEEP 24576:m9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0O/:U+E7+E7+E7+E7+E7+E7+E7+E7+E2
TLSH
T17D250909F94344B2DD2A50F04CCFE3BF8A60BB2586124EF7FB4DCA5BB522FA15428559
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3716	svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
3984	svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
5116	svchost_AAACBACCCABCBBCABBCCCAAACACBBCCCCCBBABABCBAACABAABACBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACBAAABCACAAACCBCCBAACABABABCCAABAAAABBACBACBBCBCAABBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACBACCCABCBBCABBCCCAAACACBBCCCCCBBABABCBAACABAABACBBB.exe"	svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCBABBACCCABCCCBACACBCBBABACAABAABACACBABACABACCABCBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe"	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4184	sc.exe
912	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4304	cmd.exe
1476	cmd.exe
4072	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACBACCCABCBBCABBCCCAAACACBBCCCCCBBABABCBAACABAABACBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4868	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4380	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
4380	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
4380	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
4380	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
3716	svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
3716	svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
3716	svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
3716	svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
5116	svchost_AAACBACCCABCBBCABBCCCAAACACBBCCCCCBBABABCBAACABAABACBBB.exe
5116	svchost_AAACBACCCABCBBCABBCCCAAACACBBCCCCCBBABABCBAACABAABACBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4380	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
Token: SeDebugPrivilege	3716	svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
Token: SeDebugPrivilege	5116	svchost_AAACBACCCABCBBCABBCCCAAACACBBCCCCCBBABABCBAACABAABACBBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2724	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 4304	4380	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe	101
PID 4304 wrote to memory of 4868	4304	cmd.exe	103
PID 3716 wrote to memory of 3400	3716	svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe	105
PID 4380 wrote to memory of 1476	4380	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe	106
PID 1476 wrote to memory of 4184	1476	cmd.exe	108
PID 4380 wrote to memory of 4072	4380	2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe	109
PID 4072 wrote to memory of 912	4072	cmd.exe	111
PID 3400 wrote to memory of 1264	3400	notepad.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_a49de439406f4fb1ee412fe94acc73a5_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACACCCABABAABBABCCCCBACBBBAABCAAABBCAAACCBACCBCBACBCABBBBBCABCACBCBCCABCACBCCABCBBCCBACBBABCBACBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAACACCCABABAABBABCCCCBACBBBAABCAAABBCAAACCBACCBCBACBCABBBBBCABCACBCBCCABCACBCCABCBBCCBACBBABCBACBCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBCABCAACBCAABBCBAABABBCABBABABCCAACCAACACBBBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe" start= auto displayName= "UserDataSvc_ACBBCABCAACBCAABBCBAABABBCABBABABCCAACCAACACBBBBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBCABCAACBCAABBCBAABABBCABBABABCCAACCAACACBBBBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe" start= auto displayName= "UserDataSvc_ACBBCABCAACBCAABBCBAABABBCABBABABCCAACCAACACBBBBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4184
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBCABCAACBCAABBCBAABABBCABBABABCCAACCAACACBBBBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4072
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBCABCAACBCAABBCBAABABBCABBABABCCAACCAACACBBBBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3716
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
1⤵
- Executes dropped EXE
PID:3984

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBACCCABCBBCABBCCCAAACACBBCCCCCBBABABCBAACABAABACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACBACCCABCBBCABBCCCAAACACBBCCCCCBBABABCBAACABAABACBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 37515587a958fae2e58d909949e4f9391b6aba85f073e3548feac7ae7ef50795
MD5 08caeb417fa6a2f617123d6cfb074688
SHA1 6d7cfb7590da124d61b82b3c73dc86bbe78c90ee
SHA512 97cef0feb83ad1f9d747ed3f61cc8e761a1103e3e075b471c682773f7a499aab9facba38ceb82fce8b3109c1ba6ecadd7b761b64131bb0faaa00cbf83fcd1469
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c38cb6d166f891b9112892d32e3900f051355e9e629d0b43f6e0f7f8157fdfae
MD5 982e7dcb75db7d13490dc7b2305a566d
SHA1 8c6d6c27d566d66422a1266a019ad380bba60dda
SHA512 2457669571267867512006347a99e03d3d33af17b2953fc30a9081d14c804824637b30546cdf224bd7db1922642914f494a0007556898d930f4c05fb93b5f10e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e609db98bbfd181f4403e772762d91ebed0311e395e6838c07bfd4bbafb8d95
MD5 4668fb23b2258ffbdd9febd62af7086c
SHA1 5e2200b0ee04868c826affee99d0cfba96ec0d29
SHA512 49af2545ab0c0b7ba417b0040517cb04aaf1f379068776017bf0afc9b5c6bc4585d992af4ccd0598df7481dc02480375933ea097293fcdcbe8014637915c7a98
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 92f748a07f01739e6a658b47f5aaacc9a4310fe0c026522f2e93499da4faa7db
MD5 2adadef14b2995a5a2242b1cf856f628
SHA1 5ce483e82c67a270f1ed3f2271b73a5a0c0a9c98
SHA512 ee9459538cdff0a6fc241d997e17936fb8bd36fcbc600729ad49940853b28c931c586179136f45c0f3ee6599dc2a66dd1cedb57b7f38fdd87d9d309e90369b8f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6d643e662c9f433da546e2737845fc7c8da09a023c6e531522a0897cb1221d83
MD5 3b0e2c200558bb53ff7c801d1f93b31b
SHA1 3d61d2eb73e66794cc3b0b087e9cc63ecb70e0ea
SHA512 cdfc1a624a637a3f986ab866e2afc6c418eae3eb270f42b20d73850d297d509622194a93bc7213d72dbda33f9791e00fb2bc347f46b2ce6efc42b3e66d2a2d58
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f47bf8532fc642b2953cf8fb70858a6b71f67e3dc4d390a5679e219e22b52ff2
MD5 0bc14c95ebfe34e16c8220dd0c7be156
SHA1 8df763369467f635f82346dac2d5cd608850d3ea
SHA512 3d5e83ecbad18e9f42eb955f060783ed6a2ef746d532cf51bbb9265ce2e76dc38ec7a2a29bac0c72c8977e4a73c8b071f8b5a69613d57a294f11bc891ad4a2f2
MD5 SHA1 SHA512

Submit Download

svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCACCBABBCCCBCBBBABBCAAACAAABAABBBCBACBACBCCBACCBAAAAC.exe
Size 991KB
SHA256 26a2c523dc0987c3f723eb6234f924bc1fe5f48fde15ebcfa9d5f7978cd3adaa
MD5 a49de439406f4fb1ee412fe94acc73a5
SHA1 dc80c16f9d87c06f34ed82c43b2a31debeeeaded
SHA512 3170a853a3ff18c16af108ca3117b5fcb2c2ab825677602100d99d9bd5742d06e924e7e7212a57d38ac485ed8e528ce61776fcd9df75fbdd5f3873a5db0a40b4
SSDEEP 24576:m9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0OE9+EM0O/:U+E7+E7+E7+E7+E7+E7+E7+E7+E2
TLSH
T17D250909F94344B2DD2A50F04CCFE3BF8A60BB2586124EF7FB4DCA5BB522FA15428559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 7f46b5cefa270d061b0d17c5f8f0c765b49ae22ef848ccda98e2eaa7e70e595c
MD5 07ab46747ce2bec9d01a397de4676c79
SHA1 39aa485af351f4c29b977af775113962a57d99c5
SHA512 60e796f761617c022f620fa4b36489dd81530261e7ff91a35bf2c0bd0af8b1ea7d9b21c8549c1b147120d10b103c75338272ee10cff67828765f7ef6b33d8fe4
TLSH
T11A1108A1B4E5D833FC33B8DB522A8B820CB4739FA95CAA25130942286B95C328D154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3400-66-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/3716-38-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/3716-25-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/3984-74-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/4380-6-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/5116-89-0x0000000000380000-0x00000000003A1000-memory.dmp

Download