263fa3c058460716f5c2d2e46a5790ab5f61325ca9e3b699561eedee06b958dc

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe
Size 6.2MB
Sample260814-dr36gatthy
SHA256 263fa3c058460716f5c2d2e46a5790ab5f61325ca9e3b699561eedee06b958dc
MD5 c8da2f575b6de88e1032b7223ada4a95
SHA1 f1228c335f6a063e0615282394d8f85d0ded6b6b
SHA512 d5f3ea7f473bed36a3ad32f85651a78b4610183963975b3ec0cd15e17e3c1eed1fe17a108a9e937a24dce1618e5b1cc35bad38a10f77fd538768ce236cd66db8
SSDEEP 49152:U+E5+E5+E5+E5+E5+E4+E5+E5+E5+E5+E5+E4+E5+E5+E5+E5+E5+E4+E5+E5+ER:t
TLSH
T141665C09F94340B5DA2B50B04DDFD2BF8660BA2587128DF7FBCD8A5B6823BA07539315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2536	svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
4660	svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
3324	svchost_CCAAACAACBBAAAACCAACBBBABCBACABBCCCBBBAAAAABAABCBBCCAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBCBCBACCCBBAACAABBBCCABBCAAACBCBBACBABCBCCBBAACCBCCACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe"	2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCABAACACAABBABACCBBBBCBABCAABCBAABCAAABCCCAAACBBABBABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAAACAACBBAAAACCAACBBBABCBACABBCCCBBBAAAAABAABCBBCCAAA.exe"	svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2564	sc.exe
176	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
420	cmd.exe
1480	cmd.exe
1280	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAAACAACBBAAAACCAACBBBABCBACABBCCCBBBAAAAABAABCBBCCAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3436	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4348	2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe
4348	2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe
4348	2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe
4348	2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe
2536	svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
2536	svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
2536	svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
2536	svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4348	2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe
Token: SeDebugPrivilege	2536	svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4120	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 420	4348	2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe	100
PID 420 wrote to memory of 3436	420	cmd.exe	102
PID 2536 wrote to memory of 2308	2536	svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe	106
PID 2308 wrote to memory of 1612	2308	notepad.exe	107
PID 4348 wrote to memory of 1480	4348	2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe	109
PID 1480 wrote to memory of 2564	1480	cmd.exe	111
PID 4348 wrote to memory of 1280	4348	2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe	112
PID 1280 wrote to memory of 176	1280	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_c8da2f575b6de88e1032b7223ada4a95_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCACACCBBBBACBCCCBABBBAABBCAAABBCBABCCAAAAACACBCCBBCCAABBCCACBCBCBBBACBAAAACACBCABCAACABACBBAAABBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCACACCBBBBACBCCCBABBBAABBCAAABBCBABCCAAAAACACBCCBBCCAABBCCACBCBCBBBACBAAAACACBCABCAACABACBBAAABBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3436
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCCBCCCBAABBBCCACABBCCBABAAACACBCAABACCCBABAACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe" start= auto displayName= "UserDataSvc_BBBCCBCCCBAABBBCCACABBCCBABAAACACBCAABACCCBABAACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1480
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCCBCCCBAABBBCCACABBCCBABAAACACBCAABACCCBABAACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe" start= auto displayName= "UserDataSvc_BBBCCBCCCBAABBBCCACABBCCBABAAACACBCAABACCCBABAACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCCBCCCBAABBBCCACABBCCBABAAACACBCAABACCCBABAACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1280
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCCBCCCBAABBBCCACABBCCBABAAACACBCAABACCCBABAACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:176

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1612

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4120

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
1⤵
- Executes dropped EXE
PID:4660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACAACBBAAAACCAACBBBABCBACABBCCCBBBAAAAABAABCBBCCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAAACAACBBAAAACCAACBBBABCBACABBCCCBBBAAAAABAABCBBCCAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ac944e92a988b6e4ef77f5938910de999d5c7fe97659f365588223eb9891c7a6
MD5 c183ce168e124858140ffa40a7dd9616
SHA1 56c1884e9a2b476abafd0113b0ef08202f424ab4
SHA512 20f3a8fe2bf95b8ec1b1c1bf18ea774c11f797d734363dba7bed96a35539cc52bc1f3b91c5d149a90054a075a54533bd96c8f49a5d033ab06ed7af4610a9f175
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 13e66c0fdf106e1013e30ac82f4f7675aa0e721efad89dd125bf1fa4b9d99569
MD5 f195eccac7e6766140d9623a14d0670f
SHA1 07f44ea55749b4eaa9e625b544c0d0845e4d4c2b
SHA512 39c4219c8576e8a3b46dcc8bc4adb653cb501ed3f4ea6cd6aa43924f56866b8870177361a27643a93514e35e5919abd4ecef5cb386d94af74b444c1ba5711ef6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d52dd9b46f1622a22102dea7f21cafa16b64552c1b8c83e5b75f2faf007f5c8b
MD5 2e743ea012edf460f5a0adff73e86d6a
SHA1 2bdf52f37bfda06e6285f028fe28d42807f1db4e
SHA512 c13561cc32223d8a85f5c351fd1abdd01e032643317acb469b3e1727f35e6152a20abf235b2c7505430b8aebcde9012b48ef1360d777953c3250314ed7a817e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4fe44663b504a57929db35a1b8b50e062edcdc36f39d2ed2d52bd9f37c32ef4b
MD5 e881213d075fe329f807a0545c20ac92
SHA1 ee98084caf8e9112050725202876b948285db5e0
SHA512 c8c5866cfdf5dc0fed97f7b31ab64d45b71bb7141cd95b02d86c43bef6f4372ada2aa8686c3f64634773bd48c3cc1b316121799539f9c9f031d576c7d166a935
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5f4af64783501415731e3fb3a4c560a072f369cf6888d4d1502404b1a5d2702b
MD5 5483e0cf9df1f4f4400f243821f52646
SHA1 c6da4c3ab9dcc1e00fc7ec545331bb8a65389610
SHA512 09c7d6fa016b06e73a4f8601c2a98eec329cb155e509e7f97e6a201898c301947c7d8e149afcf10bbec7b7c4689e9447cff6120352bf6452c20edaa1a9f5e48a
MD5 SHA1 SHA512

Submit Download

svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBABABBACCCBABAAABBCBCBBBCCACACACCCCBBCCBABBAABBABCBC.exe
Size 6.2MB
SHA256 263fa3c058460716f5c2d2e46a5790ab5f61325ca9e3b699561eedee06b958dc
MD5 c8da2f575b6de88e1032b7223ada4a95
SHA1 f1228c335f6a063e0615282394d8f85d0ded6b6b
SHA512 d5f3ea7f473bed36a3ad32f85651a78b4610183963975b3ec0cd15e17e3c1eed1fe17a108a9e937a24dce1618e5b1cc35bad38a10f77fd538768ce236cd66db8
SSDEEP 49152:U+E5+E5+E5+E5+E5+E4+E5+E5+E5+E5+E5+E4+E5+E5+E5+E5+E5+E4+E5+E5+ER:t
TLSH
T141665C09F94340B5DA2B50B04DDFD2BF8660BA2587128DF7FBCD8A5B6823BA07539315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2308-60-0x0000000005360000-0x0000000005361000-memory.dmp

Download

memory/2536-39-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/2536-26-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/3324-80-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/4348-0-0x0000000000150000-0x0000000000171000-memory.dmp

Download

memory/4348-7-0x0000000000150000-0x0000000000171000-memory.dmp

Download

memory/4660-75-0x0000000000790000-0x00000000007B1000-memory.dmp

Download