1b2c59c7688d0fd67b2adae69692cc8e744dde5e586e3d1aec8c0119a1ed09cb

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 18:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
Size 845KB
Sample260814-xhmlxabd49
SHA256 1b2c59c7688d0fd67b2adae69692cc8e744dde5e586e3d1aec8c0119a1ed09cb
MD5 db222b31f5185b48da6685e91c3f97c9
SHA1 8873f2215bb90cd0bd0ffa26b5489665569758d5
SHA512 582108d7f59476e2eb721841a807649c335f794cc0153395b0bbaf4b5d8a915ea4464a1f70a88681b55d26c96ee938e1c87a58ebb5287efdc20c691f41c60157
SSDEEP 24576:m9+EM029+EM029+EM029+EM029+EM029+EM029+EM029+EM029+EM0z:U+Ei+Ei+Ei+Ei+Ei+Ei+Ei+Ei+Et
TLSH
T11D050A09F94340B1DD2B51B04DCFE3BF8A60AB25C6124DF7FB4ECB5BA523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3420	svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe
1088	svchost_AAABCBBACBCCABABACAABACCACAACCCCBAABACBBBCABBABCACCBACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABABBBABCCCCCBBACABBBAABCCAABACBAACCACACABCCBCABBCAABACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe"	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CABBACBABCAABCABBBAAACBBCACCCAAABAAACBAAAAABCACACAACAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCBBACBCCABABACAABACCACAACCCCBAABACBBBCABBABCACCBACA.exe"	svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCBBACBCCABABACAABACCACAACCCCBAABACBBBCABBABCACCBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4108	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4424	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
4424	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
4424	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
4424	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
3420	svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe
3420	svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe
3420	svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe
3420	svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
Token: SeDebugPrivilege	3420	svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3044	OpenWith.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 4716	4424	2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe	98
PID 4716 wrote to memory of 4108	4716	cmd.exe	100
PID 3420 wrote to memory of 1796	3420	svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe	101
PID 1796 wrote to memory of 1816	1796	notepad.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_db222b31f5185b48da6685e91c3f97c9_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBACABCABBBBABBCABABCBABCBCABBABBCCCBABABCACABAAABACBBABABACABCBBCBCCBAAACAAACAACCAABCBCCBCCCCABCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBACABCABBBBABBCABABCBABCBCABBABBCCCBABABCACABAAABACBBABABACABCBBCBCCBAAACAAACAACCAABCBCCBCCCCABCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3420
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1796
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1816

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBBACBCCABABACAABACCACAACCCCBAABACBBBCABBABCACCBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBBACBCCABABACAABACCACAACCCCBAABACBBBCABBABCACCBACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 249f8b36108a06909c4f3bb1eb138682392d19b940c80f849709c81e61bb50e9
MD5 f98f8f31dd4e2b9e4dfa4facaa2f66d2
SHA1 9cd28db29049f85e13864faea72a655e1f4dc81d
SHA512 655c2bf37442c5cfe0f8241e38a4ba6639c87bd4f90476d9295632cf7e646e0a99b180d2805c23c588a7012142e7e6ced2c1810fc533fc6ca9d9fce769037401
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8ac5727538b2b45dbb149716bb7a00546ae8b3607551822d440ad5afec56baaa
MD5 2e633b71cdb907d9b6ed54fc5984f73a
SHA1 1675eb12e6a8cecb8ec11ccc966c1274e6d729c9
SHA512 67475414c9ffb03092119ddffa196f87e7b906ef9fa2dea04da109f4e2d88ab2c78bae140a0cf83f5199959768a2f1eea83330620f6b6f4dcfceaa75c7cf8847
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 229cb59ad736832cf6168035b7d99eb555c92036d4b018e90416bbc879013509
MD5 417a0307ed863405638db7dff0968494
SHA1 c535dc3320e3e0f780e0daa528ec3dc4c090bd7e
SHA512 00ad488e814cc63872cd9c97f5ffa40bb29f1703a12a552cffae227cce5bcab99af3352dc13a30805717b2ff603bd4b1f5181dfa18caa163c2ed6fd6c64237b9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59ffe985837a16f414c33268ecc5bbe038e45cad5ef482998a8d4a06f31e4afd
MD5 6e06ca73851a8b5409ce26cf24923823
SHA1 e2fa95f5b5c18f74bce64713518ac95e46c7dd39
SHA512 e87e6e68f160a01735b8b9da9f071af2d30682ff6e4229b267d2fd7d8b20975f6520c82f70b0a2f71fb331962b2ca6a40c9b749d84c34ddbcb24a60f86a4dd01
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b1c3b03524b971d4abc2c35cd1afa32958e867f311f31fa54e94467038093f85
MD5 0f8422b40d4c311e9a4a9eb0633eb766
SHA1 1a4d8faa76d43221d6e4506a7b86720603c399aa
SHA512 de240ddec17b0ec2d4c882a71a76650e7c04e8ecb4e2582f74f15cd91841bbdbc2fc2c2bf7cb7caa89553caa0bfd875ec8ea9511690695c8c5f1718ef087524c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d8e40e6352b6a8f183bacfb33fd2914edd0395265f591e0ba2a9fe4a84764976
MD5 bf9369cbb9ec2bc774cd8ec4cea61ee9
SHA1 ac2df4a629d27b533d6ab3cdc128a4b773f60df7
SHA512 82ee824eee8ba728514ba5c937076b5742000b6ab56d7d5ded764fb5e97c5d9814d365f910f948d4d4c465f4625cdc61a86a7ec446f5fc8120219159d22d92f1
MD5 SHA1 SHA512

Submit Download

svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACCBBCACCBBCCABAAABACABACABABBBCBBACACBAAABCABACAAA.exe
Size 845KB
SHA256 1b2c59c7688d0fd67b2adae69692cc8e744dde5e586e3d1aec8c0119a1ed09cb
MD5 db222b31f5185b48da6685e91c3f97c9
SHA1 8873f2215bb90cd0bd0ffa26b5489665569758d5
SHA512 582108d7f59476e2eb721841a807649c335f794cc0153395b0bbaf4b5d8a915ea4464a1f70a88681b55d26c96ee938e1c87a58ebb5287efdc20c691f41c60157
SSDEEP 24576:m9+EM029+EM029+EM029+EM029+EM029+EM029+EM029+EM029+EM0z:U+Ei+Ei+Ei+Ei+Ei+Ei+Ei+Ei+Et
TLSH
T11D050A09F94340B1DD2B51B04DCFE3BF8A60AB25C6124DF7FB4ECB5BA523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-73-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/1796-61-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/3420-38-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/4424-0-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/4424-8-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download