1b8afb9fb5a49d050ff156d24f28a0e2bf720ebcb6d7b58923af5b1e219e225a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 04:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe
Size 771KB
Sample260815-elhs1sen2w
SHA256 1b8afb9fb5a49d050ff156d24f28a0e2bf720ebcb6d7b58923af5b1e219e225a
MD5 49e01d778e728b8994bc3af843453f76
SHA1 ed257568a7001587370bf24463ad2a01ad7aea0f
SHA512 621e67b4bcfb1acdb41faf72653e96570138c05d7dbf4ff8e228f3047fa0bc3ceef2b1f2629fe9ab11504f8032ec2f093908692baee0447d0199f94d0f875d59
SSDEEP 24576:m9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0L:U+EP+EP+EP+EP+EP+EP+EP+EP+Ep
TLSH
T1ECF42A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2432	svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
4192	svchost_BCAACCAABABBAAABCCCCBABCBBBBABACBBBACACAAACCABCCBABBCBC.exe
712	svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCCBBABCABBAAAACAAAAABCAAACBACCCBCCCAAACABCCAACAABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe"	2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBAABCABBAABCACBAABAACCBABBBBBBACBCABBBBCBBBCCACCCABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACCAABABBAAABCCCCBABCBBBBABACBBBACACAAACCABCCBABBCBC.exe"	svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3284	sc.exe
5668	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1672	cmd.exe
6044	cmd.exe
4128	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACCAABABBAAABCCCCBABCBBBBABACBBBACACAAACCABCCBABBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1732	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4312	2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe
4312	2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe
4312	2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe
4312	2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe
2432	svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
2432	svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
2432	svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
2432	svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
4192	svchost_BCAACCAABABBAAABCCCCBABCBBBBABACBBBACACAAACCABCCBABBCBC.exe
4192	svchost_BCAACCAABABBAAABCCCCBABCBBBBABACBBBACACAAACCABCCBABBCBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe
Token: SeDebugPrivilege	2432	svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
Token: SeDebugPrivilege	4192	svchost_BCAACCAABABBAAABCCCCBABCBBBBABACBBBACACAAACCABCCBABBCBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4312 wrote to memory of 1672	4312	2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe	92
PID 1672 wrote to memory of 1732	1672	cmd.exe	94
PID 2432 wrote to memory of 424	2432	svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe	95
PID 4312 wrote to memory of 6044	4312	2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe	98
PID 6044 wrote to memory of 3284	6044	cmd.exe	100
PID 4312 wrote to memory of 4128	4312	2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe	101
PID 4128 wrote to memory of 5668	4128	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_49e01d778e728b8994bc3af843453f76_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBBABAACCCBCABACCACCABAAAACAABAABABCCCACACCBACABABBABABCCAACBCABCCCACCCABCCACAABBABCCAACBCACACABABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACBBABAACCCBCABACCACCABAAAACAABAABABCCCACACCBACABABBABABCCAACBCABCCCACCCABCCACAABBABCCAACBCACACABABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABCBABCCAAABCCBBABACAAAAACBCABCBBBBBAACAAABCCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe" start= auto displayName= "UserDataSvc_AAABCBABCCAAABCCBBABACAAAAACBCABCBBBBBAACAAABCCCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6044
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABCBABCCAAABCCBBABACAAAAACBCABCBBBBBAACAAABCCCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe" start= auto displayName= "UserDataSvc_AAABCBABCCAAABCCBBABACAAAAACBCABCBBBBBAACAAABCCCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABCBABCCAAABCCBBABACAAAAACBCABCBBBBBAACAAABCCCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABCBABCCAAABCCBBABACAAAAACBCABCBBBBBAACAAABCCCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCAABABBAAABCCCCBABCBBBBABACBBBACACAAACCABCCBABBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCAABABBAAABCCCCBABCBBBBABACBBBACACAAACCABCCBABBCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
1⤵
- Executes dropped EXE
PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ffa5d621dea2447e5fc96a0664a49bce15729bd4171ab243f399b33f909c2f7c
MD5 8d23d08a82aa6ecaa0a4fc270e5d2c49
SHA1 12cc9dc6c26e16de99733d81d62ddc67587612d3
SHA512 e930cb009920a0a894ba8fb9989ec987f2a50e3422a728054329d7cb07136d410e0374973cfbfdd54b0567dfaa634f861e0db788326140e30da513c4592be38f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6500879b302a398b08c68cb42b93302f33be7e5c901a52717b943c47a290efd
MD5 0dd62bfb8f84999977be8ea5f3b6aac9
SHA1 d4a5fa5a2077735cb46792d6066c4399f06ff1f9
SHA512 ded59315ea5bc801bfd99582b43c28bba7ff59e2ec06425ad0a6e712eb26c6d4b91bfa953ec487f3ca5de4d99bec088e70fa951a2c86752ba5179d3e2a2bb329
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c654c0245083b815a0879f1a31a5a0214f288d923471009457b91d60a23418b0
MD5 92666ea74c2eed8dcc9a0b3c3074b9db
SHA1 6c8c12fddfcff691b638c64253c461be20bbf7d6
SHA512 332e0ab3f9b67c599ce7446870b344020ab2f3b14d1bb77f48aef29a3f8acbacd93d5d2e56313cfcaf4c9df8d7cdfe85d2bb5ee44cc14648a12b22a20f2792b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 88a32dacc2314436d2a2c2a2fef929787fe17562358cf051d2842cde4a59f9b9
MD5 de3e1043620fcfb4fd6150b3b5c8de14
SHA1 4ee1689341999e121f54ef0bcff2c8f7889cd253
SHA512 f1b4fdf7b642cceca8e5b718cb26f6975e03b98af4ac499b7bdeb4caab0af77caf2bebb1818643036b26a234f8469cb0675889f8ef3af6a7e032e3c6d8dc01a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a4ea571eb02cd3236610346508ee840aa6f4ea83e658ede1fa8ba78626df3491
MD5 669bb79c1dd08a2198aea47c3167e35d
SHA1 cfbe0a4e2cb7a5fb89df5f0f46fb17e78cd9b289
SHA512 3293f30d847c0e93c0ea6da03e79388e04b9ec4140aac21b2c8b253fa30fe3377689278be5988c8d499b86c8961fd660c39b454262cb1ffc6a008e87880639a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 31b2ee0e675e6083f2abd4141ad19ef741146f4c8b56c0694251f98eadba3759
MD5 795a56e2cc87cdb411c06902e60826fd
SHA1 60f9ea72c901cef15ddb968a881b05bfb468f424
SHA512 0f4e30b40179652d664439d49dff5d75466be9a24b9f9258dec8b66b5644b64efe9bd2c4ea1fc79b02adbd1880a8bfc4d14e3a59eed7b0e25cb335cd6c45fedf
MD5 SHA1 SHA512

Submit Download

svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABABCBACCCCAABACCBCCABCBAAAACABACBBABBBBCCCBBCBAABCAC.exe
Size 771KB
SHA256 1b8afb9fb5a49d050ff156d24f28a0e2bf720ebcb6d7b58923af5b1e219e225a
MD5 49e01d778e728b8994bc3af843453f76
SHA1 ed257568a7001587370bf24463ad2a01ad7aea0f
SHA512 621e67b4bcfb1acdb41faf72653e96570138c05d7dbf4ff8e228f3047fa0bc3ceef2b1f2629fe9ab11504f8032ec2f093908692baee0447d0199f94d0f875d59
SSDEEP 24576:m9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0n9+EM0L:U+EP+EP+EP+EP+EP+EP+EP+EP+Ep
TLSH
T1ECF42A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ae9d9b2d9eb709fba74eb6a6d42593b49f20d7a431490f6324e2cd70a7847fd6
MD5 c139e5b8631e35cbb9596a75fec9c615
SHA1 05919ed36aac0b0bee385b5bc0bb21cdf960325f
SHA512 67b5e5464797d8434b620023e2a81d316373389755fd539aac51c4d4dc3bee5802567d2b45f6400fe8ab55b60089d515b3d602d74f7debf054bcd16367e1c756
TLSH
T1AB11E92198A5CC63FD3338CB8A29DB930CB83E9B5C5C5F5413490218B789D319D594D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2432-33-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/2432-23-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download

memory/4192-79-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/4312-7-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download

memory/4312-0-0x0000000000AC0000-0x0000000000AE1000-memory.dmp

Download