14eb8883fe7e2d21f50990d0e0ceb540b46d2b8d2de6b8ea7833d7fa563f6203

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe
Size 16.9MB
Sample260815-hsvb6sgk7v
SHA256 14eb8883fe7e2d21f50990d0e0ceb540b46d2b8d2de6b8ea7833d7fa563f6203
MD5 fe304bb3188eb535fe88ca2fe6fdd31c
SHA1 659fde92afea9487033fe8dcc8e4ae7b0ac0ec44
SHA512 d8fd6bd27f67eb2eecbb3a27501947e93f6e1b2bb50ffa02614f9c1a51ed72a8634a75cae18480d05ff99e540cb6a9bd341b02f3be33600dd72356be5fc46cc3
SSDEEP 49152:U+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+EL:N
TLSH
T10E072A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1992	svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe
4912	svchost_ACBAABCCCABBBCABAACAAACAAACAABBABBCBCBCCABCCCBBACCCCBBB.exe
2732	svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCACABCBABCACAACACCCACBACBCCCAABCBCABCCCBBAACABCCCCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe"	2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBBBBAACBBBBACACACBACCBACBAABACBCCBCBABBCCACBCABAAABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBAABCCCABBBCABAACAAACAAACAABBABBCBCBCCABCCCBBACCCCBBB.exe"	svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6060	sc.exe
3200	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5688	cmd.exe
3016	cmd.exe
2332	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBAABCCCABBBCABAACAAACAAACAABBABBCBCBCCABCCCBBACCCCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5860	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3128	2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe
3128	2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe
3128	2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe
3128	2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe
1992	svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe
1992	svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe
1992	svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe
1992	svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3128	2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe
Token: SeDebugPrivilege	1992	svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 5688	3128	2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe	92
PID 5688 wrote to memory of 5860	5688	cmd.exe	94
PID 1992 wrote to memory of 1452	1992	svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe	95
PID 3128 wrote to memory of 3016	3128	2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe	98
PID 3016 wrote to memory of 6060	3016	cmd.exe	100
PID 3128 wrote to memory of 2332	3128	2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe	101
PID 2332 wrote to memory of 3200	2332	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_fe304bb3188eb535fe88ca2fe6fdd31c_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAACAAACCAAABBCBBABCABAAAABBACBCABCCCACBABBBBABACCABBCCBBBBBBCBCCBCCCCCACBBCABABAABBCABBBABCBCABABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBAACAAACCAAABBCBBABCABAAAABBACBCABCCCACBABBBBABACCABBCCBBBBBBCBCCBCCCCCACBBCABABAABBCABBBABCBCABABBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCAAAACABBBBABABBBAAAACACCCCBCCCCBABCCCABCCAACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe" start= auto displayName= "UserDataSvc_ACBCAAAACABBBBABABBBAAAACACCCCBCCCCBABCCCABCCAACABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCAAAACABBBBABABBBAAAACACCCCBCCCCBABCCCABCCAACABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe" start= auto displayName= "UserDataSvc_ACBCAAAACABBBBABABBBAAAACACCCCBCCCCBABCCCABCCAACABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCAAAACABBBBABABBBAAAACACCCCBCCCCBABCCCABCCAACABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2332
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCAAAACABBBBABABBBAAAACACCCCBCCCCBABCCCABCCAACABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3200

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABCCCABBBCABAACAAACAAACAABBABBCBCBCCABCCCBBACCCCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBAABCCCABBBCABAACAAACAAACAABBABBCBCBCCABCCCBBACCCCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe
1⤵
- Executes dropped EXE
PID:2732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e2b41730ee2d690bccb42eeb7c3d17a0e6aa5196696af2729ca9a9a6507b363
MD5 cf77f2a219c6f39da41d6f947fa41ea5
SHA1 496c6ef652f9941b0655126813b10c821988a794
SHA512 0875584fdba3b0e455cbcb49694460f22c30d10c66577cb413c529b3f2f9c64b4c1691ca3f258f951f795f557621afc25e3fa19e139ed36eb923b7f8ca9fa22a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59bb5704dbb994b6c8fce48976561a4c4d2164254704cca208b5255cd3d53975
MD5 5f926ffe66ae3658780b47a614667758
SHA1 2e71b3d16466204234656099d5a4a0de23229eb8
SHA512 8c743b49afeb1f7d866fa5115587059bb396e147ca7864a01c662a32518486d507219056c8a186136d32d2ee37617c39037349da8b4b7f8bbf0f36b27b3b23e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1f297adebd96703b1f81f3731d93753fdf081af7a47c778f94f97f23b8b79e63
MD5 00b6595cb55f4a1dfd7363ee5030f8b0
SHA1 af0905669f2618ba40fd27e93bc9d700602c8a3b
SHA512 07133fc66504ae2d0589bcc4ac641541c3bb8297853cb94b321c816db50a6e711037fa4ead2848f1a7165bdde79dc760a3daa2036dc08917c86bd28b645dfd9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed102048befb39ecb62a8491e675c23be323a87ad9f00fd3fcecd1eb9a750fb1
MD5 9b22acec068c68559ab130b9d66586e1
SHA1 c75f583e3f504fe7f7dd874dbc304a77111a04a1
SHA512 c597eefbdf1142dcc06802bfa088667d7eea0e23ade7dfd521cdcdd08c75576fb02475fdc741bd6237df68ecbe9438ff02c299228178c5e99bf5c5036c851337
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 328bd26a002c13137a9706f2d643a8e461b9ea3633c998370993fc34a5c33296
MD5 a67399a86b13a2128ed578edbfd1894f
SHA1 0f12daba0a1ca4da27691884264a2bf4ba593520
SHA512 2c66614118790895414972c290de762256d47bf5f8edff7b1e79142144c9b453f6db1e9081acf023da32da3232845b75a3bb4aacdc162107979ddd0722c9fde9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4461c95bbae544dfe2dae26b0811059c07278da929941f529774a4a1855c2205
MD5 8dc9cc1b0068a9145d290c4752f821dd
SHA1 8dd74a77d3f2038754b9b49c4fedbd4855edc2cf
SHA512 52cece9de14daee0b91e4dc42367dcd8df30ca5ae35de536cec0d2bb401f100435392ed739828e58f25cb78554b5290d6821cf81312b38505a69370bda998b00
MD5 SHA1 SHA512

Submit Download

svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBBABBBABBACCBCCBCAACCACBAABCAACCCACACACABBCBBABAAACAA.exe
Size 16.9MB
SHA256 14eb8883fe7e2d21f50990d0e0ceb540b46d2b8d2de6b8ea7833d7fa563f6203
MD5 fe304bb3188eb535fe88ca2fe6fdd31c
SHA1 659fde92afea9487033fe8dcc8e4ae7b0ac0ec44
SHA512 d8fd6bd27f67eb2eecbb3a27501947e93f6e1b2bb50ffa02614f9c1a51ed72a8634a75cae18480d05ff99e540cb6a9bd341b02f3be33600dd72356be5fc46cc3
SSDEEP 49152:U+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+EL:N
TLSH
T10E072A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1992-34-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/3128-0-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/3128-8-0x00000000009A0000-0x00000000009C1000-memory.dmp

Download

memory/4912-65-0x0000000000290000-0x00000000002B1000-memory.dmp

Download