eac0df20f3d52f697336dc289128b9083e5cf0565413cf9bb5990edc3930e801

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 08:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe
Size 15.6MB
Sample260815-km7restsct
SHA256 eac0df20f3d52f697336dc289128b9083e5cf0565413cf9bb5990edc3930e801
MD5 f3b2a67807b0135780496e467908be68
SHA1 5a2b5ea134653e5d29eb9ab7a3ec233c98b5377f
SHA512 f6c7ef667e28e97b8dcace18d0c34973cc606cc27fad908ed7a1141be2ee8533162da6965be21021cdec6a3eb45c89e9a99a2e17ef2a8dc56796db76441bf198
SSDEEP 49152:U+ES+ES+ES+ES+Ep+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+Eg:KW1PszZ
TLSH
T18DF63A09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5040	svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
1596	svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
5608	svchost_BBCABBCBABBAAABBBBCCBBABBACAABCCAAACCABCBBBCACABABBAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCCBCAAACACAABCACBCAAABBAAABBAACCAACCCACACABCACCBABBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCABBCBABBAAABBBBCCBBABBACAABCCAAACCABCBBBCACABABBAAAB.exe"	svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCBCCABABABBCBCACCCBCBABACBBCBCCCCCABAABBCBBBBCAAABACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe"	2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3664	sc.exe
5764	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3400	cmd.exe
2288	cmd.exe
1892	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCABBCBABBAAABBBBCCBBABBACAABCCAAACCABCBBBCACABABBAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3408	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5640	2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe
5640	2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe
5640	2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe
5640	2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe
5040	svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
5040	svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
5040	svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
5040	svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5640	2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe
Token: SeDebugPrivilege	5040	svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5640 wrote to memory of 2288	5640	2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe	92
PID 2288 wrote to memory of 3408	2288	cmd.exe	94
PID 5640 wrote to memory of 1892	5640	2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe	95
PID 1892 wrote to memory of 3664	1892	cmd.exe	97
PID 5640 wrote to memory of 3400	5640	2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe	98
PID 3400 wrote to memory of 5764	3400	cmd.exe	100
PID 5040 wrote to memory of 2172	5040	svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_f3b2a67807b0135780496e467908be68_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCBBCAABCABABBCACAAACBABAAABBABAACCCCCCAAABCCCBABCCBBCCBACABBBCAACBBACABACAABBACCACCACCCABABBAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCBBCAABCABABBCACAAACBABAAABBABAACCCCCCAAABCCCBABCCBBCCBACABBBCAACBBACABACAABBACCACCACCCABABBAAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACAACBCAABBBACCCCABCACBAAAABBBBBAABAABCBABBCBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe" start= auto displayName= "UserDataSvc_BAACAACBCAABBBACCCCABCACBAAAABBBBBAABAABCBABBCBCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACAACBCAABBBACCCCABCACBAAAABBBBBAABAABCBABBCBCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe" start= auto displayName= "UserDataSvc_BAACAACBCAABBBACCCCABCACBAAAABBBBBAABAABCBABBCBCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACAACBCAABBBACCCCABCACBAAAABBBBBAABAABCBABBCBCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3400
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACAACBCAABBBACCCCABCACBAAAABBBBBAABAABCBABBCBCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2172

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
1⤵
- Executes dropped EXE
PID:1596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBCBABBAAABBBBCCBBABBACAABCCAAACCABCBBBCACABABBAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCABBCBABBAAABBBBCCBBABBACAABCCAAACCABCBBBCACABABBAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 189b2113c433b8405f39bca2b6131af6f13bc1189754927961f906238be984b1
MD5 642f57a04ba84cc5ec085a55f23fcbbe
SHA1 69d6d75b8bca82ca9587cfabe822d2dfe796e3cf
SHA512 bfd1b576ab72c0c01fb814b8016e751f435439a52a0010e2e2518976a2d3d249ad8f64640b16458d730c3ed5a9c5de27c713ccc9c60c286cee9b246aaa2cb93d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 933c17fe26ea0762f609f20dcadedce99a5feccff84250d325c08ce5be501b59
MD5 579cf2076b271e93df2a87c5356138df
SHA1 29f4a084d0876d7c5523c2956fe4348899b8b78c
SHA512 b09b491964c2c51fb2b6d6c331710eb6b23e62c8b01b7c7487875f558a5fc4a2fc7a135eab1dc862a49cea307fae5ef52aea35f1998f8982e00bc01e01bcbe7e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 80da3d09347312e83975a91de7b81832a18afe69d28a109932026366b981c625
MD5 21b87f29cf4b8dbb948f2e13166f493e
SHA1 ff179615d0ab87c4adaa268f399c5658622dd258
SHA512 22552a74f021cc8847d134cb886b79f21603020e246b3e015249f65e86456fe092520e0b0bf21ca1c8584d1a1ba0fbefcb7eb259185cf59aea64329ae9ffe37a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a4a9919ea9a90c72aafbc3a1a458341e9538a7993ca6b3136960251c4fb07bbc
MD5 f8d90cc6fbd278dc3c81f5b2ab950953
SHA1 32143efa63aedc8f5b853e5b906291482b4ccd72
SHA512 93f8292ffdb865a1b6020f9dbf54eef4061e8431ba1c62426b05f13ce5021bfbfef5bd3f348a8a3bc465fa4d9e11f4d2050e3a644788ec67e276d818a06d7df5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1a6404a42a7870b972eb364780fef794cc39e6323a5b781ba759f809f96ec64a
MD5 4eca3a7af6c03bb71c609b5abfe30fa2
SHA1 ec05962eb7e0529269099fe089a693a8ca828e75
SHA512 d9f3862d36d32e966162a6a9ebe881ca49c8f8e7594003c52f9966047a64f76e0ff9409d3485b99dfa2e5972ae6d007418066787dcd1e10e769d90e752329de7
MD5 SHA1 SHA512

Submit Download

svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAACCBCABCCBBBBAACBCBBBACBCCCBBAAAACBBBCCCBBBCCBC.exe
Size 15.6MB
SHA256 eac0df20f3d52f697336dc289128b9083e5cf0565413cf9bb5990edc3930e801
MD5 f3b2a67807b0135780496e467908be68
SHA1 5a2b5ea134653e5d29eb9ab7a3ec233c98b5377f
SHA512 f6c7ef667e28e97b8dcace18d0c34973cc606cc27fad908ed7a1141be2ee8533162da6965be21021cdec6a3eb45c89e9a99a2e17ef2a8dc56796db76441bf198
SSDEEP 49152:U+ES+ES+ES+ES+Ep+ES+ES+ES+ES+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+Eg:KW1PszZ
TLSH
T18DF63A09FD4344B1D92B51B04DCFE3BF8A60BB2582128DF7FB4ECB5B6523BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-66-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/5040-22-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/5040-35-0x00000000006F0000-0x0000000000711000-memory.dmp

Download

memory/5608-72-0x0000000000920000-0x0000000000941000-memory.dmp

Download

memory/5640-6-0x0000000000DA0000-0x0000000000DC1000-memory.dmp

Download