2e2da34f56e37cf9af11eb2e6946ca156f7766f66847e935a3a5e2d145dea8e8

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe
Size 953KB
Sample260816-e1kk6azzaw
SHA256 2e2da34f56e37cf9af11eb2e6946ca156f7766f66847e935a3a5e2d145dea8e8
MD5 6754c9d0f367bbbd68f00810d4cb54ae
SHA1 f67394eab28af979d4feae59365875653eee66eb
SHA512 9fe49abbfa06b4d332105d0517888cfb63648535d3aff0d3d39f9fba625bb416a38c0b4604eecc43f4029f3cf1f3964fc0b4920151ca9b290047e36024c3c6e7
SSDEEP 24576:m9+EM0qd9+EM0qd9+EM0qd9+EM0qd9+EM0qd9+EM0qd9+EM0qd9+EM0qY:U+Ei+Ei+Ei+Ei+Ei+Ei+Ei+EB
TLSH
T1D5250909F94340B1DC2B51F04DCFE3FF8A60BB25C6124EF7FB4D8A5BA922BA15428559
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3224	svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe
4692	svchost_BACABBCABABCABBBABBBCBBABAACCAACBCCCAACBBCBCCCCBCAABCBA.exe
4584	svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCCCACCACABBBCBACCABBBBCCBBBABBCCAAACCCABBACCBCABBBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe"	2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBABCBBCBCCCBBBCCBBCBAABBBCACBCABBCAACBCABACCBCBAAACCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABBCABABCABBBABBBCBBABAACCAACBCCCAACBBCBCCCCBCAABCBA.exe"	svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1900	sc.exe
2556	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4588	cmd.exe
2064	cmd.exe
2432	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABBCABABCABBBABBBCBBABAACCAACBCCCAACBBCBCCCCBCAABCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1384	2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe
1384	2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe
1384	2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe
1384	2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe
3224	svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe
3224	svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe
3224	svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe
3224	svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1384	2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe
Token: SeDebugPrivilege	3224	svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 4588	1384	2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe	92
PID 4588 wrote to memory of 3152	4588	cmd.exe	94
PID 3224 wrote to memory of 3084	3224	svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe	95
PID 1384 wrote to memory of 2064	1384	2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe	96
PID 2064 wrote to memory of 1900	2064	cmd.exe	99
PID 1384 wrote to memory of 2432	1384	2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe	100
PID 2432 wrote to memory of 2556	2432	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_6754c9d0f367bbbd68f00810d4cb54ae_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBACACCBAABABBBACCCACCACBCCABCBCCAAAACCABBCAACCCCBACBCCBCCABACCCCCAAABABCCAAAAAABBBCACBCCAAACBCBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCBACACCBAABABBBACCCACCACBCCABCBCCAAAACCABBCAACCCCBACBCCBCCABACCCCCAAABABCCAAAAAABBBCACBCCAAACBCBACCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACAAABCBBCCACACBBABABABBBACBBACCAAACBCCCAACACAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe" start= auto displayName= "UserDataSvc_BACAAABCBBCCACACBBABABABBBACBBACCAAACBCCCAACACAAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2064
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACAAABCBBCCACACBBABABABBBACBBACCAAACBCCCAACACAAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe" start= auto displayName= "UserDataSvc_BACAAABCBBCCACACBBABABABBBACBBACCAAACBCCCAACACAAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACAAABCBBCCACACBBABABABBBACBBACCAAACBCCCAACACAAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2432
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACAAABCBBCCACACBBABABABBBACBBACCAAACBCCCAACACAAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3084

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBCABABCABBBABBBCBBABAACCAACBCCCAACBBCBCCCCBCAABCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBCABABCABBBABBBCBBABAACCAACBCCCAACBBCBCCCCBCAABCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe
1⤵
- Executes dropped EXE
PID:4584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a7fc9a4d44e2594fb0f5b50b62fbe821dc8c84f0e87e91c6a956b292c6d7a70
MD5 7672d9be1508187d9e20fdc0a08b35c8
SHA1 f2741ee15350be577af19bf229345c3c7c098d1f
SHA512 8cf4be21326ce175b46d77ad2f5c59fd8d0ec5a3d721af5eb49587b3e8cb3666c2767449a53ce771fae2a3b82097a7100ff0513ae2358e46404066c967470ead
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bea9916b3521e0775a510b5aaa4a523c867eaa394546665fb968859ca159fd70
MD5 8305c82e9662d80f7c83c39347247db3
SHA1 4bcdaa7d6c13ec6074edac7711dbe05d1ea657b9
SHA512 65f161d8d3aea3a03fd3fb6082e1a2aab6899512aa0a6c5b9b08be8d72f332dd81051fb8646633acb8dd94f29ff2562c9cef13d2209e99a113cc25eb0e8b7cdc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bdb6710136903837a86d38c2493a9d94cd8a52637da2ea21106074a8f594e8c2
MD5 3dc4eb46b95661f08f512b81f186ae9b
SHA1 9a88ac632a735d8830d50e43108a3ba6644e832e
SHA512 a4702c3b23393eb25971931a06b4cde1fa76e9b8b8694c33e61f68f5001679e0b2afaa9c237fe741d782594955ea3e8997f0e7d512a3b6839e9e8313c7cc834f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c97d9337359ad51bfe3f57f46a06488f99362ef9a7a9be660e50e1ed6ce1b4e
MD5 4a129605a67fafee5dac78ea247e3abc
SHA1 e5827dac734049a14256485d67ee37adfef9b85a
SHA512 c30cf8ea60e0b8b353f88a8884eaa74de7d76b669f52c44e4d1ae1a909b9288479bc855f59e156c66f5084fdc6e7e687f8a387c22cb2e552857e3a12a35152ab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7fc37f61cab7e096a0b0930d535aeac0b327b03936f57869277209eef050f448
MD5 14e7f5b72b4a05cd263ffa93cfaace4a
SHA1 47a5bfb56ed9ff745fa91223431cf0aff986d655
SHA512 ed970d4eda730308148f9a48afe2f17e52e61d35061fee4687e034549c9d453322c16dff0d1d25e145fb548036f297e4210ccaa675a55d990a768c6c24679133
MD5 SHA1 SHA512

Submit Download

svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAABBABCABABBBBBACACBCCBCAACCABCBACACBAABBABABCBACBA.exe
Size 953KB
SHA256 2e2da34f56e37cf9af11eb2e6946ca156f7766f66847e935a3a5e2d145dea8e8
MD5 6754c9d0f367bbbd68f00810d4cb54ae
SHA1 f67394eab28af979d4feae59365875653eee66eb
SHA512 9fe49abbfa06b4d332105d0517888cfb63648535d3aff0d3d39f9fba625bb416a38c0b4604eecc43f4029f3cf1f3964fc0b4920151ca9b290047e36024c3c6e7
SSDEEP 24576:m9+EM0qd9+EM0qd9+EM0qd9+EM0qd9+EM0qd9+EM0qd9+EM0qd9+EM0qY:U+Ei+Ei+Ei+Ei+Ei+Ei+Ei+EB
TLSH
T1D5250909F94340B1DC2B51F04DCFE3FF8A60BB25C6124EF7FB4D8A5BA922BA15428559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1384-0-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/1384-7-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/3224-24-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download

memory/3224-34-0x0000000000CA0000-0x0000000000CC1000-memory.dmp

Download