72275be3400107185256826f128544915283e2040ded2a9139e6f8bbaf8a391b

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe
Size 2.0MB
Sample260816-e5fsrszzfz
SHA256 72275be3400107185256826f128544915283e2040ded2a9139e6f8bbaf8a391b
MD5 5a58a07c44babe74fc820c8b97f9fc2b
SHA1 f3c0983607fbf6b04ea9ef1920edfe52fcaa8058
SHA512 278c9bf18c2c77920d747616bb80a10aa94f6ed79297f5e80b2c523ae220e344fe90143ec34afa40dd16658861914e65bf3154a5db84080d08b9f0bb80e978c2
SSDEEP 49152:U+E1v+E1v+E1v+E1v+E1v+E1v+E1v+E1o:p
TLSH
T1EF951502EADD54A9F4B382709DBB817A9531FD258B12C9EFF244834E5833BD09E75722
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4696	svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
4252	svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
2624	svchost_ABACACBBCAACACBCAABCCAABCBACBACBCBCBAACCBABAAACABABCBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABCABBBCCBCCCCCACCAABACCBBACAACBBAAAABACBABBBCCCCACCCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe"	2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBBBCCBBCCCBBCCABAAABBCCBBACAACCAABAABAACBBACABBBACBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACACBBCAACACBCAABCCAABCBACBACBCBCBAACCBABAAACABABCBAB.exe"	svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3960	sc.exe
2908	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2732	cmd.exe
2404	cmd.exe
3164	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACACBBCAACACBCAABCCAABCBACBACBCBCBAACCBABAAACABABCBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2964	2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe
2964	2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe
2964	2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe
2964	2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe
4696	svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
4696	svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
4696	svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
4696	svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2964	2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe
Token: SeDebugPrivilege	4696	svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5028	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2732	2964	2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe	98
PID 2732 wrote to memory of 612	2732	cmd.exe	100
PID 4696 wrote to memory of 4592	4696	svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe	101
PID 4592 wrote to memory of 4892	4592	notepad.exe	102
PID 2964 wrote to memory of 2404	2964	2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe	104
PID 2404 wrote to memory of 3960	2404	cmd.exe	106
PID 2964 wrote to memory of 3164	2964	2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_5a58a07c44babe74fc820c8b97f9fc2b_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBCBBCBACAAABBCACAACBCBCACACBCCBAACBBAACCBBBCCAACCCCBBCACABAACCBBCCCCCBCBAAABBCCCAABCBCCACBBBCCCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBBCBBCBACAAABBCACAACBCBCACACBCCBAACBBAACCBBBCCAACCCCBBCACABAACCBBCCCCCBCBAAABBCCCAABCBCCACBBBCCCBCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACAACCCABAACCABBBBBBBCAAABCBBCBACABAABBBAABAAAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe" start= auto displayName= "UserDataSvc_CACAACCCABAACCABBBBBBBCAAABCBBCBACABAABBBAABAAAACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACAACCCABAACCABBBBBBBCAAABCBBCBACABAABBBAABAAAACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe" start= auto displayName= "UserDataSvc_CACAACCCABAACCABBBBBBBCAAABCBBCBACABAABBBAABAAAACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACAACCCABAACCABBBBBBBCAAABCBBCBACABAABBBAABAAAACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:3164
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACAACCCABAACCABBBBBBBCAAABCBBCBACABAABBBAABAAAACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4892

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:5028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
1⤵
- Executes dropped EXE
PID:4252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACBBCAACACBCAABCCAABCBACBACBCBCBAACCBABAAACABABCBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACACBBCAACACBCAABCCAABCBACBACBCBCBAACCBABAAACABABCBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d708a237b02808755cd103efc988536e1562d8b1bbaf623dd809f6facdd8fe2f
MD5 8757f0b067301d97b8249f76889c3c36
SHA1 50ae9396851a67d2f512ffe1c17e94b7103fc279
SHA512 6a5d6c84bddc8d97a3b286c5f2d1e278274b5bf070e4446a117e08da313c065ee6872a5cfb225400bb80b9f29b974fbdced428428c4e21fa3064f00f90a7c24b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bf751046c073049979c0852937c2cde1aee1e5f57f4419a9ea03306ecdad3598
MD5 046d26087206553773027be24955cc86
SHA1 eb4366f7fcd25db36c42bf9637b39de5a2b9e067
SHA512 ab0c52fec41fa52c6bec2b787a1769a65b0d60c7e862a8dcc3a013f74acc409a1d74d8ee5229cae7b421e64dc00c21231776e0a6643b7ecbb5e1f9d3008f3911
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8ee2440aed5d6981ef6d69a1b2dd39d94943b276bd2808b0a47c9ff6814ce29a
MD5 df387f366190d7e07d9efaaf9cd98f2d
SHA1 fd2ad88be312ee5a888c5655807d3ebbe5f97050
SHA512 1e1e7c11e0629416ad14dca5fd16a93c3a43233819a186b59581d68c61baacc2b1cb95d0b4d5d47d7ab9f0ce15133bc751adb252425ea6ed6fb42479c09cfc83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8dbeb4fb77511b45acfda86e17daa34ea957f90932c4292b18748015664b8a9d
MD5 6237a34569c24e0b6f414a1a47a4ffb5
SHA1 f6b430f6873ccc3fa2962c94ec6b8c398aaf64f5
SHA512 9a33ee1a889091fb71db58b0809bcbc1b49e44a0bb0c99b8268e1815380c609a976a02bc33d903dd7fd7e2c9b1cb0dbf6c3c3f89b2df648748daf429c1d725b4
MD5 SHA1 SHA512

Submit Download

svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABABCCAACBBCABCCCBCBACAAABCBCABCBCBACBCABBBABCBCBABBA.exe
Size 2.0MB
SHA256 72275be3400107185256826f128544915283e2040ded2a9139e6f8bbaf8a391b
MD5 5a58a07c44babe74fc820c8b97f9fc2b
SHA1 f3c0983607fbf6b04ea9ef1920edfe52fcaa8058
SHA512 278c9bf18c2c77920d747616bb80a10aa94f6ed79297f5e80b2c523ae220e344fe90143ec34afa40dd16658861914e65bf3154a5db84080d08b9f0bb80e978c2
SSDEEP 49152:U+E1v+E1v+E1v+E1v+E1v+E1v+E1v+E1o:p
TLSH
T1EF951502EADD54A9F4B382709DBB817A9531FD258B12C9EFF244834E5833BD09E75722
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2964-0-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/2964-8-0x00000000009B0000-0x00000000009D1000-memory.dmp

Download

memory/4592-61-0x0000000004C50000-0x0000000004C51000-memory.dmp

Download

memory/4696-27-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/4696-37-0x0000000000910000-0x0000000000931000-memory.dmp

Download