0aa911dfc11023a0281cd0c1a4c9cb507969525cfe288e4f354720b21d014701

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe
Size 15.6MB
Sample260816-gsfcks1clb
SHA256 0aa911dfc11023a0281cd0c1a4c9cb507969525cfe288e4f354720b21d014701
MD5 f941e8af897fe0dbb41b6f81be4f01e7
SHA1 9e1f01dc6edd5217a9b9f554cae198ea4b010444
SHA512 dae28d832371eed2834531a7b2a83cc46e3088f92167167a100cba4d46610de6ee0765e97c07e1dad886fbaf539e0d2f7ce0df809e27a508d3865006226abdfd
SSDEEP 49152:U+ES+ES+ES+Ew+ES+ES+ES+EK+ES+ES+ES+ES+ES+EK+ES+ES+ES+ES+ES+EvZ+P:s
TLSH
T187F62A09FD4340B1D92B51B04DCFD3BF8A60BB2586128DF7FA4ECB5B6933BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5880	svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
1280	svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
1844	svchost_CBCCCBCCCACBACBAABCAABBBCACABBCBCCBCABBBCABCBAACCBCAACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBCBCBABCBBAACBABBACBCBBCCAABBCABABBACBCCBCCACCCCBCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe"	2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCCBBBBCACCBBCABBBCBCACCBCCCAABCABBCABCCACCBBAAAABCCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCCCBCCCACBACBAABCAABBBCACABBCBCCBCABBBCABCBAACCBCAACA.exe"	svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1916	sc.exe
1260	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1772	cmd.exe
4592	cmd.exe
3428	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCCCBCCCACBACBAABCAABBBCACABBCBCCBCABBBCABCBAACCBCAACA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3152	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4840	2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe
4840	2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe
4840	2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe
4840	2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe
5880	svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
5880	svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
5880	svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
5880	svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe
Token: SeDebugPrivilege	5880	svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 1772	4840	2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe	93
PID 1772 wrote to memory of 3152	1772	cmd.exe	95
PID 5880 wrote to memory of 5028	5880	svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe	96
PID 4840 wrote to memory of 4592	4840	2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe	97
PID 4592 wrote to memory of 1916	4592	cmd.exe	99
PID 4840 wrote to memory of 3428	4840	2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe	100
PID 3428 wrote to memory of 1260	3428	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f941e8af897fe0dbb41b6f81be4f01e7_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCCCBCACCCBBCCBABBBCBCBCCCBAACBCAACACBBCBAAABCACCBBCCCABAABABBBAACABBAABCBAABCCCABBACCCABCBBBAABCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCCCCBCACCCBBCCBABBBCBCBCCCBAACBCAACACBBCBAAABCACCBBCCCABAABABBBAACABBAABCBAABCCCABBACCCABCBBBAABCBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3152
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACAAACABCAABABBBCCCCBCACBAABBCBABAACCABACACCCCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe" start= auto displayName= "UserDataSvc_CBACAAACABCAABABBBCCCCBCACBAABBCBABAACCABACACCCCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACAAACABCAABABBBCCCCBCACBAABBCBABAACCABACACCCCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe" start= auto displayName= "UserDataSvc_CBACAAACABCAABABBBCCCCBCACBAABBCBABAACCABACACCCCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACAAACABCAABABBBCCCCBCACBAABBCBABAACCABACACCCCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3428
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACAAACABCAABABBBCCCCBCACBAABBCBABAACCABACACCCCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1260

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
1⤵
- Executes dropped EXE
PID:1280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCBCCCACBACBAABCAABBBCACABBCBCCBCABBBCABCBAACCBCAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCCCBCCCACBACBAABCAABBBCACABBCBCCBCABBBCABCBAACCBCAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5166881024f308736dc4e1f4b147cd1a28b51f0298ffd966cf21630a8b4f8d6b
MD5 91e983e90ad85c4ae6d90a619d2fd452
SHA1 7d4ff6de712bef7c8288e735fc62bcf763ddc69d
SHA512 cc1f1a70469a5713488217357e2743741066e71c21f0130355d5c2c94dd8a545c7fa6c6327fde0f119a447fb7875ba65ccda91acd13859879686b9fe16f22b3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b6040e06c2c5cc713888752cab8642fb265709ae26711a46fdae4b4aadcc1c77
MD5 dd0ee747cd580c5315edf30af6b98bba
SHA1 f049de2b3e89848b7033445cb3bc9aa290eb7369
SHA512 39a7167328a36fe4f1c311cc43665e403a8ca32ba0be765b98107e8e07dbd3093e83863c346793df677b82beaaec7edb28e94520b74a77be472a0d85194ef507
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f6c7f0c69dff3acef00df5d2ba12ce5d6dbc1dac070f3a1c9a78482e67540388
MD5 ab33934b7791500114f17b4601b52515
SHA1 869d5fc5a5d3c7369e9c1715d2b48b8baf1a61c6
SHA512 36146e4f41419b7aeca15118e44a52e2d05961044d935e96e6791f680ff46144cc91e98f720db30190d2720f4027f300854f4cdbc3a885417cee6b75c800daee
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bd5f491226bf4b65e6214d93cea4f1a43c8804b443f7859b258cd6f5f4a60922
MD5 e1e619dbe8066762929c58f839d3d662
SHA1 13c28321f654b4a1ff794a2f0167edca499f9b29
SHA512 c6b3c08d633b6080fbfb9ebf5ef144353fe5e5cebfa1df65df4f1856e5c15eedbb4884aca427153e0b9261d665a7be397b5b94f919e31c7bb34e05869a716768
MD5 SHA1 SHA512

Submit Download

svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCCBBCCBCBACBBCCBABBBCCBCAACABBBAABBCBACBBCCCCAAABAA.exe
Size 15.6MB
SHA256 0aa911dfc11023a0281cd0c1a4c9cb507969525cfe288e4f354720b21d014701
MD5 f941e8af897fe0dbb41b6f81be4f01e7
SHA1 9e1f01dc6edd5217a9b9f554cae198ea4b010444
SHA512 dae28d832371eed2834531a7b2a83cc46e3088f92167167a100cba4d46610de6ee0765e97c07e1dad886fbaf539e0d2f7ce0df809e27a508d3865006226abdfd
SSDEEP 49152:U+ES+ES+ES+Ew+ES+ES+ES+EK+ES+ES+ES+ES+ES+EK+ES+ES+ES+ES+ES+EvZ+P:s
TLSH
T187F62A09FD4340B1D92B51B04DCFD3BF8A60BB2586128DF7FA4ECB5B6933BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4840-0-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/4840-7-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/5880-24-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download

memory/5880-37-0x0000000000E70000-0x0000000000E91000-memory.dmp

Download