dd4095938c6fb41f690b1de4cdaa2989f7d8e9c3c1a3e7fc54932875af124e32

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe
Size 19.9MB
Sample260816-pvywpsyscv
SHA256 dd4095938c6fb41f690b1de4cdaa2989f7d8e9c3c1a3e7fc54932875af124e32
MD5 e41f191a1b0e52ddec71347f0413010f
SHA1 f27424acbce4e3b15ac9bfedda4c2042d686c196
SHA512 72b02c81c98b1d1f3935b2fb7ea99d952ca79715349994d4804f088a2d62eb418fa9396309e8590dafff2f5d715a687a73c938dda90642bd86ab9ed124e8d79d
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+EP:H
TLSH
T1D8272A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2604	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
2852	svchost_CBBBCABBCCBCAAACACBBABCACCCCCBBBBAABACCCBBCCCACCABAACAA.exe
3444	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACCCCCCCBCCCACCCCABBACCCCABBBAABCBCBBACABBBBAAABAACAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe"	2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBACCBCBCACACCABCCBCCACCCACBCCCBABBBBBABCAABBCAACACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBCABBCCBCAAACACBBABCACCCCCBBBBAABACCCBBCCCACCABAACAA.exe"	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5432	sc.exe
4132	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5144	cmd.exe
1924	cmd.exe
2824	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBCABBCCBCAAACACBBABCACCCCCBBBBAABACCCBBCCCACCABAACAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3304	2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe
3304	2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe
3304	2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe
3304	2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe
2604	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
2604	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
2604	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
2604	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
2852	svchost_CBBBCABBCCBCAAACACBBABCACCCCCBBBBAABACCCBBCCCACCABAACAA.exe
2852	svchost_CBBBCABBCCBCAAACACBBABCACCCCCBBBBAABACCCBBCCCACCABAACAA.exe
3444	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
3444	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3304	2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe
Token: SeDebugPrivilege	2604	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
Token: SeDebugPrivilege	2852	svchost_CBBBCABBCCBCAAACACBBABCACCCCCBBBBAABACCCBBCCCACCABAACAA.exe
Token: SeDebugPrivilege	3444	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3304 wrote to memory of 5144	3304	2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe	91
PID 5144 wrote to memory of 1724	5144	cmd.exe	93
PID 2604 wrote to memory of 1772	2604	svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe	94
PID 3304 wrote to memory of 1924	3304	2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe	97
PID 1924 wrote to memory of 5432	1924	cmd.exe	99
PID 3304 wrote to memory of 2824	3304	2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe	100
PID 2824 wrote to memory of 4132	2824	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_e41f191a1b0e52ddec71347f0413010f_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3304
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCABABAAACCCABCBBBAACCAACAACBBAACAAACAAABBACCACACAABCCBABAABBACBACCBCABAAABABBBACBCCBBCBAABCCBACAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCABABAAACCCABCBBBAACCAACAACBBAACAAACAAABBACCACACAABCCBABAABBACBACCBCABAAABABBBACBCCBBCBAABCCBACAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCACBCABBBAAABABBBAACBBACBAABBABBABACAAAABABCCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe" start= auto displayName= "UserDataSvc_ACCACBCABBBAAABABBBAACBBACBAABBABBABACAAAABABCCAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCACBCABBBAAABABBBAACBBACBAABBABBABACAAAABABCCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe" start= auto displayName= "UserDataSvc_ACCACBCABBBAAABABBBAACBBACBAABBABBABACAAAABABCCAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCACBCABBBAAABABBBAACBBACBAABBABBABACAAAABABCCAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2824
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCACBCABBBAAABABBBAACBBACBAABBABBABACAAAABABCCAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1772

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCABBCCBCAAACACBBABCACCCCCBBBBAABACCCBBCCCACCABAACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBCABBCCBCAAACACBBABCACCCCCBBBBAABACCCBBCCCACCABAACAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 3ca4dd34679ba8558296fa5d84f3411af2bc40fbdba2440ddb8d58d77c9268fe
MD5 c667fe0ac6b4a4c7d47fa0b8023edb41
SHA1 416e9ecc1158ae143d6cc89c20b673711727f55e
SHA512 61e14a3f1b72be995bd06958dc27fe9ac19eeeed60784da320e0244fac000a7f0adb74bd303bd49720a6659c883a23f5779166b08e4bdf37b8f526c9865595fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57776c4b420b85916f06f060f8a4b8e6e91bad1af1f6992a950e482a66ed1e3a
MD5 d7c6b661b96d63c3febc99ca0e649111
SHA1 b7e38bd499c5678411e4de0d7f85cc390ef36240
SHA512 d1a654d611c351c573c5a7f4ccd38438ca02a2964e13c39472e372b9ab8d6483de32c14382119fca68f40ebc7175069447a32c9a5fc70d1f9ca0079971115500
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 581053d308a776c49c78604fb1b0084df571f638fb7fdffe505478727b1b5bc8
MD5 49a58edab518a729f452ce697b3464a7
SHA1 92a6205d194d48f3a9d3ae3d4ed116906a8bccaa
SHA512 abfb1b5dacf47c79e673dc401a4cf063e381856c69ac9db7c236da0240d53beab6883bf6981511d322bd7c60afe2b0521f211eca5f1c846cce2c814952f41e9b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3bb1601bb058226c40ec329cbe0915a5d2e682e97900028883436260782d4616
MD5 e806f45c689a5adbd144dd1ce5a92502
SHA1 c3534baa86a8fe771273e001ee4fc231a40c1131
SHA512 bd4e7fa25af27919a74c34041cc345c76d760612ddf076b31b73f2cc6746f6518249bf98d9f741a4f1dd83ac11094f11f1ac17ef6577ff1ab2066d02d781e305
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 27123493085def6fa2c71be6fc6af2598c63f4e1c793b27c8c8e341aeb420606
MD5 598c6388fe0080d0fd3b0d8830d1f9bb
SHA1 aa6ac7563eb474c0b163d7850d4a87de5bce46df
SHA512 9c7426c2d279a79bf715bc0946c6e7192038783b563c842f46a935c3bc43990ad432c39622302c835086880626e53ae8361825efa8604b68c69accbdf4b048af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c9530888b25dd44e6fe24201ac093f0663d0efb6305b58123ad8e9af114e93ac
MD5 f6a2ec1846ec9937278d7575dce1c8db
SHA1 1c5b2598d9fcc2cd37e8655744ca65e50032c943
SHA512 2d049a5fa7ccc3a3c67ac865cdb5ce51b8093c1ff20674e8f782178b42cafba4f16e5e9a292bb6b3fab7ed4e8012d2c089232b360ae757ba2db1e0607498594a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 cdb36749a9c076c9e7a417d47ed550ba33cd4094d7a7f76380925fd71308f9b7
MD5 8700313f8482fecf39cce8dee55983d8
SHA1 d80e15e4c9c928093f2cc9afd495543ed4824415
SHA512 f1657c3fbf52a06b69f447f82ebd33389abbe7676de09eb463ad19da42d86c47f11ff521ed6863bfc0aa59d5251f842bef5a870f792c9b38c4741b96ed2bf0e4
MD5 SHA1 SHA512

Submit Download

svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAAABACBAAAABCBCABBBBABAACCCCCCAABBABCABCBCBBACAABABBC.exe
Size 19.9MB
SHA256 dd4095938c6fb41f690b1de4cdaa2989f7d8e9c3c1a3e7fc54932875af124e32
MD5 e41f191a1b0e52ddec71347f0413010f
SHA1 f27424acbce4e3b15ac9bfedda4c2042d686c196
SHA512 72b02c81c98b1d1f3935b2fb7ea99d952ca79715349994d4804f088a2d62eb418fa9396309e8590dafff2f5d715a687a73c938dda90642bd86ab9ed124e8d79d
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+ES+ES+ES+Ee+EP:H
TLSH
T1D8272A09FD4344B1D92B51B04DCFE3BF8A60BB2582128EF7FB4ECB5B6523BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 84addc97cd61e558c9ef9e71f0a28390e94f8fda1b770078623101e795c3fc61
MD5 9956c2927cba5b9f6ae64f107993bb41
SHA1 efbff71d65ba5830cbf4bd0af950d63bdf3b2fb8
SHA512 47017a86a0dc2e7f07bf7bea94bcf8b445431ebb94b153dff474b85864aa4c219a7235f5b55a4861b505088dfc8472e5e42aacb7097a9c7727e03d7ab231e8ca
TLSH
T1E411E361E8F59813E97368DF553EDF830CA537AB5C9C6E542204451AB7A6C228E1D0E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 966B
SHA256 344de1e43f07156da2f35ce2ce97586ee5a65eccb3c8b63479e7f8a622e08f9a
MD5 ea493bc5dd20b35102f811fe3933823e
SHA1 81e2ecc4b2cdec7eda7f4f30f03bc42daf14aa01
SHA512 7c00f216e36dc458fec596d4d480c23b19571ce61efbc911fa6f139d50acdb64fb5221cd92a444eb8ee881c41d3e6e9159809fa247bea733c4a4a8f1135feb49
TLSH
T1C7112B61E8F59813EC7368DF513DDF830CF5376B5C9C6E442204451AB795C228E1D0E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2604-33-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2604-23-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2852-70-0x0000000000D50000-0x0000000000D71000-memory.dmp

Download

memory/3304-0-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3304-7-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/3444-72-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download