dcc544313a586b09f4557f28fbe881352f8597645b29b779c0cfa233f64f3195

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
Size 40.8MB
Sample260819-e1sa1adm9w
SHA256 dcc544313a586b09f4557f28fbe881352f8597645b29b779c0cfa233f64f3195
MD5 c725b067cd6a58bb3bc0072e4a26d2b0
SHA1 7fadff8a810cb1f413ef45471e40e8201e39d5c4
SHA512 cfa0960f182f994314a31b7b465600a2803c86a71b4389ffb10ff14f866960bd2d2366683f9f961301dc2031023137b38de228c34c3987b4321617f3e912a698
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+EQ:P
TLSH
T14A971A09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5BA923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
516	svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
4180	svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
2284	svchost_BBCAABACAABAAABAAAACCCCCBABCCBCAACCCABBACCBACABBBCCBBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCACABCAAABCCBBABBCBBBBAAACACACCABCACCBABAACCCBCABBBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe"	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACAABABCCACBCCBAACBACBCACABBABCAABAABAABAABBBAAACAABABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCAABACAABAAABAAAACCCCCBABCCBCAACCCABBACCBACABBBCCBBCC.exe"	svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1856	sc.exe
1928	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2324	cmd.exe
2552	cmd.exe
408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCAABACAABAAABAAAACCCCCBABCCBCAACCCABBACCBACABBBCCBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1292	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
64	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
64	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
64	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
64	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
516	svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
516	svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
516	svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
516	svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	64	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
Token: SeDebugPrivilege	516	svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4392	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 2324	64	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe	107
PID 2324 wrote to memory of 1292	2324	cmd.exe	109
PID 64 wrote to memory of 2552	64	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe	115
PID 2552 wrote to memory of 1856	2552	cmd.exe	117
PID 64 wrote to memory of 408	64	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe	118
PID 408 wrote to memory of 1928	408	cmd.exe	120
PID 516 wrote to memory of 2512	516	svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe	122
PID 2512 wrote to memory of 444	2512	notepad.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:64
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCAACCAAABCABCBCBAAACCBACAACCCCCBCBABCACABABAABBABBBCBCCCAAAABBBCBCCAAACBBBABACCACAABCBBCACCBBCAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2324
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCAACCAAABCABCBCBAAACCBACAACCCCCBCBABCACABABAABBABBBCBCCCAAAABBBCBCCAAACBBBABACCACAABCBBCACCBBCAAAACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1292
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABCACCCACCBBCCAAACBCCBCCACBBCBCABACCBBABBAABCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe" start= auto displayName= "UserDataSvc_BABCACCCACCBBCCAAACBCCBCCACBBCBCABACCBBABBAABCBCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2552
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABCACCCACCBBCCAAACBCCBCCACBBCBCABACCBBABBAABCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe" start= auto displayName= "UserDataSvc_BABCACCCACCBBCCAAACBCCBCCACBBCBCABACCBBABBAABCBCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABCACCCACCBBCCAAACBCCBCCACBBCBCABACCBBABBAABCBCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABCACCCACCBBCCAAACBCCBCCACBBCBCABACCBBABBAABCBCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1928

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:516
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2512
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
1⤵
- Executes dropped EXE
PID:4180

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABACAABAAABAAAACCCCCBABCCBCAACCCABBACCBACABBBCCBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABACAABAAABAAAACCCCCBABCCBCAACCCABBACCBACABBBCCBBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 afe97b8d376fc849e047bc2a4505886ac778a8e2aefbcbe52e0b3552fdd8ad24
MD5 e53e3d58a93f360a2dad4d9f1480957a
SHA1 611d68f0645a3009c0c675513dd4b40305d0dfa1
SHA512 162b5aaec5d21041eb8c27dae8dcfd880f7127ad459e046d9140df61914acc0a260e7d7a3d1b693238ba3938cf4c1a4818b55a1aa9675078e96864aa2156db08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9d33b29239b361150d12737a0b214b92480294f38f827303c880effb2a40212
MD5 183edc761efb099ed91f8ec469188233
SHA1 ae2868221598f68d0fb889a93de9a07c74290f60
SHA512 5532d14a14ecba9668c94078cd30c042c890eff645d7021d51661353ca982f5518277fbb136fdb5efdba8360cbd747f6b601166200e073022f501842d702917d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a94f914b2e9e1b1dfeb7f7d14959a9383328e6665a4e359a154fcaf41da27033
MD5 1a0e8bddfc8765c7a0bed58f3cfa5f71
SHA1 330cb124765a2ac3e1243bcd02b71767f5b1af7b
SHA512 3b219630ec9204a6baf525f532da9530ae45d85b3b1780cd1cc86f080aa25b045ece3423b023f2f745e08dbe4a437c0c70dc73a886f25b04caf0bbffe7dd13c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 551fea3be6ef886b6502b52be501e75e52ead7af7472f10d848ddafa23b6a98c
MD5 c3d939f62e511f78bbd5d36e40991a43
SHA1 085d26c61f6ff9725fa0f97ad58691528536620b
SHA512 6c9cb41573e01cf8aba047b9ed684d7aa70e633cdd8811718df3eb9398bf4d610131b04e00ebb6d83d02854669a9b015f3700add36776f80a0961a00bf411698
MD5 SHA1 SHA512

Submit Download

svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCBBBCABBACACBBABCAABACBACBABCAABABCBCABBACCCACAA.exe
Size 40.8MB
SHA256 dcc544313a586b09f4557f28fbe881352f8597645b29b779c0cfa233f64f3195
MD5 c725b067cd6a58bb3bc0072e4a26d2b0
SHA1 7fadff8a810cb1f413ef45471e40e8201e39d5c4
SHA512 cfa0960f182f994314a31b7b465600a2803c86a71b4389ffb10ff14f866960bd2d2366683f9f961301dc2031023137b38de228c34c3987b4321617f3e912a698
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+EQ:P
TLSH
T14A971A09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5BA923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BBCAABACAABAAABAAAACCCCCBABCCBCAACCCABBACCBACABBBCCBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABACAABAAABAAAACCCCCBABCCBCAACCCABBACCBACABBBCCBBCC.exe
Size 35.9MB
SHA256 a6272f023dff716d29a5a0207d6e7df0ec9e6a9d93c80d2c6c7a690f0c00bb61
MD5 681ac78e60173f9c13361c37b31ae5fb
SHA1 0c8cd92593c3bc642acdb8bda890ba0bd4ba6bbe
SHA512 c2d7b61e3120ac8577a68a9a7113a811568ffaa6dfc190dcede4a6a5cb7b0c0764ced90143e943bae86706459d2c4a402317d40aebb6f8c9751ba99174813559
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+Ex:4
TLSH
T147871A09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5BA923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BBCAABACAABAAABAAAACCCCCBABCCBCAACCCABBACCBACABBBCCBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCAABACAABAAABAAAACCCCCBABCCBCAACCCABBACCBACABBBCCBBCC.exe
Size 35.6MB
SHA256 c87e6d2779749345f010be9b655661c59d16f48682701dd3867c817bcac50353
MD5 7a804583407f1cb9d812bbc3ed187d63
SHA1 4a1c9b3816b57496beb691691b9fc6353ab11196
SHA512 68f68ca9693b6353130d13c673761a520857462a07e586dd3ee8d7a4aacb343de7fd8b6b3a9fe9d43ab4b673f77fb942541040e368997a266cf36c404a67dafe
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+Ei:n
TLSH
T15D871A09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5BA923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/64-37-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/64-0-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/64-24-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/64-63-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/64-11-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/64-88-0x0000000000480000-0x00000000004A1000-memory.dmp

Download

memory/516-36-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/516-81-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/516-61-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/516-53-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/2512-89-0x0000000002500000-0x0000000002501000-memory.dmp

Download

memory/4180-96-0x00000000003F0000-0x0000000000411000-memory.dmp

Download