dcc544313a586b09f4557f28fbe881352f8597645b29b779c0cfa233f64f3195

Analysis

max time kernel
149s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
Size 40.8MB
Sample260819-e1sa1adm9w
SHA256 dcc544313a586b09f4557f28fbe881352f8597645b29b779c0cfa233f64f3195
MD5 c725b067cd6a58bb3bc0072e4a26d2b0
SHA1 7fadff8a810cb1f413ef45471e40e8201e39d5c4
SHA512 cfa0960f182f994314a31b7b465600a2803c86a71b4389ffb10ff14f866960bd2d2366683f9f961301dc2031023137b38de228c34c3987b4321617f3e912a698
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+EQ:P
TLSH
T14A971A09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5BA923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2068	svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe
5888	svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCCABBBBBABBACBCBBCBACBCABBACBBABACBCCAACCAABBACACACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe"	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3252	sc.exe
4184	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2732	cmd.exe
4480	cmd.exe
6076	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4980	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2880	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
2880	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
2880	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
2880	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
2068	svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe
2068	svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2880	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
Token: SeDebugPrivilege	2068	svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 2732	2880	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe	92
PID 2732 wrote to memory of 4980	2732	cmd.exe	94
PID 2880 wrote to memory of 4480	2880	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe	95
PID 4480 wrote to memory of 3252	4480	cmd.exe	97
PID 2880 wrote to memory of 6076	2880	2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe	98
PID 6076 wrote to memory of 4184	6076	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c725b067cd6a58bb3bc0072e4a26d2b0_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCBCBCBBCCBABBACCCBACCCBCACBCCCCBBBAABAACACBBBBACBCCBCACCACACBAACCAACCBAAAAABABAACACCCCCBCAACCACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACCBCBCBBCCBABBACCCBACCCBCACBCCCCBBBAABAACACBBBBACBCCBCACCACACBAACCAACCBAAAAABABAACACCCCCBCAACCACCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCAAACACCCCACACACBBCCACBACBAACCCBCCBCCACBCBBBACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe" start= auto displayName= "UserDataSvc_CABCAAACACCCCACACACBBCCACBACBAACCCBCCBCCACBCBBBACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4480
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCAAACACCCCACACACBBCCACBACBAACCCBCCBCCACBCBBBACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe" start= auto displayName= "UserDataSvc_CABCAAACACCCCACACACBBCCACBACBAACCCBCCBCCACBCBBBACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCAAACACCCCACACACBBCCACBACBAACCCBCCBCCACBCBBBACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCAAACACCCCACACACBBCCACBACBAACCCBCCBCCACBCBBBACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe
1⤵
- Executes dropped EXE
PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4206f8d773a73c503d5078090ff352a2126ac1c956c08089eba90bfdfc38e6c5
MD5 0260c5192ebf3f7054c5ee6e64c6bba7
SHA1 fee75d10a99196bdc5b129497c26eaedb64ccf01
SHA512 6505c572b6af0f4ab0eed6fc09ba6e2b14c8bafa96ec717bb83bdeb1dc2c070cd9138068c852c523022130ef7595c34ac0031aa0fea2db06b3ef839b61f95185
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 da450c3337c87b67a8564623103bffb93860b57844a8c33a6d014ff13441627b
MD5 10a6195ebc1bc70882a835c387074e04
SHA1 bd580655ef4271c57b7ad4f203a27fb215f6accb
SHA512 885921950518d3842cccec48cc4d40f9dcaed7f1ba8fa753d1692bfe9a5bcd38acee9bd2b97c4b254d79f512382b1297d87c8adfb1c90f93062cb420d06bbeb8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1d2db9aef861a5e8e8aa014326014cf33e52d8bb5676e5905f1cc206f27db8e0
MD5 759c094b7c06cd618db194e8247ae79a
SHA1 fd7f2ce726075bcd9728dbf276578119d3bfc7cc
SHA512 88d43e0d835da7cac0efaba405c215d64f35c4f56c95a7ed2fee3ea199055ab05019859a01c9c34f70e98b16a9fd3f4727e618c2469f1c243f331f002f194a59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9874ce7c342dbf49e07b1bccafbc4ff3a30e737fef0606069db61c9fef4956d5
MD5 c17b2a4f98cdf4649f8173bacc4dd1be
SHA1 fb1278218d2577b2bfa27ada850e7096000147e9
SHA512 eb4716ae091de897d1367ce8052a3e939fef9cfcd55d0cc565ca7c95334d6660c04d76b2316585aebcdcaf982beeb8b89c2440795d04d75b8d953f37493f139a
MD5 SHA1 SHA512

Submit Download

svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe
Size 40.8MB
SHA256 dcc544313a586b09f4557f28fbe881352f8597645b29b779c0cfa233f64f3195
MD5 c725b067cd6a58bb3bc0072e4a26d2b0
SHA1 7fadff8a810cb1f413ef45471e40e8201e39d5c4
SHA512 cfa0960f182f994314a31b7b465600a2803c86a71b4389ffb10ff14f866960bd2d2366683f9f961301dc2031023137b38de228c34c3987b4321617f3e912a698
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+EQ:P
TLSH
T14A971A09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5BA923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABCCBCBACCBACBCBABBAACACBACAACCCBBBCAAACCCACAABAABA.exe
Size 25.0MB
SHA256 ac3ec06dcb1924746e3a6d2831c28c4f05c73c8a9bcb1d4517b4960615bfa6bb
MD5 9174b97d2caed33d83c16a9b51f93d9e
SHA1 e95b96543867dd5af9e1f8863cca13943d76119a
SHA512 54e64e8769456c34ed15abcc01c04c8f33fa249c18bcf7e53b00a20ed4902e2c14487f6aa9b9cde35b42aecfab56dce2bb57b9d71d6d532467be7118b46fe9a3
SSDEEP 49152:U+ES+E8+ES+ES+ES+E7+ES+ES+ES+E0+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+EO:n
TLSH
T132471A09F94340B1D92B51B04DCFE3BF8A60BB25C6128DF7FB4DCB5BA923BA16428155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2068-25-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/2068-38-0x00000000004E0000-0x0000000000501000-memory.dmp

Download

memory/2880-0-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download

memory/2880-8-0x0000000000BE0000-0x0000000000C01000-memory.dmp

Download