f59b6425f68da32be49f6ce8d4cdc06010563b46c1fdb365753c0326d32592f3

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe
Size 688KB
Sample260827-hd4bjayvbs
SHA256 f59b6425f68da32be49f6ce8d4cdc06010563b46c1fdb365753c0326d32592f3
MD5 e23b36a2af04fb8a891bd01a7be322a6
SHA1 60cf3f7b9fcd19e42e5e1b44eaf33a81f4d829da
SHA512 70388f0d148693cf1fd6ec2813bf6486056207ec863982f3f274c7d74c83e96e4de4d974c064a857844f8ee920daff3cccd66e28ea121007c452e9df8f39a189
SSDEEP 12288:mgUFgEsnojAGgUFgEsnojAGgUFgEsnojAGgUFgEsnojAGgUFgEsnojAGgUFgEsnb:m9+EM0t9+EM0t9+EM0t9+EM0t9+EM0tU
TLSH
T168E41B0AF94744B2D92F51B00CCFE3BF8A60BB25C4128E76FB4ECB5BB936B215819155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4480	svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
436	svchost_AAAACCAABAACABCACCAAACACCBBCABBCBABACAAACCACCAACACBAAAA.exe
1736	svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBAAABCCABBBCBCBABBABBBBBAAABBBCAACBCABBBAAAABBCBBABBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe"	2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABAACCCCBAAABCACBCBABABBACAABCABCCABBABABBCCACBCBCCBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACCAABAACABCACCAAACACCBBCABBCBABACAAACCACCAACACBAAAA.exe"	svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1100	sc.exe
4440	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3268	cmd.exe
3052	cmd.exe
2236	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAACCAABAACABCACCAAACACCBBCABBCBABACAAACCACCAACACBAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4164	2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe
4164	2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe
4164	2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe
4164	2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe
4480	svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
4480	svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
4480	svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
4480	svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
436	svchost_AAAACCAABAACABCACCAAACACCBBCABBCBABACAAACCACCAACACBAAAA.exe
436	svchost_AAAACCAABAACABCACCAAACACCBBCABBCBABACAAACCACCAACACBAAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe
Token: SeDebugPrivilege	4480	svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
Token: SeDebugPrivilege	436	svchost_AAAACCAABAACABCACCAAACACCBBCABBCBABACAAACCACCAACACBAAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2800	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 3268	4164	2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe	95
PID 3268 wrote to memory of 1036	3268	cmd.exe	97
PID 4480 wrote to memory of 4532	4480	svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe	99
PID 4532 wrote to memory of 2584	4532	notepad.exe	100
PID 4164 wrote to memory of 3052	4164	2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe	104
PID 3052 wrote to memory of 1100	3052	cmd.exe	106
PID 4164 wrote to memory of 2236	4164	2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe	107
PID 2236 wrote to memory of 4440	2236	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_e23b36a2af04fb8a891bd01a7be322a6_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACBCACACCBBCBCCCBBABBBCBBCACACABBCCAABACACAACBCCABBCABBAABCAAAABCBBAABCCACBCCACABBAACBAAAACABACBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCACBCACACCBBCBCCCBBABBBCBBCACACABBCCAABACACAACBCCABBCABBAABCAAAABCBBAABCCACBCCACABBAACBAAAACABACBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAACBBABCBABBBCCBBCBCCCCBCABABCBABBACACBBCCBCCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe" start= auto displayName= "UserDataSvc_CBAACBBABCBABBBCCBBCBCCCCBCABABCBABBACACBBCCBCCCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAACBBABCBABBBCCBBCBCCCCBCABABCBABBACACBBCCBCCCABA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe" start= auto displayName= "UserDataSvc_CBAACBBABCBABBBCCBBCBCCCCBCABABCBABBACACBBCCBCCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAACBBABCBABBBCCBBCBCCCCBCABABCBABBACACBBCCBCCCABA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2236
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAACBBABCBABBBCCBBCBCCCCBCABABCBABBACACBBCCBCCCABA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4532
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2584

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAABAACABCACCAAACACCBBCABBCBABACAAACCACCAACACBAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAABAACABCACCAAACACCBBCABBCBABACAAACCACCAACACBAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
1⤵
- Executes dropped EXE
PID:1736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcdc65142f4a30105e835e9fca7addd754ef82eded80f4ca911bd7798234bc08
MD5 6a5f32074e1a260642173adc3e2506ff
SHA1 f47627656121f9e3b93edb38b6b218d8477225f1
SHA512 22b4e56c3d72dfa32ec3471e56fc52da5aa98d5213d0d70cbaa3bfd8d9087ded18a8a8e3992462163294e40f2f961a8f49dbb2e36cf50a90f39422cf56294902
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3338ba91617dcd97d9baa797a6c9ba8280e9a42c647b22a2251143c0288d6970
MD5 2c135e3d412af1a1dd01621123040c10
SHA1 fb7b29c3c716deeeedbdcbc64c0a247e3c4f96d2
SHA512 166577662100e013f5aced2291170a24e2bdcd40c5f7b4eae8ce999025f33282ce636413c64210e278db3bac802fa07eab46cbbd5c5d40d742ead9d324bff844
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8a88a2ef141152ea450553e32390024e00b60a69d8a9aba780bac3a8cbb37d72
MD5 2e56ab8c907288370e4990f6ecdcfb71
SHA1 ca9fb16a1e36098662e3cf808b161e132f46176b
SHA512 2e1b01a79927df5102e4533ce679b4df9a7c2bab8028bdf3973f9b97f83fe7a4a90fd77075df92912200c7181d4f5968a60806b3b7e3e113a70e8b9ebdf4f841
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f5eda41db6c0129372ff6a6e778b61894ef76834cae906970b5f9b80bec570e5
MD5 af5e286e2b6b7151878a8aa50bf06f8a
SHA1 e9eb64385254e4bbf7b9cff32e1b9052ed827753
SHA512 3737a9794289b57a89e5e2d8f8ad4acf06640893e9a9a644278f80cbc43ab474a4e9971493ab600094fe316ed4c1d029e448616ad7ad0fa0730e367d4600702c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 01a5250b6d26035aab0afba55f451d6e12fbd21c56be6974d60319cbc29223b6
MD5 807d142d9367945a83d83271433fbdb2
SHA1 aeab72c1cb581427003c535a03a7158eccb78ef6
SHA512 6afd1c81c35dafc8d0a6d330a6705973706cba1fba25b883d8439ea370a5091b78128842c26ac53175a6a2301af0739833d042c6247ec5b67de0be25a551c9eb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7baa922f13460bc328499b36848eebd5cc8ed1efd52af94c617b4837c490f54f
MD5 a0f0ee60f35d5975caefdce7f7e4df1e
SHA1 89fd485a2e41b30a72263a4c6607d6152976834a
SHA512 7d9f3b5d06a0da5f60bdde0c2f5e3a828eb0733eaedfcf9ef66c83daa664810720f0c45690059aecc0c0adada91b6b4a03973600f11b9555e005f5f2048a4367
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 96ed64676742a48e22dba88ef0a31dde8555e2f587968bf41ead811021992ca5
MD5 152af8ceb9ed7e5e0c94ef8bf078cfb6
SHA1 8d415985b0b72c3bbb53f4076d16362bc815f985
SHA512 af5a0d86b504f71fa62c429a73bf02f00aaa24e5bd4cd748f4721cc0eb1e35fe0c01f15dfad8c267c818192a71cc5e37ff9968eef1a99facdc6dd91c2d7c1336
MD5 SHA1 SHA512

Submit Download

svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBACAAAACCACAABBBABACBCABACCCABCAAABBBCBAAACBCCCAAABC.exe
Size 688KB
SHA256 f59b6425f68da32be49f6ce8d4cdc06010563b46c1fdb365753c0326d32592f3
MD5 e23b36a2af04fb8a891bd01a7be322a6
SHA1 60cf3f7b9fcd19e42e5e1b44eaf33a81f4d829da
SHA512 70388f0d148693cf1fd6ec2813bf6486056207ec863982f3f274c7d74c83e96e4de4d974c064a857844f8ee920daff3cccd66e28ea121007c452e9df8f39a189
SSDEEP 12288:mgUFgEsnojAGgUFgEsnojAGgUFgEsnojAGgUFgEsnojAGgUFgEsnojAGgUFgEsnb:m9+EM0t9+EM0t9+EM0t9+EM0t9+EM0tU
TLSH
T168E41B0AF94744B2D92F51B00CCFE3BF8A60BB25C4128E76FB4ECB5BB936B215819155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 f000a12519b9071b00c3752358c6efd81d5f19d391aebb4b9e521ad24346220e
MD5 749f87a6ea779aa778055031cbff5d08
SHA1 e60022bf3f3ab0758822276e339992531372f648
SHA512 323a26c88233e99aa8531ef7845c2e7b64653d5c3f7714815591d5c17338c228f2f59c0cbc20f7fd1c7d9ebc539a4f7530b2ca78d2c67a4847175a894cb24cbb
TLSH
T14201F9B091F5ED27FB336CCB91196AC22CF276CFAC549A382304831C77898258D55CD6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/436-82-0x00000000000E0000-0x0000000000101000-memory.dmp

Download

memory/4164-0-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4164-8-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/4480-37-0x00000000004C0000-0x00000000004E1000-memory.dmp

Download

memory/4532-61-0x0000000005690000-0x0000000005691000-memory.dmp

Download