a88f3b4d284a73ecbb4c04050d68511f1fe98fcfbabb392e83a95b702dd704ea

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe
Size 14.2MB
Sample260827-llk2psfp4s
SHA256 a88f3b4d284a73ecbb4c04050d68511f1fe98fcfbabb392e83a95b702dd704ea
MD5 bc86bcde0d40219b42db1ce0c066c8d5
SHA1 960792beff3d5192d3da9610d097508578b58604
SHA512 368110ddb3093bb89fe1ff8b8e3263b9da695b054fbb23dc7e37a20629fbd185367e88a1025e23d0adc82172943caacda4046df0f1ff63a39c8a9b32a367e8da
SSDEEP 393216:bhhh+hhh+hhh+hhh+hhh+hhh+hhh+hhh+hhhN:bhhh+hhh+hhh+hhh+hhh+hhh+hhh+hh8
TLSH
T1EBE6E109F94740B2D86B60F10DCFD3FF8A70BF2581124EB7FA5D9B5B7A23A616024166
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence spyware stealer

Malware Config

Signatures

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/files/0x000c00000001c543-20.dat	UPX
behavioral2/files/0x00080000000182ab-377.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
968	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
1912	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCCABBCCABCBAAACCCBBBBCBBCCBABBCAACACBBCCBCAACBBAACCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe"	2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCAAACCBAAAACABCBCBBBAABCBCCBCAACCBAABBABBCBCABAACABAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCBCABCCABBCBCABBAABCBCAAAACABBCBACAABBAABCACBBABCBAB.exe"	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1576	sc.exe
5000	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4964	cmd.exe
4720	cmd.exe
3972	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1592	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4388	2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe
4388	2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe
4388	2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe
4388	2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe
968	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
968	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
968	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
968	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
1912	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
1912	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4388	2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe
Token: SeDebugPrivilege	968	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
Token: SeDebugPrivilege	1912	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 4964	4388	2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe	92
PID 4964 wrote to memory of 1592	4964	cmd.exe	94
PID 4388 wrote to memory of 4720	4388	2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe	95
PID 4720 wrote to memory of 1576	4720	cmd.exe	97
PID 4388 wrote to memory of 3972	4388	2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe	98
PID 3972 wrote to memory of 5000	3972	cmd.exe	100
PID 968 wrote to memory of 3748	968	svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_bc86bcde0d40219b42db1ce0c066c8d5_coinminer_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCBCBCBBACAAABBAACBBCCCAACACABCBABCCABAAAAACCAABCCCBCCBABBABCABACCBBBCCACACAABBAABBBBAAAABAABABCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4964
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCBCBCBBACAAABBAACBBCCCAACACABCBABCCABAAAAACCAABCCCBCCBABBABCABACCBBBCCACACAABBAABBBBAAAABAABABCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBAACBAABCBCAAAABABCCCABAABBBCCCAACAACAACAAACCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe" start= auto displayName= "UserDataSvc_CCBAACBAABCBCAAAABABCCCABAABBBCCCAACAACAACAAACCCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBAACBAABCBCAAAABABCCCABAABBBCCCAACAACAACAAACCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe" start= auto displayName= "UserDataSvc_CCBAACBAABCBCAAAABABCCCABAABBBCCCAACAACAACAAACCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBAACBAABCBCAAAABABCCCABAABBBCCCAACAACAACAAACCCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3972
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBAACBAABCBCAAAABABCCCABAABBBCCCAACAACAACAAACCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3748

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 8deee8dde22e1f249893817fbd1f234783ecaf5098b6e845d95a558fee3969d5
MD5 221bcc1ab349dcf6dd581d61262d4075
SHA1 4ca7212c45aeb54295ce90be6be64f2ede3f0484
SHA512 eb405d884410f44af0733323fa993a469cf117447457fd9a2d51c751c04352860136ae55c13fe1e07f3fd7982f7a63e1096b876cd1060f0a4d11522b9bf04da9
MD5 SHA1 SHA512

Submit Download

windowsdesktop-runtime-8.0.15-win-x64.exe

Path C:\ProgramData\Package Cache\{5625bb48-295c-4113-bc92-d6a69b19b04c}\windowsdesktop-runtime-8.0.15-win-x64.exe
Size 10.0MB
SHA256 2b41546a29e080ae51518bbced28159f4a6b6b74068ca51e0d85410f23148169
MD5 e31119f692dfce3daef813b0467a807b
SHA1 f437ad912c06c64135b836a2ed306a196c6e6170
SHA512 2ec198fa48038ca9c669ebd1c17d6b8af695c32ea472274164ddaa76533b5bae79cea8965a92b96082e459dfb78cdbc069e9b99836af4cf4cb20b042f5b8ae84
SSDEEP 196608:bnhnhnhn+nhnhnhn+nhnhnhn+nhnhnhn+nhnhnhn+nhnhnhn+n8:bhhh+hhh+hhh+hhh+hhh+hhh+8
TLSH
T15AB6E109F94740B2D86B60F10DCFD3FF8A70BF2581124EB7FA5D9B5B7A23A616024265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\ProgramData\Package Cache\{6DB765A8-05AF-49A1-A71D-6F645EE3CE41}v14.30.30704\packages\qap`g`v~dtlq
Size 10B
SHA256 101e26a0bc13d36f087ed975b9acca42c64b1ebdb61edbf8201f1ce07de54ae6
MD5 cff3911663cf511209ca9e993cae2dbc
SHA1 b1bf58f990aa65cfd1e69b7f0874f8e7dd4112b5
SHA512 479479a6c507c5170a2d5c04153396df93543f82bfcdd48d3e9c623ea6392b7c0e257dd808e8160b739dc7cb97822da0d7359b4675a537efecfdb4c0b8006651
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5597758f480388e7ebd6dfc1c27190748062a2d149542d2ce81804b301ccdc84
MD5 9829c3012a0b2751ed9730ec1f3660f1
SHA1 a7da4292d3b541fb3e1252d80d64719d9cfee250
SHA512 648c0f8f9437a6a4b8398e7cac7bf92d8b86ccdab87a964ef8038a60ebe820b485aad7ed6a80a21b328e72baf4b6949a051764ce885d9e8dc070672ffe132e67
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 696003c9bef9700d9b154c62d422dfb75af211cdea73d99bbae397dabc82c307
MD5 f2fed1d7e31a8ceaa84c2f23ce765f0e
SHA1 72f64fdfbd5ece9d3d08d490e2cf01f223e87032
SHA512 c76a8e00e666c494c829375bc4dbbf7a0630c504996348ffbdd23b1e8f7e9a40e172fcbf9222fa3b9704d3d6cbbbb94e3034ea4cac1b842e22fc60f2c84ed377
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e77039d884cd92b3f731f9038c5362992ed180f930506dace14d4e9c546d081
MD5 c87144fbc7dd8ee148f9e79b803a329d
SHA1 c81f21fce8f2f839411951e31d706308eafd6bb9
SHA512 d00e763d6c0003eae63d7beb802f1b2ab9c62521ee65ac0acd37a85b9a4090f8c0c7e6d3396b2c0de14c1049c86c6cf1f9d6aa4745456589aa633e863966bb86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2e5cb33af6a76315271124ee591e73b56830ff70235fad507dc5b45a2210ce2a
MD5 6c81402f9812a0ca30ddf7fde12678e6
SHA1 ec3d2cc994fc7e41561a1475f0d9030cc4b62470
SHA512 ec5789e9d82a30d15584422e7de0722ba69a2d092b7f9b3cea80e07d49e3533229a25a75b7a0009db56379ae22b6148485084c0d64af348c9ba73fb98c5fd0e4
MD5 SHA1 SHA512

Submit Download

svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABCCACBAABBCCABABCBBAAAABCABBBCBCBBCCCCABACBCACACCAB.exe
Size 14.2MB
SHA256 a88f3b4d284a73ecbb4c04050d68511f1fe98fcfbabb392e83a95b702dd704ea
MD5 bc86bcde0d40219b42db1ce0c066c8d5
SHA1 960792beff3d5192d3da9610d097508578b58604
SHA512 368110ddb3093bb89fe1ff8b8e3263b9da695b054fbb23dc7e37a20629fbd185367e88a1025e23d0adc82172943caacda4046df0f1ff63a39c8a9b32a367e8da
SSDEEP 393216:bhhh+hhh+hhh+hhh+hhh+hhh+hhh+hhh+hhhN:bhhh+hhh+hhh+hhh+hhh+hhh+hhh+hh8
TLSH
T1EBE6E109F94740B2D86B60F10DCFD3FF8A70BF2581124EB7FA5D9B5B7A23A616024166
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 973100767ba8e10c37c38e1308161f24c93f0127ff71a6e2c9dad7a319af3fcd
MD5 f4175fb496cdfbdefe98c3cd67347b71
SHA1 42302bdafae06e8a568bb03f671f2001d153f8f4
SHA512 65a249ae5cbdb3e90ad8ba8d8e46b8d404c34fc10b1b970d5ef07440020cd5efc70b8223aff73ab46217deba9496e315316f92a3fc69823ce07a444a68cd5cc8
TLSH
T18C11E76290F5DC27F53268CB6225C9E21CA837DE6ADCAA1413084399A787C318E574F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 834B
SHA256 1c2828b488fc2489d8c7fce8c8fd8223656ecc9d9f15e80f61e711f2046ce4bf
MD5 1ed6f4d713daf5bc2ee2cc269e55a3d7
SHA1 9c29a401b66d9897165e9f22c1a1acd492501873
SHA512 ce374381b3b2caaf16fef19093bbd068467e81a28455bbe2db9a80f2a13bae0a70e3c05815fe744660167c8b08fd06bbb8575215b2589d82e9ba3d72631c466b
TLSH
T1BB01A56190F5CC67E53268CB6225C9E21CA837EE6ADCAA1013084699A7C7C318E574F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/968-36-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/968-24-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/4388-0-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/4388-8-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download