7a6c7033acf88d51f8e6b7323ab220d638bd6f193ca4108a85ad1e8bbf0ed10f

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
Size 2.5MB
Sample260830-2nkfysdf98
SHA256 7a6c7033acf88d51f8e6b7323ab220d638bd6f193ca4108a85ad1e8bbf0ed10f
MD5 ff4ebcd9909992f090514e4fbf9168ed
SHA1 a38655b9990af551eb105b25fa3e7b98f01d0314
SHA512 bc9bdeb4295acf128c56e82605eda3e337e21e3d557e41d6593409408c8a7fd6fd5029024106c18a736d2fc0d91694643f8afbdcbf9b4c47bda04a22fece1b3f
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+EG:b
TLSH
T169C55B09F9D748B2D97B51B00CDBE3BF4971BB2580258E6AFA4EC74FB823B505419392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2104	svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
2796	svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
4884	svchost_CBBABBBBBAACBCBAACAACBCCACCBCCCAAABBBBABCBCCCBCBACCCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACABACBAACCABBAACABCACBBBBBBBBBACCCBCABBBBCCCAACBAACCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe"	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABBAACBBCCBBABCBCBBBCABABACABBBACACCBBCBAAABACBCBCAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBABBBBBAACBCBAACAACBCCACCBCCCAAABBBBABCBCCCBCBACCCACA.exe"	svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4384	sc.exe
5684	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4968	cmd.exe
4632	cmd.exe
700	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBABBBBBAACBCBAACAACBCCACCBCCCAAABBBBABCBCCCBCBACCCACA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5312	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
5312	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
5312	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
5312	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
2104	svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
2104	svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
2104	svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
2104	svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
4884	svchost_CBBABBBBBAACBCBAACAACBCCACCBCCCAAABBBBABCBCCCBCBACCCACA.exe
4884	svchost_CBBABBBBBAACBCBAACAACBCCACCBCCCAAABBBBABCBCCCBCBACCCACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5312	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
Token: SeDebugPrivilege	2104	svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
Token: SeDebugPrivilege	4884	svchost_CBBABBBBBAACBCBAACAACBCCACCBCCCAAABBBBABCBCCCBCBACCCACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5312 wrote to memory of 4968	5312	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe	91
PID 4968 wrote to memory of 4828	4968	cmd.exe	93
PID 5312 wrote to memory of 4632	5312	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe	94
PID 4632 wrote to memory of 4384	4632	cmd.exe	96
PID 5312 wrote to memory of 700	5312	2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe	97
PID 700 wrote to memory of 5684	700	cmd.exe	99
PID 2104 wrote to memory of 4116	2104	svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_ff4ebcd9909992f090514e4fbf9168ed_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5312
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAACACBAAAACBABCCBBABABBBCBABBAABACAAABBBCAABCBBACCBACABCCAAAACBBCCAABBCAACCBABCBCCABABCBBACABCBCBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBAACACBAAAACBABCCBBABABBBCBABBAABACAAABBBCAABCBBACCBACABCCAAAACBBCCAABBCAACCBABCBCCABABCBBACABCBCBAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABABBABCCCCCBBBCBAACABACCBAAAACBCBAABBCAAACABCBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe" start= auto displayName= "UserDataSvc_ABABBABCCCCCBBBCBAACABACCBAAAACBCBAABBCAAACABCBAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4632
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABABBABCCCCCBBBCBAACABACCBAAAACBCBAABBCAAACABCBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe" start= auto displayName= "UserDataSvc_ABABBABCCCCCBBBCBAACABACCBAAAACBCBAABBCAAACABCBAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4384
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABABBABCCCCCBBBCBAACABACCBAAAACBCBAABBCAAACABCBAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABABBABCCCCCBBBCBAACABACCBAAAACBCBAABBCAAACABCBAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2104
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4116

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
1⤵
- Executes dropped EXE
PID:2796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBBBBAACBCBAACAACBCCACCBCCCAAABBBBABCBCCCBCBACCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBBBBAACBCBAACAACBCCACCBCCCAAABBBBABCBCCCBCBACCCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ee9486a29430aafc73266e3d7d9c9f776e58bff8a547565447af737a1bd14a65
MD5 59ca9b622c34be285c34ca1dfb7bac96
SHA1 b08bbaff70ccaba2d577085391b33cb58c0690f7
SHA512 cda7a19cc685e81bf5f2c8d8c4fd5d65b4913993c0e17e080243a7e5552ee5e67d392b1fa7e3927bc7de084534a53c292a8f9348ed9b2b03b32038997f1ed6dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 efd0c0752ba8238f2501068fa43d1119df69024c76c731ef210d607de669ec49
MD5 83366a6c597b3c3ef5a933c33dbc5549
SHA1 0e845b1a8810d4e441aa53525527ff3344de4150
SHA512 e02bd0a26fcbb91caf2c439ca4e2864b9158fddcb8f630e636aadd6c05c4c56fb610f22793307d7a98310bed23e2cc460fab893246950db66bcc7bb6904f6e17
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a833a73e335448fb76195f37d5eaca40529e83a4dc41617abb41484113469675
MD5 70dd068f4546efba3b0e07296ac81279
SHA1 919addc9fcc036b99aea3d4f031df2f94492762d
SHA512 5f44455ceb70b8d00b5c2ad71b33f8655c45f8a6826caa91601f975595ae65b500cc3664fa50ba3d052ac6d16c3305d48a93e75cf98c4d7947ad1662a58f7964
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 460dd0b546cc729f121747e89e512a31d52b52f1301ccf8cb1bd29196ba86a0b
MD5 81b0e063f69dc9c27040cb8cbcdfd96f
SHA1 f06a4e816f27930b15ef2438395b5b9db4c6964d
SHA512 eedf75674e35354e3632311ddd08c27302ab65cd56595690b39e93b74436a9129b92f77c8514ee45b0e5b6ebc4c6d445307ee558507ededae95d4af49f005ec2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e52696361f0fd13c05e0e588ddaf22c7429bd16693fc8be6ed4dddcce01ee23f
MD5 f1fbc674ba18dc35cd9f62865e1ecf4a
SHA1 a3ec844d765ed535e81de554aabf70327b92945e
SHA512 a87327d7725a532d0dbf57524895ad2509203e744001fc791b7d3775ac25dea2e051c573d8f8e7ec689e87273e8385b27e283af78d42609a63a1db7a17935e00
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 727052ded891f282bd82ada8980040e3368d336c66bfbc78b0f47de277834d02
MD5 53e853cfbabaf9382ab7eb249936e45c
SHA1 0b53ff4133652a0367da2db2e825511fca06bab3
SHA512 d547ebe76432ee21a80b028b9ff3e29ea5441d46f1ee62b2f64d02c1d8df5a3b06980c9fe0e33b025634821621db81e94708fec454226e7db89afb49f1c6e181
MD5 SHA1 SHA512

Submit Download

svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCAACBCACBBCBABBAABCCABACAACCCBCBCCABBAABCBAACCCCABCAAC.exe
Size 2.5MB
SHA256 7a6c7033acf88d51f8e6b7323ab220d638bd6f193ca4108a85ad1e8bbf0ed10f
MD5 ff4ebcd9909992f090514e4fbf9168ed
SHA1 a38655b9990af551eb105b25fa3e7b98f01d0314
SHA512 bc9bdeb4295acf128c56e82605eda3e337e21e3d557e41d6593409408c8a7fd6fd5029024106c18a736d2fc0d91694643f8afbdcbf9b4c47bda04a22fece1b3f
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+EG:b
TLSH
T169C55B09F9D748B2D97B51B00CDBE3BF4971BB2580258E6AFA4EC74FB823B505419392
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1291691d8c003b3facb7346554a4bae1c8c8d441e70c19a6a83288ab5a2c2add
MD5 6814b60bf268117bdf63221194fbb86d
SHA1 f26372f08440b85b6d254a8e2ffed82c1a3dcfee
SHA512 b4e9e9e7adad4eb7595ffde4af1538b6323a3dc02fefdf4402af0719d7306853b384df50876553beb9c473e3a2786143cebc07a0cba013ad0dad3080cc8851f4
TLSH
T101113A00E0E9D4F3F837388F0629CEE608D8378E9C546A54230C452CB7EDC719D698E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2104-22-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/2104-35-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/2796-66-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/4884-81-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download

memory/5312-6-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download