ddf4005019273e311f3ccc61f8525c275e58b0a77c78d19bcde9b17eb9f4840d

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe
Size 19.5MB
Sample260830-2ymn3abj5x
SHA256 ddf4005019273e311f3ccc61f8525c275e58b0a77c78d19bcde9b17eb9f4840d
MD5 fba513a9fc8bd33761385fe0318493c9
SHA1 8345444580e4d42087907a79b05f31c8b7ed4555
SHA512 bd4222d1dbbe991e1cb50b6bece1a756ccf6e5bb29775974b1794cb89cf90fee858c4beb2b9f20f2b311d659f665830e3f8fc01d6287abfce77686a045c5b9b5
SSDEEP 49152:U+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+E5:U7pq7p9
TLSH
T10C272A09F94340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4ECB5B6533BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2248	svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACACBBBBCCABBACACAABBBCBCBCBCABCABAABABCBBABCBAAABBBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe"	2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5924	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5524	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2596	2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe
2596	2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe
2596	2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe
2596	2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe
2248	svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe
2248	svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2596	2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe
Token: SeDebugPrivilege	2248	svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 5924	2596	2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe	92
PID 5924 wrote to memory of 5524	5924	cmd.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_fba513a9fc8bd33761385fe0318493c9_elex_hawkeye_remcos_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACCCAABBABBCCACAAAACBABCAAACBABCAAABBAACABBCACBBCCABCABCABACCBBBAAACBBCABAAABBAACBBABABBCBBCACCCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5924
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAACCCAABBABBCCACAAAACBABCAAACBABCAAABBAACABBCACBBCCABCABCABACCBBBAAACBBCABAAABBAACBBABABBCBBCACCCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5524

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b84553be94ba9fcc153bbc0e5325288d0cfb0367caa4b4f1dab97585184c0a44
MD5 d1cf3b60e91da9f11dbe32680c9f7ac6
SHA1 464eb70aab73a94018917e23033764005f2ee7f0
SHA512 6e268442002d3c4e34fdb30114908384bb77d54f73bce48c2abb217247c61225613ef665bacc3fd280fe7c69950949c59f2eb1e40dd35d268d00c24bb1d9231b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4dd0bd0d80a20c58682acadea467706264708310887dc7167921303f5b0a61f9
MD5 76d5611279585a9d2c1ae870f0a36c22
SHA1 112dd9ceb5136e1adf5345639f5f3a3d3d64d355
SHA512 709cf2532e62215f7f00fce9af3bed5f4653e307d243eff4ee01aa9e446b66748a86344f5d2215fb19ae737070cfca403b60aee13f9978ba20cea2d8d1edc3ed
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9f719df15e5d4d96c7ff2fb07c017656c28d5aed7b99039c47ba0b5ab2b8bd4
MD5 d5e3404bbf49d059237197efedf5c675
SHA1 a591e3cf14625be7d8ebad727cb586e02078f251
SHA512 62df6768deb2a2de5f8147feb4d78cf59d79c3a30a16e034d24957941fc1171db6590d0f580f38855ce469a5505125b316181f29939f4894f9cf014c713af28a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6b774d2402d7f7a370fa7565cd6f189cc88fb02d123edf7dac134db78d47d9f2
MD5 da963f804025377db7c53a9b383237f2
SHA1 59f662022114ffcdd81e89bd5025008aa5e679e4
SHA512 3e6ebcfe3a36a2b6ba4b1660c9deb4e8f348894decbe875e76647cc874dfe5a3885decf872a7656b92de66ca765428827d0a7588931aa4da0dffee160e5fb9de
MD5 SHA1 SHA512

Submit Download

svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCBBACCBBBBBBAABABCCCCACBAAAABBCABACABAAAACACCACCCABA.exe
Size 19.5MB
SHA256 ddf4005019273e311f3ccc61f8525c275e58b0a77c78d19bcde9b17eb9f4840d
MD5 fba513a9fc8bd33761385fe0318493c9
SHA1 8345444580e4d42087907a79b05f31c8b7ed4555
SHA512 bd4222d1dbbe991e1cb50b6bece1a756ccf6e5bb29775974b1794cb89cf90fee858c4beb2b9f20f2b311d659f665830e3f8fc01d6287abfce77686a045c5b9b5
SSDEEP 49152:U+ES+ES+ES+Ee+ES+ES+ES+ES+ES+ES+Ep+ES+ES+Ee+ES+ES+ES+ES+ES+ES+E5:U7pq7p9
TLSH
T10C272A09F94340B1D92B51B04DCFE3BF8A60BB2586128DF7FB4ECB5B6533BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2248-25-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/2248-38-0x00000000000A0000-0x00000000000C1000-memory.dmp

Download

memory/2596-0-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download

memory/2596-8-0x0000000000BD0000-0x0000000000BF1000-memory.dmp

Download