83e0c742aff94eacacb4179112dbc7bf62e26e176c7af6eb5b9a2fa1186a2a3e

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/08/2026, 23:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe
Size 905KB
Sample260830-3nvglabl4t
SHA256 83e0c742aff94eacacb4179112dbc7bf62e26e176c7af6eb5b9a2fa1186a2a3e
MD5 ffe9fd41dd6c7042d1285600cece3046
SHA1 34669610c8a42b6ac82a718bb37014ac61d10a62
SHA512 1983811bffc7335f7dc75820da0e7dc8d75f2754aac64ac5a51945392f53b24da7c1ff23898c78dc5caa4586bd9fc1d68501b76ec156bdfb04ccbe5b5d9ab4e3
SSDEEP 24576:m9+EM0t9+EM0/9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0eJ:U+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EQ
TLSH
T14F152B0AF94744B2D92F51B00CCBE3BF8A60BB26C4128E76FB4ECB5FB936B115419255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4076	svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
4592	svchost_ACACACCBABBBABCBACAAABAABCAABABBAACBCABAACCCABCCABCBAAA.exe
1032	svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBCAACABABABCACCBBAACBBBAAACACACCACBBAABBAAABACCBBBBCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe"	2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBBCBACCBABAABCBACCCAABAAAAACCCAABBCBACCBACCAABBBBCABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACACCBABBBABCBACAAABAABCAABABBAACBCABAACCCABCCABCBAAA.exe"	svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3788	sc.exe
3048	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
700	cmd.exe
3068	cmd.exe
4212	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACACCBABBBABCBACAAABAABCAABABBAACBCABAACCCABCCABCBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4336	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3608	2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe
3608	2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe
3608	2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe
3608	2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe
4076	svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
4076	svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
4076	svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
4076	svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
4592	svchost_ACACACCBABBBABCBACAAABAABCAABABBAACBCABAACCCABCCABCBAAA.exe
4592	svchost_ACACACCBABBBABCBACAAABAABCAABABBAACBCABAACCCABCCABCBAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3608	2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe
Token: SeDebugPrivilege	4076	svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
Token: SeDebugPrivilege	4592	svchost_ACACACCBABBBABCBACAAABAABCAABABBAACBCABAACCCABCCABCBAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2664	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3608 wrote to memory of 700	3608	2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe	96
PID 700 wrote to memory of 4336	700	cmd.exe	98
PID 4076 wrote to memory of 2200	4076	svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe	99
PID 2200 wrote to memory of 5084	2200	notepad.exe	100
PID 3608 wrote to memory of 3068	3608	2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe	104
PID 3068 wrote to memory of 3788	3068	cmd.exe	106
PID 3608 wrote to memory of 4212	3608	2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe	107
PID 4212 wrote to memory of 3048	4212	cmd.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_ffe9fd41dd6c7042d1285600cece3046_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCBCCCBACABCCBACCCABCACCCBBCBCBABCBCABBBAAACBBCCCCBBABABCBCCABCACACAACCABBAAABCCACABCCAABCBCCBBBABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAABCBCCCBACABCCBACCCABCACCCBBCBCBABCBCABBBAAACBBCCCCBBABABCBCCABCACACAACCABBAAABCCACABCCAABCBCCBBBABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABCCBBACABCCCAABACBBAACABABBCACCACCABAABCAAABAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe" start= auto displayName= "UserDataSvc_AAABCCBBACABCCCAABACBBAACABABBCACCACCABAABCAAABAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABCCBBACABCCCAABACBBAACABABBCACCACCABAABCAAABAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe" start= auto displayName= "UserDataSvc_AAABCCBBACABCCCAABACBBAACABABBCACCACCABAABCAAABAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABCCBBACABCCCAABACBBAACABABBCACCACCABAABCAAABAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABCCBBACABCCCAABACBBAACABABBCACCACCABAABCAAABAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2200
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5084

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACCBABBBABCBACAAABAABCAABABBAACBCABAACCCABCCABCBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACACCBABBBABCBACAAABAABCAABABBAACBCABAACCCABCCABCBAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
1⤵
- Executes dropped EXE
PID:1032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5e38fd2b56e011110da9f415eb4ebf233dcb0cccd4fed01a8875775b22b4fc93
MD5 d225f6ac73a0e908e59d94e15e3daead
SHA1 941c165c46c767d3bc0c5148ef68822e38eb94de
SHA512 5f21e1abc6647b086e393ad180451e1cc5fd9acf926b7cf4bedccf4afbe651879676cd3611eea28d08e90503f78d04dd6a77cb9b4b8d28865d34c7d88409c837
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e82b98a628c07ec7179f73b098b8336c2c5665f84d6ab17bed5d960e4a72a8c
MD5 7cac6e27e6dacd108c14bbc5673c02b3
SHA1 6bd111b1b640c0d1609df352ce78c6ce2affe579
SHA512 f5926c911552cd87a384ae8f96b3f746e19595e7d79fcf5d3b4f0441e5f4022a9de7a728b3d2cfb186458d0fb389c24b701eb022fc3b3b210efab4547a11e67a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ba23d43db92e1544dcbb866d16bbff94254e8b9e3aa199091329b2d6d817cc6c
MD5 475b89a7f2f5bef510649da641fac63e
SHA1 721822a8f39c046515d092977872ff4a6de0aff8
SHA512 8f5d481c6c58e21e20a1e4cd16502e5e9e1e45562240408c49a65cf222688830f2e761db6225b24affd252b9c4d40d975594394b09b123fba83a407691f05276
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2e88dab42bc091b63454fcaaae7056f0a02a41484c489b92b1032f9faef663f3
MD5 c4430fa4c3067d0e116323209c1c5f1c
SHA1 5ae8f5f955f472ec66637cf874c1821581c7fa80
SHA512 e883be40df3d57015801fc43c7ad925cc169dbf4eb4745a3210f00ae9842e81279a37ddcc2fab0107e24174b4e7bec6e9e0738542002eb798c07af5d1f52ed9d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 070cbeddc6129dd68dd85b7e0664ccda71430f3c717a6e0abf8f154e5e579a91
MD5 5430628b45b3ad5ebe14c4125ad019e1
SHA1 8e9812edcac5fa9a1b9713cb9bab7da150bb2ecc
SHA512 21e52cfd4add1c5d807883944ae43b70ac9216dbf40900fc57cd82235342863ddbe7d6819511fba86baf0d1a630789146695af0343fc79ed71edc5f3113846f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 aa4c35044fbad79d434696270cefac74518a288f552504dcbc684386092881a2
MD5 9cd78c8a5ee4ff9c108f955beae62e67
SHA1 5b131a3bef332a8687b76285ee9ae29fad364fd2
SHA512 a662605f9f274e9ec87e81e383c2234ed7310907b82e5e5373a3ef2833510676454ccf504aaac608b1361e53e495974bb92a3d6f4edf8527c345eefb769760c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 db8eb7789333f3891d2f68ffc0539509ee9106ff65a0427df5418953d98c3c67
MD5 4e145c1ac26ab2bf1b5f9de1a86b390c
SHA1 0f2c93e6a3cbbd299b3e99c034ea066690406951
SHA512 77e5b988cd9780a7c58f3a1b1bad0dcd81d8620ed29e9324bcb04a85abee56877a988291f40f66abf34e2fe25b0c4625e8a55d7b3a7cc61654e86ad976632b3a
MD5 SHA1 SHA512

Submit Download

svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCAACBACCCACCCBCBBBACCCACABACBBBAAACBCACBBBBCBAABBACC.exe
Size 905KB
SHA256 83e0c742aff94eacacb4179112dbc7bf62e26e176c7af6eb5b9a2fa1186a2a3e
MD5 ffe9fd41dd6c7042d1285600cece3046
SHA1 34669610c8a42b6ac82a718bb37014ac61d10a62
SHA512 1983811bffc7335f7dc75820da0e7dc8d75f2754aac64ac5a51945392f53b24da7c1ff23898c78dc5caa4586bd9fc1d68501b76ec156bdfb04ccbe5b5d9ab4e3
SSDEEP 24576:m9+EM0t9+EM0/9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0eJ:U+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EQ
TLSH
T14F152B0AF94744B2D92F51B00CCBE3BF8A60BB26C4128E76FB4ECB5FB936B115419255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 27e21c5f32a4ea342ec0162faed688b0a5a2f3e2d4d2202bd9bb6c1a48b97546
MD5 a69de121aa4d237104d58385953db1d8
SHA1 1101583284a967418e8c9e218e81954f69d80008
SHA512 3ab67211bb50fe75f1fe33844dbc4120dd81bb4ab67dd38b3cfab6c3289f211060897e578f7299486c98d0f63dcf7405d1c8d460250cbf73e104a3b48634daed
TLSH
T181119161E1F5D493E93228DB8615EA870C99368FAC1C6A5463194718B7E9C31CE258F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1032-92-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/2200-59-0x0000000004F40000-0x0000000004F41000-memory.dmp

Download

memory/3608-0-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/3608-7-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/4076-36-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4592-72-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4592-90-0x0000000000950000-0x0000000000971000-memory.dmp

Download