994fc3c68283e7e1e9c1829fd544a8c9f69ba2e911a4075460db671cf65bea3e

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe
Size 11.8MB
Sample260831-1f3f5aae25
SHA256 994fc3c68283e7e1e9c1829fd544a8c9f69ba2e911a4075460db671cf65bea3e
MD5 3526434070fac385aa4421839b1dc406
SHA1 f03a14a6303d69db8d1226cbb03c8453e8a3e4f3
SHA512 29d2ae1fac2c15dd2a7c6fa8633f4210e421d9063dd0a152a58e169019307ad3102879cf4e08ce1506a41db3bae29f8f7ca9770362e0eae414d1b7ad73dbfa56
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EnH+Ex+Ex+Ex+Ex+Ex+H:R4Tk
TLSH
T197C63C0AF98740B1E92B51B04CCBE3BF8A71BF658412CE7AEB4ECB1F7532B115819255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables manipulated with Fody 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c52a-19.dat	INDICATOR_EXE_Packed_Fody

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5996	svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
5044	svchost_CBBBABCBBCACCAABAABAACBCABCBABCABAABBBABCACCBABBCCAACBA.exe
3176	svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBCBCCBCCBBACCABCCAAAABBCBBAAACCCBBCCBCCBCAACBACABABCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBABCBBCACCAABAABAACBCABCBABCABAABBBABCACCBABBCCAACBA.exe"	svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBACABCCBCCCAABACAACAABAAABAAABABCAABBCAAACCBACACABCCBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe"	2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2124	sc.exe
5336	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4984	cmd.exe
5508	cmd.exe
3300	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBABCBBCACCAABAABAACBCABCBABCABAABBBABCACCBABBCCAACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5724	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2300	2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe
2300	2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe
2300	2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe
2300	2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe
5996	svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
5996	svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
5996	svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
5996	svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
5044	svchost_CBBBABCBBCACCAABAABAACBCABCBABCABAABBBABCACCBABBCCAACBA.exe
5044	svchost_CBBBABCBBCACCAABAABAACBCABCBABCABAABBBABCACCBABBCCAACBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2300	2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	5996	svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
Token: SeDebugPrivilege	5044	svchost_CBBBABCBBCACCAABAABAACBCABCBABCABAABBBABCACCBABBCCAACBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 4984	2300	2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe	93
PID 4984 wrote to memory of 5724	4984	cmd.exe	95
PID 5996 wrote to memory of 5796	5996	svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe	96
PID 2300 wrote to memory of 5508	2300	2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe	99
PID 5508 wrote to memory of 5336	5508	cmd.exe	101
PID 2300 wrote to memory of 3300	2300	2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe	102
PID 3300 wrote to memory of 2124	3300	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_3526434070fac385aa4421839b1dc406_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAACCCBACACACBCBBABACBACCAAACCBBCCABBABBAABACBCBACBABBBAABCBBBACBBBBACAABCBAABCBBBAABBABBBABACBACBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAACCCBACACACBCBBABACBACCAAACCBBCCABBABBAABACBCBACBABBBAABCBBBACBBBBACAABCBAABCBBBAABBABBBABACBACBCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBACACBAABCBBCCCCACCBCCAACCCACBBCACAAAAAAABBCBABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe" start= auto displayName= "UserDataSvc_BBBACACBAABCBBCCCCACCBCCAACCCACBBCACAAAAAAABBCBABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5508
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBACACBAABCBBCCCCACCBCCAACCCACBBCACAAAAAAABBCBABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe" start= auto displayName= "UserDataSvc_BBBACACBAABCBBCCCCACCBCCAACCCACBBCACAAAAAAABBCBABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5336
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBACACBAABCBBCCCCACCBCCAACCCACBBCACAAAAAAABBCBABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3300
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBACACBAABCBBCCCCACCBCCAACCCACBBCACAAAAAAABBCBABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2124

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5996
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCBBCACCAABAABAACBCABCBABCABAABBBABCACCBABBCCAACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBABCBBCACCAABAABAACBCABCBABCABAABBBABCACCBABBCCAACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
1⤵
- Executes dropped EXE
PID:3176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ee4de71297005d600b70a25a8b2a9d3f40dc7e010a98761c16135480a64cef72
MD5 5736371687cca273f618866b138f76c3
SHA1 e1b4cc2927387f0d93850c74c57ac9c0511f9d1b
SHA512 41ae19877b8d71b35aa09e0f6490b7acc9e0dfa272e7b6dba27bc4a5df9914802935b2371c8782e9738807a1f2ea05822f5dba1bcac35922a45b3a844713ed2c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ea6df11976d2e5bffc10220927fd305865f2a7de1de47e525f5cd946eed1848c
MD5 ad517e41e63bf82e69fff0cb978bf2c0
SHA1 539f51d88c6c138d25ecaf539b3f5cd2a726e96f
SHA512 81f204706f97ece26c27b0989c7519b719674407c145f35bc0240103d34065d830c5d8f58e531b0b230cea6a56f1df5e34609292c176ade78f9ae97c11c11370
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61e8cf751d09a1dfcba850e1d87464fff7a078e3f2a944d80f21410a1ccdfa16
MD5 7c9c6bf22c048d626bdc9ad2693006da
SHA1 5b39229a26b065235a3c241c9a8034d06ea9a394
SHA512 5447d2691ae8eb23a0dd01900f35d95758e9494bad7f51568d5ea761af856acb5cecf2b32422c18f88752476a594a24672ef14de4f84a13c8d12e8dbe0b6f0f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f3bbf737001203c72bb0adf0299d9dcb36b7dd81811e149349043474ae4f7b37
MD5 25870c4219cc677b8d79ec7fd50512c2
SHA1 72fda5d100351a5a912705393cbb46dd3e4086f4
SHA512 c0ec2603f839c15e75a5a85a90d122885d03270016e8e9b3970511fc1315f757d8da0e45dc35ddbd608b0fd8cc3e3e9e3da5ff0c9fdcfb244bd07d80bc1ad7a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3ea66d95c4fa5f1b715cdff30b5caec339e9cd98782ccc0b4b855bb8c6e48d2c
MD5 c308052ca4bdd78ee183b70267440b7c
SHA1 417db57f49c9d8251a9a3277ef8a64b500a9b592
SHA512 b4fef3a4091782c423ac3797e2d07397bda4463f8ba6137f2f3020be768ce5fd8aeca638802b37e2f58298e732681ffe337bedecd5dceb4d5aca13075fd04282
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99136ef1fc6555dca146a215be2ffc5285da2c2f038e1d37f53b9066d5fed3af
MD5 ac6744ec95a229ee4a4bc4b725af858a
SHA1 d48de1e32a56eb1260ead0a9ba71db3d1770a724
SHA512 5e870599da4063f96f4678038819c7d2fdd21c4669e4348965c874a153b003fabefe1d480d9dd009897cf4b99278b36e34d9c887442901d231c3e61fdc329125
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 611d6ea3c216d333b93537dd3aed61ce287a10a3c009df247d90f50294fb01bd
MD5 4b1a20e3aa9a67ff8ed4756633d9637c
SHA1 4c9994f7ecc433bdec0a8565bb14c8262092c24a
SHA512 808462685ca98ca9b3be23f0145f7673737e0b6973c8be4fffa3f32e3c7cfb6aa2e6a5a2520cdbc77fbb1c8c42a625fb7d766672726da662dc4df2a7ce2b8c69
MD5 SHA1 SHA512

Submit Download

svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBBBBCBBCBBCAACACCACAACCCCBAACCABBCABCBAAABBBBAACCB.exe
Size 11.8MB
SHA256 994fc3c68283e7e1e9c1829fd544a8c9f69ba2e911a4075460db671cf65bea3e
MD5 3526434070fac385aa4421839b1dc406
SHA1 f03a14a6303d69db8d1226cbb03c8453e8a3e4f3
SHA512 29d2ae1fac2c15dd2a7c6fa8633f4210e421d9063dd0a152a58e169019307ad3102879cf4e08ce1506a41db3bae29f8f7ca9770362e0eae414d1b7ad73dbfa56
SSDEEP 49152:U+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EnH+Ex+Ex+Ex+Ex+Ex+H:R4Tk
TLSH
T197C63C0AF98740B1E92B51B04CCBE3BF8A71BF658412CE7AEB4ECB1F7532B115819255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c6f27e2943324a0d8f6f85ee1ae666edb055b4cb8d53d3ef98412853b9822571
MD5 de95fa2166f759256f49912abc419de4
SHA1 fa7d0b2c5ac69055ddb5e8199f67c541b982da5b
SHA512 99f782d950d5d7147a3f7529d60c8dffde65f06c719674fd917b442c5135b94d023d03f7f8ab62798e29af60b8e06d3abfef9f053714f10b3175e2aff08a692f
TLSH
T1AA11E360E4E6DCF7F433A8874615C9CB8CA836DEAC5CFA54631D861CA7E9C304D254E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2300-7-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/2300-0-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/3176-84-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download

memory/5044-64-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/5044-82-0x0000000000570000-0x0000000000591000-memory.dmp

Download

memory/5996-33-0x0000000000D20000-0x0000000000D41000-memory.dmp

Download