1984dc00f987977217e11c29f3b936e5b2b089238e70f3abe9574aa7b9fae693

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe
Size 1.1MB
Sample260831-cv2w5swthy
SHA256 1984dc00f987977217e11c29f3b936e5b2b089238e70f3abe9574aa7b9fae693
MD5 e28ce8163a457e2a73876b4b49a8785a
SHA1 3cbe0527b2a40a01fe46fd8bfd962ba74d9c5871
SHA512 b7eb7172be16e10c313e99f482dc07019f09b870cad0f7c3e42eb7ea5347bb87cf858e4006ca1428ffd0d9d71b5b0d381832fae5e8bde537daf2d78b655c8c77
SSDEEP 24576:m9+EM0t9+EM0t9+EM0t9+EM0t9+EM0M6BavWrB1xetOsQuEZIG6+/GNsElnJnC+:U+Ex+Ex+Ex+Ex+EKW1PszNsQd
TLSH
T1BB356C02FBD70471EA77357009BBA2BA4D76BA114431CD6DE74C892FAB33E41982935B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
536	svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
4276	svchost_BAACCACABBACCCCACCBABACABCBACCBBABACCBACCBBBCBACCCBACCB.exe
2316	svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBACBAACBCCBBBABAABBCCBABABBACABBACBACCCBACCCCACBACCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe"	2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBBBAABAACBACCCACCABBCCCBCABCAABACCBCBABCBCAABABBBCCCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCACABBACCCCACCBABACABCBACCBBABACCBACCBBBCBACCCBACCB.exe"	svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4728	sc.exe
3888	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4860	cmd.exe
1924	cmd.exe
4396	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCACABBACCCCACCBABACABCBACCBBABACCBACCBBBCBACCCBACCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4232	2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe
4232	2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe
4232	2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe
4232	2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe
536	svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
536	svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
536	svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
536	svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
4276	svchost_BAACCACABBACCCCACCBABACABCBACCBBABACCBACCBBBCBACCCBACCB.exe
4276	svchost_BAACCACABBACCCCACCBABACABCBACCBBABACCBACCBBBCBACCCBACCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe
Token: SeDebugPrivilege	536	svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
Token: SeDebugPrivilege	4276	svchost_BAACCACABBACCCCACCBABACABCBACCBBABACCBACCBBBCBACCCBACCB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1452	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4860	4232	2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe	106
PID 4860 wrote to memory of 4884	4860	cmd.exe	108
PID 536 wrote to memory of 3444	536	svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe	109
PID 3444 wrote to memory of 3644	3444	notepad.exe	110
PID 4232 wrote to memory of 1924	4232	2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe	114
PID 1924 wrote to memory of 4728	1924	cmd.exe	116
PID 4232 wrote to memory of 4396	4232	2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe	117
PID 4396 wrote to memory of 3888	4396	cmd.exe	119

C:\Users\Admin\AppData\Local\Temp\2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_e28ce8163a457e2a73876b4b49a8785a_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBAACCAABBCCAAACBBBBCCCACABACBABBAACACCACCBCCBACAAACBCCCBABBCBCCABCCCABABABBBABCACABABBACABBBABCCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCBAACCAABBCCAAACBBBBCCCACABACBABBAACACCACCBCCBACAAACBCCCBABBCBCCABCCCABABABBBABCACABABBACABBBABCCBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCAAABABBBBBBABCCCACAABBAABAACAABAAABCBCABCCCBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe" start= auto displayName= "UserDataSvc_BCAAABABBBBBBABCCCACAABBAABAACAABAAABCBCABCCCBCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCAAABABBBBBBABCCCACAABBAABAACAABAAABCBCABCCCBCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe" start= auto displayName= "UserDataSvc_BCAAABABBBBBBABCCCACAABBAABAACAABAAABCBCABCCCBCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCAAABABBBBBBABCCCACAABBAABAACAABAAABCBCABCCCBCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCAAABABBBBBBABCCCACAABBAABAACAABAAABCBCABCCCBCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:536
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3644

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1452

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACABBACCCCACCBABACABCBACCBBABACCBACCBBBCBACCCBACCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCACABBACCCCACCBABACABCBACCBBABACCBACCBBBCBACCCBACCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
1⤵
- Executes dropped EXE
PID:2316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e42d592541cf6b6867b74c16d3119c04c39b090891b9f513956093833eee94e3
MD5 3c3458797dd0e6ee8379e382199043e3
SHA1 1714b08f4142d7b38bc88142a0399c295169eff7
SHA512 d476fbdfabf192aff573fe5551a9113117ad68e967d70fe00a924942d7d3cafc56024659941b964426eee7519198500d8b59fa00520a4b5e550489bd759b6cc0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3bce52d0f20121f6b5f20a1819bda66d6a7471d75520ef2bb0af569857425e6b
MD5 6ea13042a5ce42b646b027ee4433dbee
SHA1 e163fa42298e338d0102a61e249385c4ee2e5407
SHA512 08015dec6e45a5bfbd1c0cb52f42bdf793f5d92a79e3c0698ac1f0745e724481b56b66726fe5e175433303eb6206f1000105e71575cbd0cb0a6e0e3061af8112
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e28536b5956a7ba3566fa197035b2a9d5210aafdbc9693fa4de26840440fdc88
MD5 87fd4ef257338d7e092dc990587451fc
SHA1 3e3039180cba9f87113b465da31827bfe54c98c8
SHA512 1038e1116df8511999204e8a853f90a17dde325b0daaa327542434a3802a97cc94c97b7f2bd0f04f0e877458c62a263dac5e28633dbafb8b54f8d5637e0090a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2fe2efb75b34f94ccee857939305390641b8297c5ea0ba44c5ea945aa596b8ad
MD5 513ffce63027330e8e55a768e311c2b3
SHA1 db3cf885d03bd4092fabffc723e88697be8e58ca
SHA512 4a7643b39fd31845c656793009ae9789418e9a73bc68001c47af473ec3d2596cacb5640156f944fca183d692f973b3d775539e42d766110a7dd9e0cb6d15132e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 df9fc949ffb012e5f6cea0590673e35951927409d619d2bb26d09d943c1dde83
MD5 8afcf5b9c83b6b0f8b6e3c11ab53020f
SHA1 484fa44596f72532c7efb210f8cbae4c0384d514
SHA512 6fbb274f041b2578ea08c66b50d317ce99d28d6152362c1cf022c6c333bf626e847776ab2cb712a3132215dc3d66b8ac0369d3d107f90ebd69e5a4261f33bcfa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 58a919854769dea23e99fc0754b8abee42291b5bdc99ea1f08617d9d87c1d886
MD5 1f4ac461f794fee8177a4ad153ab6606
SHA1 11c25543612ff36936c91702401b886f1ea31ad0
SHA512 50a88ac50120deced6f187b1a22fa2ae64abe61aae70af78eb388bffeebd7b70e38c56e2874ec9398f261a7cbd598407111a951ca01ad4fa0da2d23604705981
MD5 SHA1 SHA512

Submit Download

svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCCABBBACABCACBCAABCABBCBACBBBABCCACCBCCAABBACCABCCAB.exe
Size 1.1MB
SHA256 1984dc00f987977217e11c29f3b936e5b2b089238e70f3abe9574aa7b9fae693
MD5 e28ce8163a457e2a73876b4b49a8785a
SHA1 3cbe0527b2a40a01fe46fd8bfd962ba74d9c5871
SHA512 b7eb7172be16e10c313e99f482dc07019f09b870cad0f7c3e42eb7ea5347bb87cf858e4006ca1428ffd0d9d71b5b0d381832fae5e8bde537daf2d78b655c8c77
SSDEEP 24576:m9+EM0t9+EM0t9+EM0t9+EM0t9+EM0M6BavWrB1xetOsQuEZIG6+/GNsElnJnC+:U+Ex+Ex+Ex+Ex+EKW1PszNsQd
TLSH
T1BB356C02FBD70471EA77357009BBA2BA4D76BA114431CD6DE74C892FAB33E41982935B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 7b2292e0ff18f6c15106af6705eab79715160415ed95a31a913ce39dd9f7f0e6
MD5 575294b3bb4ad073e9c8f7f0e715f31e
SHA1 cc3259a13a141f193beb638ed066d27b995eb4c0
SHA512 c65d45cc99833f42c46469055f29ccc5830a028b0130d40ddec7b2db0231f7a58c76d8b55639fde71708d44c12cd08092915b376ef6f8b8575ead6cb7100e57b
TLSH
T1DC110661D0F5E87BE53268CED92ACEC78CE1365FAC246A94231D42187B79C33CE150E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/536-36-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/536-26-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/2316-89-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/3444-60-0x0000000005440000-0x0000000005441000-memory.dmp

Download

memory/4232-0-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/4232-7-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/4276-87-0x0000000000070000-0x0000000000091000-memory.dmp

Download