37ada18e30848ac9900f026c62ea1176570566f31ccbbe01e130764544ee78bb

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe
Size 243KB
Sample260831-fxpalsdp31
SHA256 37ada18e30848ac9900f026c62ea1176570566f31ccbbe01e130764544ee78bb
MD5 c21804270c998bb05224ac56c34cddb5
SHA1 4add95712409c955d8ff1d2e24bb1e0f7a5c1851
SHA512 e18c29fa5fbffc8631c7ac39b409053a0a9599e98437c6e5eefc9945dd307116dd9b9c806325657ec025f7540cfd620df84a876c4e0f50a0be6325dd09a21f01
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLKkIkOk1XI8fNuRS:m+dTTUFgEs3XojAdP+dTTDFb1L7
TLSH
T1C1347D05F8875476D91A40F00D9FD2BFD670BE6286008DEAF7CD8A6F9C62F947225329
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6044	svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
4996	svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
2896	svchost_ACCBCABBACAACACBCCBBCCABBAACCAAACCCABCACCCCAAACACACCCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABBBAAABACCCACBCAACCABAAAABAABBBBCAACAACCBAACCCCBCCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe"	2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBACABBABBAACCCACBACBBBABBCBCAACBBCBCCCCBCACAAABBBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBCABBACAACACBCCBBCCABBAACCAAACCCABCACCCCAAACACACCCAA.exe"	svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6048	sc.exe
2836	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
972	cmd.exe
1992	cmd.exe
3936	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBCABBACAACACBCCBBCCABBAACCAAACCCABCACCCCAAACACACCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3452	2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe
3452	2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe
3452	2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe
3452	2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe
6044	svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
6044	svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
6044	svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
6044	svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
2896	svchost_ACCBCABBACAACACBCCBBCCABBAACCAAACCCABCACCCCAAACACACCCAA.exe
2896	svchost_ACCBCABBACAACACBCCBBCCABBAACCAAACCCABCACCCCAAACACACCCAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe
Token: SeDebugPrivilege	6044	svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
Token: SeDebugPrivilege	2896	svchost_ACCBCABBACAACACBCCBBCCABBAACCAAACCCABCACCCCAAACACACCCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 972	3452	2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe	91
PID 972 wrote to memory of 3836	972	cmd.exe	93
PID 3452 wrote to memory of 1992	3452	2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe	94
PID 1992 wrote to memory of 6048	1992	cmd.exe	96
PID 3452 wrote to memory of 3936	3452	2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe	97
PID 3936 wrote to memory of 2836	3936	cmd.exe	99
PID 6044 wrote to memory of 4364	6044	svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_c21804270c998bb05224ac56c34cddb5_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACCAACCBBCBBCAACAACBABACABABBAAAAABCCBACBAAAACACCCACCCAABABBAACCBABCBBACACACAAACBCBACBCBBCACBCABCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACCAACCBBCBBCAACAACBABACABABBAAAAABCCBACBAAAACACCCACCCAABABBAACCBABCBBACACACAAACBCBACBCBBCACBCABCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3836
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBAABACABABCAABBBCCCBACAACBABAAABAAACACACACCAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe" start= auto displayName= "UserDataSvc_BBCCBAABACABABCAABBBCCCBACAACBABAAABAAACACACACCAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1992
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBAABACABABCAABBBCCCBACAACBABAAABAAACACACACCAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe" start= auto displayName= "UserDataSvc_BBCCBAABACABABCAABBBCCCBACAACBABAAABAAACACACACCAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBAABACABABCAABBBCCCBACAACBABAAABAAACACACACCAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCBAABACABABCAABBBCCCBACAACBABAAABAAACACACACCAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2836

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6044
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
1⤵
- Executes dropped EXE
PID:4996

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABBACAACACBCCBBCCABBAACCAAACCCABCACCCCAAACACACCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBCABBACAACACBCCBBCCABBAACCAAACCCABCACCCCAAACACACCCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0af6759af1c0c40f61b1abd1e4fdd739d8a9927bd597f81031c8a624842d3909
MD5 98883009d05680edfdcb6c00fa4258e0
SHA1 351d1260c1e46c05685fe7f0869ec4497bcdb1ab
SHA512 a171300143a6b880b372c0486e22ca111c2a7f77341538956a5a1be35f028f1464d57d8a8b0680d88fa01532794361c460f546b5b91d45fb164adc056477a21f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ef721fd52699400bd45663abe6fdc24312c7d7bb3dc3ad1523f4fb831ee0891b
MD5 407781e2a4bc2a8ad30c6180e102689d
SHA1 ed6a9215e318985c79034867310161d95d7b2f2e
SHA512 6dfdd27df796ffadad20958a7712dfbc8e1c8c7eb68b020673fec4837a4e4d279cf5491fc845dccfc0b35cb244a2cc9af88ffc8fd0b92a6af63cce435cdf7515
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 11c0215a6d4150652f0729c88c8c5e6c1fefd16e9c7d677431674f3e21cd1428
MD5 3df83d9c04e01fa90f72d0b1fea22ecb
SHA1 a29babf10a7e5cb43c326c9e0d52952fe2cc8375
SHA512 a6681cf4102d8a7dacb35e45fff30193bb45a7460976a9724bd0748ca5457f783a7ee29652efaab21042256e4e3ea81478241d878d0be01717c17d37899205dc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6960c4aef7c7a6ddf3f0a7029a43a4fed196d2cc71e3206ad7192c922a457644
MD5 c72679b7928f6ac62f38ace2f0481fbe
SHA1 5c2b04a2e5f580884e51dc81c672a6f96fb80e9a
SHA512 52319f12bd88ac17101b02876d34ea91e3f2b0d613c04a59da919ff88fe5a59c6b198260a48f9947e6ec3a26ecc4ab47f87dee8c15aaa565af21567b74951db2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 86c0a1483e20cc2a38184e3eada597c0fdb28058f8fa55d554b7c2218c0d3b1b
MD5 a57c82989445e11bde8c77498902d303
SHA1 88508527b97c7eb9ec603a3c00fca5a2a2f2169c
SHA512 5cdf257a3ef6b8ac8d297d7800cc13e53bd8665d480b76f26f52113fb2ef0856f9a3af2931d2c740e09039af877ceaab48a3de763e87f229cffd55d49b24760e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3990792046de716ddb1d088c271ae742593d6bc8cb924d3df5022df087e9996e
MD5 d88ffc20b08760ba5a83b6029bae4ba1
SHA1 584f038e7fbb822ea462dada8f9e6d892ea50132
SHA512 21f33f88f1aecbc9288512647dd36bcf4602cac827af85c2b72a1805cef921b47e31848df408cf28ce0966429c5f1fcef34fe668056dbff3660cd2eec21ad00b
MD5 SHA1 SHA512

Submit Download

svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCCCBABCABCAACABCCACCABBCABBBCBBCABABABCBCCABACBACAC.exe
Size 243KB
SHA256 37ada18e30848ac9900f026c62ea1176570566f31ccbbe01e130764544ee78bb
MD5 c21804270c998bb05224ac56c34cddb5
SHA1 4add95712409c955d8ff1d2e24bb1e0f7a5c1851
SHA512 e18c29fa5fbffc8631c7ac39b409053a0a9599e98437c6e5eefc9945dd307116dd9b9c806325657ec025f7540cfd620df84a876c4e0f50a0be6325dd09a21f01
SSDEEP 3072:PdtpUtI9vTTLoFpmEY13XojAdoNdtpUtI9vTTLKkIkOk1XI8fNuRS:m+dTTUFgEs3XojAdP+dTTDFb1L7
TLSH
T1C1347D05F8875476D91A40F00D9FD2BFD670BE6286008DEAF7CD8A6F9C62F947225329
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 053a3ca6532c4f72b9d46fe7c774b9987b0a71061eeba97163b6b214d8a3c82c
MD5 7624684dc9712c07c3811acdd99fa794
SHA1 c0d624fefe65a7b39456897e6b3e89019cdaded5
SHA512 643e275b833d5ce46f99b58185062bb394afd531f600d84ec70bee683f25eea2f9ff2008779533209a8b7ee3c47a2b3f502db63b58e2e9f2e4f187cb0e2f2cd6
TLSH
T19C11A760C0EADC67F53368DFA6399F470CB0378FDC646A1413155218AF569368F25CE2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2896-72-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/3452-6-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/4996-66-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/6044-35-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/6044-22-0x0000000000090000-0x00000000000B1000-memory.dmp

Download