2aec1dd4a402aefed8cff26327af54ea9f23e2e7a4375fba345fd1ac1cde87f2

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 06:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe
Size 2.1MB
Sample260831-hedr9sfa47
SHA256 2aec1dd4a402aefed8cff26327af54ea9f23e2e7a4375fba345fd1ac1cde87f2
MD5 b07356f824a7518e8e47f2f526c5953a
SHA1 1101697f1362cea858ebe141e30347f187beff44
SHA512 bb78c7d0239f6b8320f39206182c3b2e583cd7b756e5d2fd710f178af2c7758e5a1f3e111c3cb45042c685b1388b5fcd70a628974d0b69738e2dff85e7f4849c
SSDEEP 49152:U+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EKW1PszNsQd:9W1PszZ
TLSH
T18FA55D06FA8740B1E97B61B00CDBE3BF49717B2584318E7AE74DCA1F6A33B11581935A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2704	svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
2952	svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
4556	svchost_BBBBBBCBAAAAAAACCACBBCCCAABBACAACBCAAAABCBCCACCBCAABCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCAACACBBBBCAABBACABACBBABCBCCBCABACAAABCABCBAABAABBCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe"	2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCAAACBACBCCCACACACCBCBCCBBACBCCACBCCBABAABCCACAABACBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBBBCBAAAAAAACCACBBCCCAABBACAACBCAAAABCBCCACCBCAABCBB.exe"	svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2740	sc.exe
2144	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5980	cmd.exe
5388	cmd.exe
4252	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBBBCBAAAAAAACCACBBCCCAABBACAACBCAAAABCBCCACCBCAABCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3156	2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe
3156	2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe
3156	2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe
3156	2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe
2704	svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
2704	svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
2704	svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
2704	svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3156	2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe
Token: SeDebugPrivilege	2704	svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3156 wrote to memory of 5980	3156	2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe	92
PID 5980 wrote to memory of 5380	5980	cmd.exe	94
PID 3156 wrote to memory of 5388	3156	2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe	95
PID 5388 wrote to memory of 2740	5388	cmd.exe	97
PID 3156 wrote to memory of 4252	3156	2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe	98
PID 4252 wrote to memory of 2144	4252	cmd.exe	100
PID 2704 wrote to memory of 1144	2704	svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_b07356f824a7518e8e47f2f526c5953a_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCBBBBAAABCBABCACABACAAACCBBABAAACCAABCACBCCCAAABCBABAACBCAAABBAACACBACBBCACCCBACBBCBCAAAAABCBCBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5980
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCBBBBAAABCBABCACABACAAACCBBABAAACCAABCACBCCCAAABCBABAACBCAAABBAACACBACBBCACCCBACBBCBCAAAAABCBCBCACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBCBAABBAACACBACBACBBBACCBBCCAABACAACBBABBAABAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe" start= auto displayName= "UserDataSvc_ACBBCBAABBAACACBACBACBBBACCBBCCAABACAACBBABBAABAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5388
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBCBAABBAACACBACBACBBBACCBBCCAABACAACBBABBAABAAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe" start= auto displayName= "UserDataSvc_ACBBCBAABBAACACBACBACBBBACCBBCCAABACAACBBABBAABAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBCBAABBAACACBACBACBBBACCBBCCAABACAACBBABBAABAAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBCBAABBAACACBACBACBBBACCBBCCAABACAACBBABBAABAAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
1⤵
- Executes dropped EXE
PID:2952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBAAAAAAACCACBBCCCAABBACAACBCAAAABCBCCACCBCAABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBBBCBAAAAAAACCACBBCCCAABBACAACBCAAAABCBCCACCBCAABCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fb6e9224c321688e09c29715b5230594b63cfad19e90c61d9f99799901771e90
MD5 3f8fa708696eeb62770aee0054d9277d
SHA1 2152a4eebe5b0b9a28f2a040ced880ff12c20442
SHA512 87253297da70d184044715fb4f015899b40de48180d828877762912d4340d3e3d316239e9453087fd00a76e3ba9fd24880daea29639b3f73b0132d242468b041
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f9660201464b3b6f05f71378c05b615c9b5da6f71b06e61126fee999683afd96
MD5 ca67c674bf5c74ae2d1299c4a080f4c0
SHA1 72a79ee37a38edea68b083a056e743927a1d6e36
SHA512 a924ac5e9054dbb809cf9c88e3398d8bd5a5b84bdd046393b1a55680c87dbd404a64423feed9ea173d1b87eb307427570e9d33a0cf69e827a0a41c757604b4d7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 81ce6af6ae034388ad6946a2b20a50ed7e9bd943c5793dc2ee008cc7b2cb6996
MD5 df497d0cf8e49b3131d9111f5f235ece
SHA1 1a2af70f12936d323419ec05a5bb236b519039a6
SHA512 ccf6af76a5957166c12ed0d621b6dfe94f3e9c6060e47a97890666088470204108c1fe3e5209d63e93f4cbab4d41865359a7c549560ea5d60e0fe98258779a32
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fc21199e36ab6abd8f35caaef7a218a9bbf72fda3785eedecdebad08345e901f
MD5 ddbb4951c3361421ebd5e2f7a524666c
SHA1 847b0199f72f170cf4dcb9bf0326231416b83616
SHA512 b28398046e86aa646b42b180ac572d6f7e020fb9d4f036d5e59758bcfcaaf5f94b71fea1f5f37ffa0f7de37c45b3324f3be52659078def104c00c532c9dfc549
MD5 SHA1 SHA512

Submit Download

svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBCACBACBCACBCABACCCCBCCBCAAACBCBBCBACCCAAABBCABAACBC.exe
Size 2.1MB
SHA256 2aec1dd4a402aefed8cff26327af54ea9f23e2e7a4375fba345fd1ac1cde87f2
MD5 b07356f824a7518e8e47f2f526c5953a
SHA1 1101697f1362cea858ebe141e30347f187beff44
SHA512 bb78c7d0239f6b8320f39206182c3b2e583cd7b756e5d2fd710f178af2c7758e5a1f3e111c3cb45042c685b1388b5fcd70a628974d0b69738e2dff85e7f4849c
SSDEEP 49152:U+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EKW1PszNsQd:9W1PszZ
TLSH
T18FA55D06FA8740B1E97B61B00CDBE3BF49717B2584318E7AE74DCA1F6A33B11581935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2704-23-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/2704-36-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/2952-66-0x00000000005E0000-0x0000000000601000-memory.dmp

Download

memory/3156-0-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/3156-7-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download