5983f7c12c2610194abdd7aa6e2a2061d01379fd2507270c9a56d3dcc30c7277

Analysis

max time kernel
149s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe
Size 12.2MB
Sample260905-lndqeada85
SHA256 5983f7c12c2610194abdd7aa6e2a2061d01379fd2507270c9a56d3dcc30c7277
MD5 5d0ad01d3cdf937e27366d4a8ec47e9d
SHA1 21149a58cbb2fbd24a5af424fd952ca1b60504b5
SHA512 6d53ee867031db5f4994d309c7e9932eba6808b6eb3f66c1df31469a355fe74e688797b4adf48dfb3e34a64266e4815d01b412266592edf06db21ff39e52c4f1
SSDEEP 49152:U+ES+Es+ES+EzD+Es+ES+Eea+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+Eea+Es+I:up7V
TLSH
T1C4D62A09F98740B1E83B51B04DDBD3BF8A30BB2186128DFBF64DC75BA932BA15834655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4752	svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
1340	svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
2120	svchost_AACCCCCCACBBAACBABAACCABCBCBABABCBABCAAABCCACBBABBCACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBABBCCCCAACCBBBBABACCCABAACCACAABCCCCCBBBBCACABCCAAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe"	2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBAABCCCBCBCBBCAABAACBAACBACABCABBBCCCBBCCACCAABCCACAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCCCCACBBAACBABAACCABCBCBABABCBABCAAABCCACBBABBCACCA.exe"	svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4148	sc.exe
2632	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4312	cmd.exe
704	cmd.exe
5116	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCCCCACBBAACBABAACCABCBCBABABCBABCAAABCCACBBABBCACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4240	2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe
4240	2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe
4240	2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe
4240	2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe
4752	svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
4752	svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
4752	svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
4752	svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4240	2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe
Token: SeDebugPrivilege	4752	svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 704	4240	2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe	92
PID 704 wrote to memory of 4232	704	cmd.exe	94
PID 4752 wrote to memory of 3752	4752	svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe	95
PID 4240 wrote to memory of 5116	4240	2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe	96
PID 5116 wrote to memory of 4148	5116	cmd.exe	98
PID 4240 wrote to memory of 4312	4240	2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe	99
PID 4312 wrote to memory of 2632	4312	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_5d0ad01d3cdf937e27366d4a8ec47e9d_elex_stop_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACBCACBCBCCAABAAACBBCCCCABBBCAABCCABBBABBAAACBCCAABBABAABAAACBCABBACCCBBBCBBACBBBBBCCBBCBBCCCBCBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCACBCACBCBCCAABAAACBBCCCCABBBCAABCCABBBABBAAACBCCAABBABAABAAACBCABBACCCBBBCBBACBBBBBCCBBCBBCCCBCBCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCAABCBABBBCBCCCBCAACABCBCBCCAABCBBACCAAACCACACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe" start= auto displayName= "UserDataSvc_ABCAABCBABBBCBCCCBCAACABCBCBCCAABCBBACCAAACCACACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5116
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCAABCBABBBCBCCCBCAACABCBCBCCAABCBBACCAAACCACACCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe" start= auto displayName= "UserDataSvc_ABCAABCBABBBCBCCCBCAACABCBCBCCAABCBBACCAAACCACACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCAABCBABBBCBCCCBCAACABCBCBCCAABCBBACCAAACCACACCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCAABCBABBBCBCCCBCAACABCBCBCCAABCBBACCAAACCACACCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3752

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
1⤵
- Executes dropped EXE
PID:1340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCCACBBAACBABAACCABCBCBABABCBABCAAABCCACBBABBCACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCCACBBAACBABAACCABCBCBABABCBABCAAABCCACBBABBCACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f63aaa31edf63cd737ed5f82c09032024aac935a09f56ba2bd066dfc8138a927
MD5 7608351d7a2a36fffb64de7e7c0a0a7d
SHA1 7e687a07b58a1d2e5a28a8d6dcbff17ed99ac169
SHA512 281794db098aa0951822eb2a8286f618c65eca4a2d03fdaf3c371c174369063f321285626b4dd423d6b1c55b16463a70dc91b9785410fddc91687c6b56b0d7ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d77399f138f554e051aeea88708ed726e0bc3c83d395a62d7d85587ecfd5b50d
MD5 b7cd812e962d59335b918d72e561821c
SHA1 f834a000ee255c3cec1670e88cd9e94e88bca8ca
SHA512 95d1ea73a24fdfa40c8be879d2fd78c07db5d3a8465696745d5fde1934817d30abd39bdc0edf47f99bf04291129752b885742ae023f2012feb95067567220466
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1f50e1126258f2f30df8a43d971dacc04a23a75444469cb87811c0fb6240e2ef
MD5 a7ad4bd5230dc5d7bdefa6afcdb5ee69
SHA1 457d5eb21bf7984c45a1d562f765bb1dc6193b96
SHA512 ff0e4d8edf0967b5d3f92e7de285fc4443615ec647c0178b406713d69066ed0e22fed284868d1449e44de278b1505774848e486487b06424e4d02a8b7fe5f69c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5c69d19a6860471b951bb23c63b9326280e7af0305af45293061b63221dccca0
MD5 3dcd58d06e0fe4128fbb08ccb8ef82fc
SHA1 1499c9e6ec50a440e9b916358819ccb2e3b1d34b
SHA512 f34b4e536196bde34ff9e04dd6d9932a891e1f09ba881c295edb87a8de23a476fbc8d9211b660d90a24ad4b7bc9e5b10b91c2879e91f1340120fa585893b6388
MD5 SHA1 SHA512

Submit Download

svchost_AACCCCCCACBBAACBABAACCABCBCBABABCBABCAAABCCACBBABBCACCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCCCCACBBAACBABAACCABCBCBABABCBABCAAABCCACBBABBCACCA.exe
Size 10.2MB
SHA256 2e4a9297bb7493d88d416f840dd0c48760da76459c81d5c7db0bc0e7b65c0904
MD5 aa6a443084073f7b80e27dc2c2e01f0c
SHA1 ce73713dcde8c20532a526aa63d922293a3f6907
SHA512 516d52a1806bc1214310d631328c13a09e91ca4e5bdca46f0f70e437d538d556e155bdb32855c9290cfe2e8c36162b3fd038f46dd346a5bf3627320255069d13
SSDEEP 49152:U+ES+Es+ES+EzD+Es+ES+Eea+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+Eea+Es+5:B
TLSH
T1E9B62A09F98740B1E83B51B04CDBD3BF8A30BB2586128DFBF64DC75BA933BA15824655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACBBBCBCAACCCAACACABAAACACABBABCACBAABBCCAABABBBCCAA.exe
Size 12.2MB
SHA256 5983f7c12c2610194abdd7aa6e2a2061d01379fd2507270c9a56d3dcc30c7277
MD5 5d0ad01d3cdf937e27366d4a8ec47e9d
SHA1 21149a58cbb2fbd24a5af424fd952ca1b60504b5
SHA512 6d53ee867031db5f4994d309c7e9932eba6808b6eb3f66c1df31469a355fe74e688797b4adf48dfb3e34a64266e4815d01b412266592edf06db21ff39e52c4f1
SSDEEP 49152:U+ES+Es+ES+EzD+Es+ES+Eea+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+Eea+Es+I:up7V
TLSH
T1C4D62A09F98740B1E83B51B04DDBD3BF8A30BB2186128DFBF64DC75BA932BA15834655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4240-0-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/4240-8-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/4752-24-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/4752-34-0x0000000000870000-0x0000000000891000-memory.dmp

Download