a163d407340b5983cbea488b07e2108647cb1a9dbf3b49ccc175f87008a8e082

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 11:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
Size 7.3MB
Sample260905-m7bwladd55
SHA256 a163d407340b5983cbea488b07e2108647cb1a9dbf3b49ccc175f87008a8e082
MD5 4f992ac3ce91eb26badbbb9e7a14d4e3
SHA1 22c29d84c62091752482e986f2f88a81d79727b7
SHA512 219cebb4eaa56bd86e62e0576b333791a3dd893f7c99d92f833925d1199343551b4fde17fe33b746927c7d9c58252cdea02618dac7b99e70360ba0dbd8a4e160
SSDEEP 49152:U+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESmF:G
TLSH
T14E762B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
728	svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
2872	svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
3264	svchost_BCCCAABBBACBCBBACCBBBBBBACBCACCCACBCCAAACAACBAABAACAAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBBBABCACBCACBBBBBCACBABBAABBBCCBABAACABCCAAABBAACBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe"	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCBABACABCBCBAABCCCBCBBBAABBCCBBAABCBBCCCAAABBBCCABBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCAABBBACBCBBACCBBBBBBACBCACCCACBCCAAACAACBAABAACAAAA.exe"	svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1096	sc.exe
4592	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1396	cmd.exe
4500	cmd.exe
4972	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCAABBBACBCBBACCBBBBBBACBCACCCACBCCAAACAACBAABAACAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1960	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4584	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
4584	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
4584	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
4584	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
728	svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
728	svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
728	svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
728	svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	728	svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2568	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 4500	4584	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe	106
PID 4500 wrote to memory of 1960	4500	cmd.exe	108
PID 4584 wrote to memory of 4972	4584	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe	115
PID 4972 wrote to memory of 1096	4972	cmd.exe	117
PID 4584 wrote to memory of 1396	4584	2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe	118
PID 1396 wrote to memory of 4592	1396	cmd.exe	120
PID 728 wrote to memory of 2980	728	svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe	122
PID 2980 wrote to memory of 4288	2980	notepad.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_4f992ac3ce91eb26badbbb9e7a14d4e3_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBCAAABBCBBAABCBBAAACBCCAACBCBBAABBCAACACCCCACCCCBBBCBACCCAACCABBBAAABCBCCBCBACBAABCBCCCBBABCACBAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBCAAABBCBBAABCBBAAACBCCAACBCBBAABBCAACACCCCACCCCBBBCBACCCAACCABBBAAABCBCCBCBACBAABCBCCCBBABCACBAABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABACACCCCAAACCCABAACBCBACCBBCCBCBCBBCACABCBBACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe" start= auto displayName= "UserDataSvc_AAABACACCCCAAACCCABAACBCBACCBBCCBCBCBBCACABCBBACAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABACACCCCAAACCCABAACBCBACCBBCCBCBCBBCACABCBBACAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe" start= auto displayName= "UserDataSvc_AAABACACCCCAAACCCABAACBCBACCBBCCBCBCBBCACABCBBACAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABACACCCCAAACCCABAACBCBACCBBCCBCBCBBCACABCBBACAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABACACCCCAAACCCABAACBCBACCBBCCBCBCBBCACABCBBACAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4288

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
1⤵
- Executes dropped EXE
PID:2872

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2568

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBBACBCBBACCBBBBBBACBCACCCACBCCAAACAACBAABAACAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAABBBACBCBBACCBBBBBBACBCACCCACBCCAAACAACBAABAACAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 afea51fb857acda1c60685a44227c8a6615c747cf79bf4cda225bee46386892d
MD5 fbadee202232d0f0dfd334f7a8233335
SHA1 7b04ba5684b82940a2e4b099ba3ca634d5bb0451
SHA512 b92e0b7ddfb6c72a90420a97163b7067984b981a0ab3c82d253b986c5c8165d67a00d8ceb5239b9eb7668427e1dfe4437d7931a0bac08519f4c0fcb0bca10882
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5726bbf19799f8a29476078ee2eef0713788c9cf9539046b3072a4279e248ab4
MD5 e8d9c855c1c2ba423261225e0a397012
SHA1 502bab9c8b25ba95903a172b5d5b93494c787c16
SHA512 95b17420102991e8d279248feb248c6fc6e87463f12d527813856bc47dace43cdf5180579160ac9beaae67bf3a34587cacd8d2a528f5e327df351d0b483291b8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a114ba8a859d6d403126ccb2d659e3aa9ba3aecee1a44209d0eb5e643cebbf9e
MD5 9d09d999fb1be5c5daabc32d94f56bb0
SHA1 ffad15c03e5e1cbf517e948307b2e982e00a2a9f
SHA512 b5d4cfd10766759b7c8768bf8bcdf75294ad2d00d68340a619782ff90d7a3c120113c395ae49beff63ce4f1ec50fdb058466b66fbbbe746c4285159f9a25b21b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 fd220c21f4ecb85663eef8388357c4968269061bf2a1087e74c1e9c3fafa2c31
MD5 53ee9bcc2c048585d40b99f5f07cfbfd
SHA1 298eb44174b3c2e4aa8a7acb0d716804667772ee
SHA512 bee298cd008ae98a396e1a32fc0d67292ebfae755d892e32f0755f8a9239d4cc0c926871f8b61a0ce46d568fb0f77b5835d6cffc8208f152bb0c78006bad4fe6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 02c4eb6a9282c5ba7faa056911e885ea524a781fad79e17cdd54ca739273bd2f
MD5 8ecd5f4c7041e4a4e068ac8962c44641
SHA1 96bb82490c7799c3f24cfa0cbfd61e640a57b00a
SHA512 3059997a22bd720fe5724b6390e2284430fd5468a0284846a592db7a65c8f46efff8479b72f833d56482643ce8f448e75808f4b65d0fc961ac41d16f5b1a90b8
MD5 SHA1 SHA512

Submit Download

svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBAABBAACCCBBCBABBCBAACBBACBAACCBCAAABBBBBACBAAAC.exe
Size 7.3MB
SHA256 a163d407340b5983cbea488b07e2108647cb1a9dbf3b49ccc175f87008a8e082
MD5 4f992ac3ce91eb26badbbb9e7a14d4e3
SHA1 22c29d84c62091752482e986f2f88a81d79727b7
SHA512 219cebb4eaa56bd86e62e0576b333791a3dd893f7c99d92f833925d1199343551b4fde17fe33b746927c7d9c58252cdea02618dac7b99e70360ba0dbd8a4e160
SSDEEP 49152:U+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+ESmF:G
TLSH
T14E762B09F98340B1D92B50F04DCBE3BF8A60BB25C6128DF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/728-25-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/728-38-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/2872-74-0x0000000000790000-0x00000000007B1000-memory.dmp

Download

memory/2980-67-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/3264-82-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download

memory/4584-6-0x0000000000D10000-0x0000000000D31000-memory.dmp

Download