548de89fd58365b0885eddcbb7542bec3d1f39ddf4659b8c4b17fe3f3cbaaf84

Analysis

max time kernel
149s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe
Size 231KB
Sample260905-svflxaxeke
SHA256 548de89fd58365b0885eddcbb7542bec3d1f39ddf4659b8c4b17fe3f3cbaaf84
MD5 2cd511cddfe5ad7a01f0e498fe9276f0
SHA1 6d52afb4e1c7a13a513222686fc5922a4ee98013
SHA512 c752f432d2163ed85b52046dd15bdbebbb45c0752036bb241977841d02beded2407f6488180c78f221924c51e9f38b4e364b369e3fc9d80874ee829a3f06c841
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAdkNV1:mgUFgEsnojA9gUFgEsnojAeb
TLSH
T18C342909F98744F1E93B41B04DDBD2BE8530BA2587128EEBF649C70F6933BE15839616
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1076	svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
3736	svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
6056	svchost_CABBBAAAABCBCABAABBCACAACCCAAABCAACACABAACBBACBCACCCCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABBCCBBCABBACBCBBAAAACCCBBBBBBBABAACACAAABBBBBABBABAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe"	2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCCCCACABCBCBAACCCBBBCBCBBABCABCCBABBCCBBBBBCBCABBACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBBAAAABCBCABAABBCACAACCCAAABCAACACABAACBBACBCACCCCCC.exe"	svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1668	sc.exe
5916	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5724	cmd.exe
864	cmd.exe
1228	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBBAAAABCBCABAABBCACAACCCAAABCAACACABAACBBACBCACCCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1204	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1272	2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe
1272	2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe
1272	2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe
1272	2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe
1076	svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
1076	svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
1076	svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
1076	svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1272	2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe
Token: SeDebugPrivilege	1076	svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 5724	1272	2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe	93
PID 5724 wrote to memory of 1204	5724	cmd.exe	95
PID 1076 wrote to memory of 5564	1076	svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe	96
PID 1272 wrote to memory of 864	1272	2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe	97
PID 864 wrote to memory of 1668	864	cmd.exe	99
PID 1272 wrote to memory of 1228	1272	2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe	100
PID 1228 wrote to memory of 5916	1228	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_2cd511cddfe5ad7a01f0e498fe9276f0_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAAACAABCCBBABBCBCBCCCCBCACCCCBABCBCCBABCBCBBBCACBAAACCABCCAABCACBCBABABABCACAAACAAABBAAABBCCBACCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAAAACAABCCBBABBCBCBCCCCBCACCCCBABCBCCBABCBCBBBCACBAAACCABCCAABCACBCBABABABCACAAACAAABBAAABBCCBACCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAAABCABABCACBBBAACCCBBBCBCBBCAAAACCCABBABBCCBAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe" start= auto displayName= "UserDataSvc_AAAABCABABCACBBBAACCCBBBCBCBBCAAAACCCABBABBCCBAACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:864
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAAABCABABCACBBBAACCCBBBCBCBBCAAAACCCABBABBCCBAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe" start= auto displayName= "UserDataSvc_AAAABCABABCACBBBAACCCBBBCBCBBCAAAACCCABBABBCCBAACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAAABCABABCACBBBAACCCBBBCBCBBCAAAACCCABBABBCCBAACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAAABCABABCACBBBAACCCBBBCBCBBCAAAACCCABBABBCCBAACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5564

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
1⤵
- Executes dropped EXE
PID:3736

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBAAAABCBCABAABBCACAACCCAAABCAACACABAACBBACBCACCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBAAAABCBCABAABBCACAACCCAAABCAACACABAACBBACBCACCCCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fe3b7a5df67bc5650d5c8903ed2210f39be679b26fa23ef4cbce91919cfe6037
MD5 7e3d8d8997a5f1d7422cd8a38396d910
SHA1 2b1997375587801862f12d1afbc1546f63c5b107
SHA512 7e5386d013426444ee46c2827c7d2e232215c4b870e1647d1b9f607a0e0371e1b64c1851233acf3960aaa7660ea5da7e48664292ab1aa8ea25765594dd59749e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 994f15cd65a5ff0eec3f3cf0a19c87fa248efbbdf97962764661c6880a393e2a
MD5 f777cc10a2e5b9cb620bf707c363395d
SHA1 f849fe42e8cb24b858a7c58cf76c04e26cd0786d
SHA512 bce2b8536507a640170caea96ac7345a57279801217072ba6b1701de834ec9ab2d511dd58f8982cc89a586c47dc26e58aad8da84f1a8b887e2cc3b912655b8ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0deddc50a4be410aaa76f57a7a68bdc926cbed358480e7096b9578ba10a639f7
MD5 5032274f1239505cf0f0588ac044aa39
SHA1 d1a654eecc87e95787edad1179d463e96abe3f12
SHA512 05c2e0d63e8138d0ba4c36e1b3e171555d759e67297dea21dbb073c770f728488b31e80660a670cead1ec7f2d0828c906ff1a0aac2e4443a209ba09ca08cfec9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 15c9d7f16f154cb7d77bc14b9057ca8b54a87a50121111118541417edd211b32
MD5 ae6bd6d062ec3ebaafae4fb378d17ff5
SHA1 b65e0d1a5bffed0ebcc581754c155838f90a9776
SHA512 6294879ef32e710ff879abeb55da2fe57a12e8d1276c2186f26fe441bc2071af7695294e19fa95f5c1aa9ab7f51e39fd9c3f97e57fe74efdfb10a6c1ba488d83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d7651de15b999c4390196a7efa1adfeb501026a9b1124d8d8798b9760de663df
MD5 7802c1e16730da6dd1a179fc92467a48
SHA1 f96cbad28c7c8d1aa88164a1174baf0778b9bf90
SHA512 366eac5be3dac44a6d0ba89a9bca4dfb79e6de82e7c58210462fabe2c83abc5708d1c9e1be2a38fd773284bc6d6b5cdc0b5b4946548fbc3d7acd4c7d7fc654e1
MD5 SHA1 SHA512

Submit Download

svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBBBBCAAABBBABABCCBABAACBCABBAACABAABBBBAAAABBAACBCC.exe
Size 231KB
SHA256 548de89fd58365b0885eddcbb7542bec3d1f39ddf4659b8c4b17fe3f3cbaaf84
MD5 2cd511cddfe5ad7a01f0e498fe9276f0
SHA1 6d52afb4e1c7a13a513222686fc5922a4ee98013
SHA512 c752f432d2163ed85b52046dd15bdbebbb45c0752036bb241977841d02beded2407f6488180c78f221924c51e9f38b4e364b369e3fc9d80874ee829a3f06c841
SSDEEP 6144:m+dTTUFgEs3XojAdP+dTTUFgEs3XojAdkNV1:mgUFgEsnojA9gUFgEsnojAeb
TLSH
T18C342909F98744F1E93B41B04DDBD2BE8530BA2587128EEBF649C70F6933BE15839616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-22-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/1076-35-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/1272-6-0x0000000000090000-0x00000000000B1000-memory.dmp

Download

memory/3736-66-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/6056-71-0x00000000001E0000-0x0000000000201000-memory.dmp

Download