c2227d974bf3337af7b2a818526acfd774e799d432d36a7380f2b1a2c941e3b2

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 14:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe
Size 11.9MB
Sample260908-sada2ssvax
SHA256 c2227d974bf3337af7b2a818526acfd774e799d432d36a7380f2b1a2c941e3b2
MD5 88c6166735abf625e6ca2f1fba9c38b4
SHA1 8cd38686b8c18df2f28903aa070a608991d20307
SHA512 52f399737642518c9ccad35c3b5d7b26aec1dcf2f8a02b6aa88c46dec7472b0da7ce551d20b14c8e252de3fadc8127759995d23f1645efcb3ce12d9bf4c18c8d
SSDEEP 49152:U+ES+ES+E7+ES+ES+E8+E7+ES+ES+E7+ES+ES+EsXpH+ES+ES+E7+ES+ES+E8+Eu:S
TLSH
T189C64C05F98344B1D92B11B14CCBD3BF8A60BA2187228EE7FB4DD75FB932B916438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3340	svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
3536	svchost_CABCBCBABABCACCBABBCCABBBBBAABCBAAAAACCBAACBABBCCABAACB.exe
5472	svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAACBABAAABBACCACBBACBBBACCAACACABCAAACCBABCACBBACCAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe"	2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACBACCACCCCCCACACBCBBCBCCBBABBCAAABCACABACACCBBAACABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCBCBABABCACCBABBCCABBBBBAABCBAAAAACCBAACBABBCCABAACB.exe"	svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4708	sc.exe
4512	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5812	cmd.exe
4028	cmd.exe
2380	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCBCBABABCACCBABBCCABBBBBAABCBAAAAACCBAACBABBCCABAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4624	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1240	2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe
1240	2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe
1240	2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe
1240	2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe
3340	svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
3340	svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
3340	svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
3340	svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
3536	svchost_CABCBCBABABCACCBABBCCABBBBBAABCBAAAAACCBAACBABBCCABAACB.exe
3536	svchost_CABCBCBABABCACCBABBCCABBBBBAABCBAAAAACCBAACBABBCCABAACB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1240	2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	3340	svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
Token: SeDebugPrivilege	3536	svchost_CABCBCBABABCACCBABBCCABBBBBAABCBAAAAACCBAACBABBCCABAACB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4028	1240	2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe	92
PID 4028 wrote to memory of 4624	4028	cmd.exe	94
PID 3340 wrote to memory of 2692	3340	svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe	95
PID 1240 wrote to memory of 2380	1240	2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe	98
PID 2380 wrote to memory of 4708	2380	cmd.exe	100
PID 1240 wrote to memory of 5812	1240	2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe	101
PID 5812 wrote to memory of 4512	5812	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_88c6166735abf625e6ca2f1fba9c38b4_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBAAACBABACACCCBBCACCCBCCBACCCACCBABCAACBCBABABACCACBACBCBCACBACABAACCAAAACCCAACAACCBCCCBBBCCABCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBAAACBABACACCCBBCACCCBCCBACCCACCBABCAACBCBABABACCACBACBCBCACBACABAACCAAAACCCAACAACCBCCCBBBCCABCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4624
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAABBABACAACCCCBBABCACBCBBBABCCBABACBACACBBBAACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe" start= auto displayName= "UserDataSvc_BBAABBABACAACCCCBBABCACBCBBBABCCBABACBACACBBBAACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2380
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAABBABACAACCCCBBABCACBCBBBABCCBABACBACACBBBAACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe" start= auto displayName= "UserDataSvc_BBAABBABACAACCCCBBABCACBCBBBABCCBABACBACACBBBAACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAABBABACAACCCCBBABCACBCBBBABCCBABACBACACBBBAACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAABBABACAACCCCBBABCACBCBBBABCCBABACBACACBBBAACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4512

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2692

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABABCACCBABBCCABBBBBAABCBAAAAACCBAACBABBCCABAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCBCBABABCACCBABBCCABBBBBAABCBAAAAACCBAACBABBCCABAACB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
1⤵
- Executes dropped EXE
PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 649eb66e50c12bd8ca7c3c4a3f115b37b80a95c6bb38acb50c31822190514998
MD5 6d5db0682a552b4e12c5c5ccff6a352f
SHA1 d36ad2e3da077f5cfa51aa0bf875efccac0c8bf0
SHA512 23f1f1a1a3e2f92430c9be62a615a957a24ab415de20a0650a46172c610a17eab853b9287e032d553b9e72d4ced8a63246e0c4c2b00d59d5f8d1a946ca7d7757
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60e382be086842fbff203d8be16c3389c31807223e49648c239c24ad3d830b2c
MD5 44f66d4534a26d31bd4416d7a80a0401
SHA1 a5a25bbdc2c8dab6080c2be9f77e889b10c5f839
SHA512 ec54f4b11716e475efed6302afc2e2e4b03198ca0f6b47e5bbde5fab23bad89b7c0ad470d0a32dd7109cfb64b0cc45f6d17882fee132530de3ed7d4110febb59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b47b314749b1854d167b6dc3400eae27825bb5c01638c567fbb8422a01114e48
MD5 d780be41e26dfbde7f37f50d155a3a1d
SHA1 5cb936358ebeee4f21500ee886adc2056d03ab2b
SHA512 f75282648743434a02671caf53c0467ba22286f398b1449aa1dc080887cc7a6681caaf592a49b84bde502dbcf4b3fa150a58c6769b4aa53a58eeec51d9c96a28
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 92a0ca4e0188777962c5330ad8b0056f2f1c8e8a6ace1b27a65548dd811a1fb1
MD5 952e6a24218c66a4deafe820ff69c95c
SHA1 70a22aacbad525f6a57cbe28f90a4ab4e26b2298
SHA512 b1ca9221dd9007fa2a61a1e5809257b811a82c8456aa2113015caf9855f9589f73b5434f4d24932b10d331457552c8e514dc2879a2452e96d751104c4e103a14
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 42016d72448d925fe9e2cfa4c1f35d6a064b27b09b7b73bbc58930c79449692c
MD5 be630729f9c0278bd48842757bfb548f
SHA1 525847895ef373cc99baccd637ae8eadb48dedbc
SHA512 c6b91ce2830d8941ce266fe8688ce2683a0f3725a720101830bf5a919d9819fbbfa86b02af9ff89db2a23d5c38b3560947fd91ebce40e9d943a6c83b7f0b13fc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d23f389deb1e05beb76c04b3df04dafe95444da102daf1475e1a0d71da96fb6d
MD5 e544eba7bc18eb76ede92fdcad9b732b
SHA1 951961e20c7132decfe34d7b2c345e7b53d765f5
SHA512 253e2f7c845aa7ee1acb633c1305323e82042ad6ca705e31222f1f6920fdc7719e658edc436a38fdb8526b45be1311c0b7e88c7cc26da95dcd3380880e0ee0ce
MD5 SHA1 SHA512

Submit Download

svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACCCBABBBCCCCAAACBCACACABABCCACCBBCCBBACCACAABAACCC.exe
Size 11.9MB
SHA256 c2227d974bf3337af7b2a818526acfd774e799d432d36a7380f2b1a2c941e3b2
MD5 88c6166735abf625e6ca2f1fba9c38b4
SHA1 8cd38686b8c18df2f28903aa070a608991d20307
SHA512 52f399737642518c9ccad35c3b5d7b26aec1dcf2f8a02b6aa88c46dec7472b0da7ce551d20b14c8e252de3fadc8127759995d23f1645efcb3ce12d9bf4c18c8d
SSDEEP 49152:U+ES+ES+E7+ES+ES+E8+E7+ES+ES+E7+ES+ES+EsXpH+ES+ES+E7+ES+ES+E8+Eu:S
TLSH
T189C64C05F98344B1D92B11B14CCBD3BF8A60BA2187228EE7FB4DD75FB932B916438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 7ffc801b9075095595664e9f72446a1b737e511d5654b04a3afd54a6c5f7aea7
MD5 b6325f0b0e38b32e5d156a98592dc27d
SHA1 faf873d242aab4fe66e06eaa8955d9a6d6410e10
SHA512 36e1e657e775d2a926223891dcea729f6895111eed2d801761f4f4e0d8f3d0bae181c258e6b767953aaf16c5bf28d1557037a44161c51b85406139ce979fbf8e
TLSH
T1DF1108207465D493F93228C35635DFCB1C983F9F7C9CAB0C134E4219A69883A8D594F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1240-0-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/1240-7-0x0000000000DC0000-0x0000000000DE1000-memory.dmp

Download

memory/3340-33-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/3340-23-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/3536-79-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/5472-81-0x00000000004F0000-0x0000000000511000-memory.dmp

Download