28baab9f45cf66ba578f1039679bb4bdf5c6929f08db7339f3d0043b2a34b540

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe
Size 306KB
Sample260909-sd9tesysby
SHA256 28baab9f45cf66ba578f1039679bb4bdf5c6929f08db7339f3d0043b2a34b540
MD5 9bf15f5b154933c2122c37d180a3173a
SHA1 5f4e67fef620c8f9378ab204dd95255dca61c41e
SHA512 bf4caa6d14a3cab4ee13abb31222a9319ec895fbd9a7590a6995f7f745eedc266263a122c4c835c295274c7c7850e6c653560c98e5be3254812da92832b7c98b
SSDEEP 6144:m+dTTUFgEs3XojASaVWdyzOxeA1DfdwX3MmIOMaPIJMCLH:mgUFgEsnojASMROxdDfOnMmXwSCLH
TLSH
T18864E00AFA5B40F2D56791B10CDFD3FF8AB07E2980128E77EB1AEB5FB927A111405215
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c4c9-18.dat	UPX

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3212	svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
5888	svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
4424	svchost_CBCBCBCABACBCAABBAAAACABABAACBAACCCCBABCACCAACBBBACBBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACAACCACACCACBBCAABAABBABAACBCBBCBCBCABBCCABCBAABAACBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe"	2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBABBCBBABCAAAACBAABABABAACBABCABCACCAABBCBBCBBABAABCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCBCABACBCAABBAAAACABABAACBAACCCCBABCACCAACBBBACBBCC.exe"	svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5168	sc.exe
2612	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2508	cmd.exe
2764	cmd.exe
5704	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCBCABACBCAABBAAAACABABAACBAACCCCBABCACCAACBBBACBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4456	2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe
4456	2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe
4456	2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe
4456	2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe
3212	svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
3212	svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
3212	svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
3212	svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
4424	svchost_CBCBCBCABACBCAABBAAAACABABAACBAACCCCBABCACCAACBBBACBBCC.exe
4424	svchost_CBCBCBCABACBCAABBAAAACABABAACBAACCCCBABCACCAACBBBACBBCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4456	2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe
Token: SeDebugPrivilege	3212	svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
Token: SeDebugPrivilege	4424	svchost_CBCBCBCABACBCAABBAAAACABABAACBAACCCCBABCACCAACBBBACBBCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 2508	4456	2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe	92
PID 2508 wrote to memory of 3232	2508	cmd.exe	94
PID 4456 wrote to memory of 2764	4456	2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe	95
PID 2764 wrote to memory of 5168	2764	cmd.exe	97
PID 4456 wrote to memory of 5704	4456	2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe	98
PID 5704 wrote to memory of 2612	5704	cmd.exe	100
PID 3212 wrote to memory of 1920	3212	svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_9bf15f5b154933c2122c37d180a3173a_coinminer_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBACAABAACCACCABABABAAAABBBBBCCCABAABCBCBACBBBBCBACABBCCACBABACAACACCBAACCCABCBCCCBCCCCCAACBAACABCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBACAABAACCACCABABABAAAABBBBBCCCABAABCBCBACBBBBCBACABBCCACBABACAACACCBAACCCABCBCCCBCCCCCAACBAACABCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCABCCBCABACAAACACBCBCCACCCBCBCBBABBBACBAAAACBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe" start= auto displayName= "UserDataSvc_AABCABCCBCABACAAACACBCBCCACCCBCBCBBABBBACBAAAACBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2764
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCABCCBCABACAAACACBCBCCACCCBCBCBBABBBACBAAAACBBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe" start= auto displayName= "UserDataSvc_AABCABCCBCABACAAACACBCBCCACCCBCBCBBABBBACBAAAACBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5168
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCABCCBCABACAAACACBCBCCACCCBCBCBBABBBACBAAAACBBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5704
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCABCCBCABACAAACACBCBCCACCCBCBCBBABBBACBAAAACBBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1920

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
1⤵
- Executes dropped EXE
PID:5888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCABACBCAABBAAAACABABAACBAACCCCBABCACCAACBBBACBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCBCABACBCAABBAAAACABABAACBAACCCCBABCACCAACBBBACBBCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d2940793c2057742c03d37101199b43faaab42f0f6b01bb6a133f808fafe6a10
MD5 375d318e8551887ac07c9cede2f193c8
SHA1 68ab8812b482077109d8d2165ae2395b00eef7ad
SHA512 93cb427afb1b62d1d09541e0c777b9078eeeb3c190614693e36bf620de96982bb471a92be52ff2c7d634236a48259fb32f49a5de40d58c90a3f29375b07b456c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73daed4b30c7ef761cc9af8bc4dfe7c997f14896c4367c2808f2a1108e1e2679
MD5 b2950d6a33f0e3e621bdc1d2129a02e4
SHA1 637da905ceb3bf820c2f199a5aee424bab487768
SHA512 426e65160b189376408e21a12d3065d6daa8c2c24e4340387634a2a9f0651c15511e1c5bf5215a5965ffc78d1bc744a2035f779c0d9755157eb3ca08147cd1a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1beb8f91fb9b161caa9d77ea31657a576da16e60433deb960742d964d72dabfa
MD5 05992851dd6b47e35705a1d19592cfe0
SHA1 17b07a39c34d9b01b6da2cd02c53bf27a73a5b6a
SHA512 7f12fcdf9211806567d71ed3517d7d3c5af8fa52bc6b2f9cd052e076514a21467fb85f672c394d7508fc62c9af294977b19a7a80687892fb55b817cc877a6708
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 58ad161a246f8b36585e5f471e88ea36e5f52ec28c56b015e569d10aaeaf4964
MD5 3cd1fb192e29310cdacbccf92292e526
SHA1 e11fdc231d885c41e4adb0a2173417437a748be1
SHA512 9a6eeb46fe99596194c919a3e3708435fafe6f7abdab5f3c877bbb65bcfb181f32e19682531b3bcd9b7594de81887e4ddd361e3f0ccfc7bd1bd2418752921def
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 398bff72659057e601cea9377bbfbfa23686ec17fd8a61fef68021b0e9ae616f
MD5 150c38c0bf68ba92e4a7716fd996804d
SHA1 67fe01dbb66e95d141e73966ac39a357a302fbea
SHA512 a155f5f2b833890f5d6a86dac9b9da3f1afca75588b78912b49043f12f28d65122d047768bdd9dad123451a2434f102c0f3d7961c582a9029f80cda91f3b9be4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 db6ef47499a78bfb423e68f3e1281af9f03ff257976240adc96901d62bc4bbef
MD5 a9fa6af9dc90abc012c6c90dbd945446
SHA1 bea6ae799d8cf48bd4b4c6334a4f312a25cbf176
SHA512 7ad31415d5ecf81ae73fe6650e0fc8407f4afe11b1c5a3dd681405517f0d20155fdaba315a5e102703c666956a95decd8ea6cce0f86f53e251506830babae9ec
MD5 SHA1 SHA512

Submit Download

svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCCBACBBABBBABCAACABABCCCBCBABAACBCCACABABCCCABBACBA.exe
Size 306KB
SHA256 28baab9f45cf66ba578f1039679bb4bdf5c6929f08db7339f3d0043b2a34b540
MD5 9bf15f5b154933c2122c37d180a3173a
SHA1 5f4e67fef620c8f9378ab204dd95255dca61c41e
SHA512 bf4caa6d14a3cab4ee13abb31222a9319ec895fbd9a7590a6995f7f745eedc266263a122c4c835c295274c7c7850e6c653560c98e5be3254812da92832b7c98b
SSDEEP 6144:m+dTTUFgEs3XojASaVWdyzOxeA1DfdwX3MmIOMaPIJMCLH:mgUFgEsnojASMROxdDfOnMmXwSCLH
TLSH
T18864E00AFA5B40F2D56791B10CDFD3FF8AB07E2980128E77EB1AEB5FB927A111405215
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 323040f895554389c79ba3270fe52f527c77ab0f6296dfd9a8d81b7df00e3ba9
MD5 e5c472e656f71bf8a75a205a3ff8b19e
SHA1 037636f1f88cd6e5bced2561ddecc18a4e873926
SHA512 6362b8b991778042f9dbe1cc44c73bd96af0512e2917a09be797c17bee5563b8697e652497570d0fd8a31467ae19c9e05911a67073d3e7deda6c6a25c3925b3b
TLSH
T17A11CD50B166D853F131B8C64A39AAAB0CE03B5F9C58AB545305431DF3D5C35DD564E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3212-22-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/3212-35-0x0000000000930000-0x0000000000951000-memory.dmp

Download

memory/4424-72-0x0000000000540000-0x0000000000561000-memory.dmp

Download

memory/4456-6-0x0000000000200000-0x0000000000221000-memory.dmp

Download

memory/5888-66-0x0000000000930000-0x0000000000951000-memory.dmp

Download