c4cdb928c049e9548a678f3e180e05c07671bd416abf05b104305e059bcf92fe

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
Size 4.0MB
Sample260910-28tkcsfa57
SHA256 c4cdb928c049e9548a678f3e180e05c07671bd416abf05b104305e059bcf92fe
MD5 cf3e9d0a527e0b5ec641daa7fd7a36b1
SHA1 286f72754b52d2c9883264ea9ecb6d1f2faae5c7
SHA512 59cdec593f12c2fea6464cb6f31d3f74f013ee09d5ebdf583e9fa0f34c7a825fc38ead4db76ba77efe0242d8272534bf88882a3e13ed54b7f5099ca4810e5ce7
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+Ee:Z
TLSH
T15D163B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6300	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
2292	svchost_CBAACBBBCAACCBABCACAACCABCACCABCCCCACBCBCABAABABAACCACA.exe
236	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCACBCCCBACABAABCCABCBACBCBCBBACBABBAAACBACBABBACBCBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe"	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABBACAACCBBCCACCCCCACBCACACABACABCCCCACAACCBCAACAACAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAACBBBCAACCBABCACAACCABCACCABCCCCACBCBCABAABABAACCACA.exe"	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5220	sc.exe
6756	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4360	cmd.exe
6556	cmd.exe
2956	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACBBBCAACCBABCACAACCABCACCABCCCCACBCBCABAABABAACCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
5412	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
5412	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
5412	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
5412	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
6300	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
6300	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
6300	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
6300	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
2292	svchost_CBAACBBBCAACCBABCACAACCABCACCABCCCCACBCBCABAABABAACCACA.exe
2292	svchost_CBAACBBBCAACCBABCACAACCABCACCABCCCCACBCBCABAABABAACCACA.exe
236	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
236	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	5412	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
Token: SeDebugPrivilege	6300	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
Token: SeDebugPrivilege	2292	svchost_CBAACBBBCAACCBABCACAACCABCACCABCCCCACBCBCABAABABAACCACA.exe
Token: SeDebugPrivilege	236	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5412 wrote to memory of 4360	5412	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe	93
PID 4360 wrote to memory of 6560	4360	cmd.exe	95
PID 6300 wrote to memory of 6488	6300	svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe	96
PID 5412 wrote to memory of 6556	5412	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe	99
PID 6556 wrote to memory of 5220	6556	cmd.exe	101
PID 5412 wrote to memory of 2956	5412	2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe	102
PID 2956 wrote to memory of 6756	2956	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_cf3e9d0a527e0b5ec641daa7fd7a36b1_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABBACBAACCBACACBABABBCAAACBCCACACCABBBCCCBABACCBACCAAABCAABCACAABABBABCBBCBACBABACACCBBCBBACBCBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABBACBAACCBACACBABABBCAAACBCCACACCABBBCCCBABACCBACCAAABCAABCACAABABBABCBBCBACBABACACCBBCBBACBCBACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6560
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCACBABACAAAAAACBBABBCCACCCCBCCBCACCBACAAAABCCBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe" start= auto displayName= "UserDataSvc_BCACBABACAAAAAACBBABBCCACCCCBCCBCACCBACAAAABCCBACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6556
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCACBABACAAAAAACBBABBCCACCCCBCCBCACCBACAAAABCCBACBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe" start= auto displayName= "UserDataSvc_BCACBABACAAAAAACBBABBCCACCCCBCCBCACCBACAAAABCCBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5220
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCACBABACAAAAAACBBABBCCACCCCBCCBCACCBACAAAABCCBACBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2956
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCACBABACAAAAAACBBABBCCACCCCBCCBCACCBACAAAABCCBACBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6300
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6488

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBCAACCBABCACAACCABCACCABCCCCACBCBCABAABABAACCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBCAACCBABCACAACCABCACCABCCCCACBCBCABAABABAACCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2292

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 cab5c035dbe686920d17d81c6f3ce2ebb7840f2e15df2bc2e81c5bde1f1a7032
MD5 69aacea9117d9a0aefc966f89f644eaa
SHA1 ae22b33d2e4c765bf673cd404bffbbdb92e1acf7
SHA512 28065403a7c7ba947a48a3783ee0b5626ce4d5f9c4f45cdd7b67a11e5b4bb62ac582e2887a06c9093b8f3d8dce8aeb6714edfd301c9157897f72a697da9c5198
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa7b3e4fd40ca0eae87a3aea8f593bdb056630e439a0162f30f22fe92d6f4fb5
MD5 029418513bac71736cde0423da4578cf
SHA1 f9b0fa3563f8ae9478ccf52a16f098aeda59d7de
SHA512 b42306a91e1fcd9c5501f3e92142f224b5331db5631e663b3739a48e0eb10469f0484f48724da00b87052578c92ce0c49421da0a7367c6f8cc65de2991ee69ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b7048795d4f0ca69b67e6dfaa49d5c525a804146c93a09f388dabdf64c3975e
MD5 c5c980541e6b0ba561df5fe0fe4581fd
SHA1 b1fc5b5584e08f0b19f49cc9633afd96d3cefcba
SHA512 11f51b992cd9178d36235f71a95bfd2542861b3c22d076f1ceebab297395c0b0fa19d8b11f42eee9fdacc3d7c931c55b61ead0ec13f9adde5ddf8302fade2667
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5d5e2411da249c8ff1ec7a9eb5240e23fa97adf65c6a9426f20df7c971ab9ad1
MD5 e64bbe61e371be29370e0cdd95d51a68
SHA1 5f8e2e5ad88f938592a47b0f4b863003c2956d1d
SHA512 ba09d568b62ef9212a2353f7daf83fa6f3979c96da1fc6c792752278845d67a969f4e5f1fd22edde685cfbbf65718b166f038a582bce4b77deb94969baf2f5ad
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 341d562bdbd54e1ca99116e2628d466a8db228dc2abebb8f26c82fd90185753b
MD5 fbe3ae42c735a42539a14079a263115c
SHA1 33b59bdebee712b1f6b7e98327a47c88a0bcd16d
SHA512 5547e572e65872e3c90ed00f76f6a0a2426be074cab954f36f41787dfbea66864d5a248bdd6c6b39141a0825bf5b1f56adbb820d31e7d52b031159b8c8d8ab83
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6137165f2cb648c0110f301d4d02d17e7153aa3a01cb25df263582e68d39a530
MD5 ba63f249bb846a4c4be75de982d96600
SHA1 6f1842034929875741aeb20ef36b4ae0e120fc32
SHA512 2a96491ecaeeaf0f5a55b8e41d25f6b1326a3aa002832c0dce3ad6218797af11e1bead50bbfd3962f2e3637187d089c6590dac42a573b547270ed67067279c6f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 67e24ed23889056b4ae8dbb203ee0124d2266586c14da10394b91b8c546a3cf1
MD5 1d78390ba2e3181b5fd6357339152a05
SHA1 b7c9b05725e018b0c60bf30c13c8b854e4b82b91
SHA512 d47d61b20542e4e2934ed27814a1166a24db8f5ed3aa206a9f2a6ba684495c866d533caf122bcefa70f2dd7875e867fb8853adb961e36f78ea6dd594fcba750b
MD5 SHA1 SHA512

Submit Download

svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABCACBAABCCBBACBBCCABBAABBBCCACBAABABABBACCBBACCABBC.exe
Size 4.0MB
SHA256 c4cdb928c049e9548a678f3e180e05c07671bd416abf05b104305e059bcf92fe
MD5 cf3e9d0a527e0b5ec641daa7fd7a36b1
SHA1 286f72754b52d2c9883264ea9ecb6d1f2faae5c7
SHA512 59cdec593f12c2fea6464cb6f31d3f74f013ee09d5ebdf583e9fa0f34c7a825fc38ead4db76ba77efe0242d8272534bf88882a3e13ed54b7f5099ca4810e5ce7
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+Ee:Z
TLSH
T15D163B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 945901d418d0c83f0db389753a4df895134510413f4f4298a45d8087b565eb42
MD5 63e69362606dc9b69d74b89ad5f7cab6
SHA1 edffed6e38233819479da7a7d94afb276146f9a7
SHA512 1221dea0d0903726e865294f76f8822ba37d09a6cbf7cc7fc69ec34b93e124ad1c99aa5b9448f004a6fb1fa5993ffb45ad9e3f030ddd3b5478da0bf65ad572bf
TLSH
T14511E060A0F5D877F020688B993A8F5709B0379BECACAB54631D4218E755C3A8E190E2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 774a2589e4ad3bdc4616676bf54cf9c902ca9f189de4948ca59473cde9dd0b33
MD5 f168606023c8808923e5505f1965af39
SHA1 bcc3df8e59ae741ac863ee5998fb52397721bc24
SHA512 138f2a8fee622b0e3cef4fe239408adea3fe7cff70f0fa58dc20d61b72d4859d15ddded7aeff57b05905b2ccbf879107f992b9ee273b95901610cfec927f9272
TLSH
T1FA21C060A0F5CC77F020788B9A39CF5709B0379BECACAB54631D5218E755C3A8E194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/236-81-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/2292-79-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/5412-0-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/5412-7-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/6300-33-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/6300-23-0x0000000000830000-0x0000000000851000-memory.dmp

Download