3f24403ee0500c5d8621664b8d45a358bb8e48b80b107aa6a9aba61f4e798f7f

Analysis

max time kernel
149s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
Size 12.5MB
Sample260910-clx7laef44
SHA256 3f24403ee0500c5d8621664b8d45a358bb8e48b80b107aa6a9aba61f4e798f7f
MD5 e1c2d33648f39541dc067dbb69669309
SHA1 7db224ce2aa0b70817379f80d596758f76625bcd
SHA512 bccd444366798b6bfdac8519c51f60fedbfbc0775cded79f47c44ca5149dac04509ca799ee34dc242703b7b9abfa80816a1d8153fc2c4b94bcf8071672bc070c
SSDEEP 49152:U+ES+ES+ED+ES+E7+ES+ES+E7+ES+ESwqp+ES+ES+ED+ES+E7+ES+ES+E7+ES+EG:K
TLSH
T1A0D66D14F9E60C72E5BB11B10DE7E27E0D30BB258225D9DBFA8D874F7823B905426792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2004	svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
1972	svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
3536	svchost_CBBCCBAACABACABACBABCCABACBABCBCBAAABCACCBBCBACAACABCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABAACBACABBAACCCCCAAABBABCACBBCCCAAAACBCBCACBAAAAACCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe"	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCABAAACBBBACBAAABCCAACBCCAABBBAABABAABBBAAAAACBCCABAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCCBAACABACABACBABCCABACBABCBCBAAABCACCBBCBACAACABCCB.exe"	svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2584	sc.exe
5072	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2664	cmd.exe
4876	cmd.exe
844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCCBAACABACABACBABCCABACBABCBCBAAABCACCBBCBACAACABCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3508	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4140	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
4140	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
4140	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
4140	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
2004	svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
2004	svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
2004	svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
2004	svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4140	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
Token: SeDebugPrivilege	2004	svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3188	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 4876	4140	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe	109
PID 4876 wrote to memory of 3508	4876	cmd.exe	111
PID 4140 wrote to memory of 844	4140	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe	116
PID 844 wrote to memory of 2584	844	cmd.exe	118
PID 4140 wrote to memory of 2664	4140	2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe	119
PID 2664 wrote to memory of 5072	2664	cmd.exe	121
PID 2004 wrote to memory of 3624	2004	svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe	125
PID 3624 wrote to memory of 916	3624	notepad.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_e1c2d33648f39541dc067dbb69669309_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBAACCCCBABACBABCABCBCAAAAABBCCBABCCCCCBAACBBBAABCABCCBABCBBBCBCCCCCBCCBABBCCCAACBBCCCAAACCABBABBABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBAACCCCBABACBABCABCBCAAAAABBCCBABCCCCCBAACBBBAABCABCCBABCBBBCBCCCCCBCCBABBCCCAACBBCCCAAACCABBABBABCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBACCCCBCCBBCBACBAACCBBACBBACCACACBACCABAABCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe" start= auto displayName= "UserDataSvc_AABBACCCCBCCBBCBACBAACCBBACBBACCACACBACCABAABCCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBACCCCBCCBBCBACBAACCBBACBBACCACACBACCABAABCCABAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe" start= auto displayName= "UserDataSvc_AABBACCCCBCCBBCBACBAACCBBACBBACCACACBACCABAABCCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBACCCCBCCBBCBACBAACCBBACBBACCACACBACCABAABCCABAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBACCCCBCCBBCBACBAACCBBACBBACCACACBACCABAABCCABAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5072

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3624
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
1⤵
- Executes dropped EXE
PID:1972

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3188

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBAACABACABACBABCCABACBABCBCBAAABCACCBBCBACAACABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCBAACABACABACBABCCABACBABCBCBAAABCACCBBCBACAACABCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CompressUse.exe

Path C:\Users\Admin\Desktop\CompressUse.exe
Size 25.2MB
SHA256 faa24fa6d97719e78e6c357795b63ab1ad928510f3e4927b0b88b4e81eb3e326
MD5 a6b7b22da0a6408aa1c427f41147570e
SHA1 17ff18a2e710893c012319f2b7bb255ce2a269b3
SHA512 58668a97af35eab898c06362cf33fe5fd218398fd865bf4cb9d95acfceb3a3b2f3f8a26172c0be09e5cdf0cc35c96b3aedeb985e35fb5ef2e67b65eee175ff9b
SSDEEP 49152:U+ES+ES+ED+ES+E7+ES+ES+E7+ES+ESwqp+ES+ES+ED+ES+E7+ES+ES+E7+ES+EV:R
TLSH
T1E7476D14F9E60C72E5BB11B10DE7E27E0D30BB258225D9DBFA8D874F7823B905426792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4c0991b77195869db93d91a08da9b5bb9c12033db18540812842aa4a86ba1ad
MD5 655e677451f52227a334aa1646c2cfcd
SHA1 43a1082a7c78723168b15537109125222fe72400
SHA512 8f36a47d8b904851f73ff3510020efb90743ab43c4087b5d556aa3886375cf0decb4d2f31a7f74b197f9d9e655264380ba2827407741bb099f2b0c309d8d0208
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 515d2cef225106910141630a4169be12efdb472b6da16128d6c1b1b2eedd2a7b
MD5 470eef1fcc4ab01a0df3e5318796420a
SHA1 1ba611ea0d2d3d82752f7d0cdcc17e3d87389348
SHA512 29b70ce0da71f99e7d4de5890795aab55661a6afe3e1d86162ca3f848e689b38052fa724a1349a4d44e7b49202eeca9dd14a0c62af78c8bf30b621e94ba674b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9cdd928ed467381640c55b55f1d3cafb85f1643fc887b2c77392fe55bdd8de9
MD5 dcd73709ad02440071ba097cdbd6832e
SHA1 5ea4862d4b831d202eb22e0d0ca8ea9c60190632
SHA512 349b8fee817479a7780b8c70b3a45812f36495ee3a788af72660609d3c81c5d2eb40220a1f13af9c80fb88f5c0608327ba795ed35a194349eb33dcb4a06855af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9235b4b8fdf3d838850ac37a2c3346033c1a2bd8b87baa7bcaf162f8c4c6ba16
MD5 5fa307be8613e8b5a3af3ac9b1a65875
SHA1 d4e32423aa70c40ee7d25ab0e8fc5ea0d9fcd405
SHA512 f11bc4a47ecdcf5ffbb781780b4c3e6e616ca5b7ca4f1f3711467d5348b99e6ed108ca5800e62ecee95abbf671132e3a15f91593e690794885fa279b4e29f983
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 114f89336467b373aea8d49f1f65d775aef17b0eed3cbd376b807fde525ba1b1
MD5 c5cd0b5b94849fde23233b91a46857dc
SHA1 eaf69e34325d63df97ab3d1f4e7e273cf863885e
SHA512 f19132af74228a04db12d4581a1fc9c0c5342813587da34ecd7a5bba38cf700ce75f1357a35a32fb3805b31d10d2d3e7fee1a82a7e1453ebfece3b1927dcf62b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a38308911e305a43f867628dfa8b7c3f6737996e53176470432bd56a7993c83e
MD5 fd63782080da784d735612a76d49816f
SHA1 44c2390ac1bd043d8bc30c411582d6d37a9b269b
SHA512 970a86a08b96f7236e1b91330f58057f23ff26843ecbf52a73b74cd761844b9f7ffb49cb26f173e03e0e69537645a11ffc1af36eb0be4deed874bdcdbac77c29
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8a6649099305c4470ec8cbf88138402e1ebc2e102df1d78630bb5fe4aae76655
MD5 44d20384d2e4e5af51aa6a5bbe5118c1
SHA1 75a21066420410906a045e0de8c29212ab51cf9f
SHA512 2952643dce3b235a4fca1298ff7def98d2cd65b3a9c69b6f7e3dbddfcf49a0e3bfa3ff53e7dcb3c425d35171d949a3e060e16b4608ea86b49523f8ce74ecaa6e
MD5 SHA1 SHA512

Submit Download

svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABCCABCACBBCCCCBCCBABACCBCAAACCBCCCCABCCCABAABBCCAB.exe
Size 12.5MB
SHA256 3f24403ee0500c5d8621664b8d45a358bb8e48b80b107aa6a9aba61f4e798f7f
MD5 e1c2d33648f39541dc067dbb69669309
SHA1 7db224ce2aa0b70817379f80d596758f76625bcd
SHA512 bccd444366798b6bfdac8519c51f60fedbfbc0775cded79f47c44ca5149dac04509ca799ee34dc242703b7b9abfa80816a1d8153fc2c4b94bcf8071672bc070c
SSDEEP 49152:U+ES+ES+ED+ES+E7+ES+ES+E7+ES+ESwqp+ES+ES+ED+ES+E7+ES+ES+E7+ES+EG:K
TLSH
T1A0D66D14F9E60C72E5BB11B10DE7E27E0D30BB258225D9DBFA8D874F7823B905426792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1972-116-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/2004-45-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/2004-68-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/2004-123-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/2004-92-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/2004-102-0x0000000000DE0000-0x0000000000E01000-memory.dmp

Download

memory/3536-125-0x0000000000300000-0x0000000000321000-memory.dmp

Download

memory/3624-109-0x0000000000B00000-0x0000000000B01000-memory.dmp

Download

memory/4140-46-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4140-108-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4140-79-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4140-30-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download

memory/4140-14-0x0000000000B20000-0x0000000000B41000-memory.dmp

Download