8d2128bc5aa6341ab53ef9592d2cf2666e8e94ffcc219994a213b851698cab4e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 06:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe
Size 15.9MB
Sample260910-g2f1gazbma
SHA256 8d2128bc5aa6341ab53ef9592d2cf2666e8e94ffcc219994a213b851698cab4e
MD5 3d7bce7e3eec7d69ffffe524acd03cf4
SHA1 7b6ab307f0fd0a27cf5bb29bfae1c8618b2f2d56
SHA512 912d8a53fd5d029536be46d7c5e4a82aa875ad5147d675803f7e69bffa983e43cc8cfe18984c6e23ba3a6f2b504ee7bf8dec76d95e70340b24c49ae3252ec635
SSDEEP 49152:U+ES+ES+E7+ES+ES+EV+ES+ED+ES+E7+ES+ES+E7+ES+ES+E7XpH+ES+ES+E7+E2:b
TLSH
T1ABF63C09F98344B1D96B11B04DCFD3BF8A60BA2187128EE7FB4DC75BA933B916438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1072	svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
2500	svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
4960	svchost_BBABCCBBBCBBBBCBCABBBAACABCBCCCCBCBACABCABBBCABBCBBCBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCACCACCABBAACCCABCACACCBAABBBBBCAAACCABBABBAABCCBABACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe"	2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCABAAABCACCCAABACAACCBCACCBAACABAABCABCBACACCBCCAAACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABCCBBBCBBBBCBCABBBAACABCBCCCCBCBACABCABBBCABBCBBCBAA.exe"	svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2076	sc.exe
912	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4628	cmd.exe
632	cmd.exe
2708	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABCCBBBCBBBBCBCABBBAACABCBCCCCBCBACABCABBBCABBCBBCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1256	2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe
1256	2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe
1256	2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe
1256	2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe
1072	svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
1072	svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
1072	svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
1072	svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1256	2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe
Token: SeDebugPrivilege	1072	svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2804	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 2708	1256	2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe	107
PID 2708 wrote to memory of 4004	2708	cmd.exe	109
PID 1072 wrote to memory of 4656	1072	svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe	112
PID 1256 wrote to memory of 4628	1256	2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe	113
PID 4628 wrote to memory of 2076	4628	cmd.exe	115
PID 1256 wrote to memory of 632	1256	2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe	116
PID 632 wrote to memory of 912	632	cmd.exe	118
PID 4656 wrote to memory of 3160	4656	notepad.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_3d7bce7e3eec7d69ffffe524acd03cf4_amadey_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACABACBCBCCCBACCABBABABCCBBCAABAAACABBCACAAACACABABABCCBABABBBABCCBCCCACAABBCBCCCAAABBABABAAABCCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2708
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACABACBCBCCCBACCABBABABCCBBCAABAAACABBCACAAACACABABABCCBABABBBABCCBCCCACAABBCBCCCAAABBABABAAABCCCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCAACBAABBABBBAAAACBCBACAACCACCCAACACACCBBACBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe" start= auto displayName= "UserDataSvc_BBCCAACBAABBABBBAAAACBCBACAACCACCCAACACACCBBACBBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCAACBAABBABBBAAAACBCBACAACCACCCAACACACCBBACBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe" start= auto displayName= "UserDataSvc_BBCCAACBAABBABBBAAAACBCBACAACCACCCAACACACCBBACBBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCAACBAABBABBBAAAACBCBACAACCACCCAACACACCBBACBBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:632
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCAACBAABBABBBAAAACBCBACAACCACCCAACACACCBBACBBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4656
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
1⤵
- Executes dropped EXE
PID:2500

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2804

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCBBBCBBBBCBCABBBAACABCBCCCCBCBACABCABBBCABBCBBCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABCCBBBCBBBBCBCABBBAACABCBCCCCBCBACABCABBBCABBCBBCBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f7ad77f47b636b2e3e13e908a57990af75ebe4f5f4d400488b178c7c41c21f3a
MD5 cee1e07065a5135dd00e57906f71dd0e
SHA1 e3f5c7be99eff2785c233684a322705f5e9f6643
SHA512 45b506243b075997a4c93dc58259af1820b7136bb60195df88e066e1fa1560d11dbfd928b16e234a1bd5bdad89d2c5a69c8daa321881fc7f3ff31ae59ce2a7d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 28e4baa03748ca675990dd32d50030053f3066c5cfcee7bb17d5173d0515a6c2
MD5 974ea7fddab3cd5a9de11577fa8dd372
SHA1 5e5b05bcf9773d9e7681c69ad3be724d6041f7ae
SHA512 7ea7b8bb92d58b17482d41b8e58009c1844c77e31ab13c654fde18f3f2c6a32138cc2bfe1602960e7d4d0a3878b521f05fa4d4758bf362eb06ce16b4f8f4461c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c1248935884f7e635f921395b2ce3b84e7e14d833d5d51e1a1d0eb287090e503
MD5 a4a9f00cf1f35f80b1abbba701112e7b
SHA1 03c17a00d737d1ce6846d460402439a9073a1953
SHA512 e53c10a7829c924be69cda31625dcb0c57bf6f3968ccf14bc9d0101c3acf1101acd39757f9f1d66e7f738931ec6f49db70a85ca9482b0d1e9e56df93ce3ec496
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4f8e61be0d074938be58903d8db09f3e0b8ff9da6137b772c23b709a082767cd
MD5 bb6c280ba7048878f7d1f4f182863657
SHA1 0bf8f173f21764271ea3a8bbc775ee34624af8e5
SHA512 202a7589ff0c62b0d18cf69ed515a7e68e68d590b0fbb7c847bedf56b9c452d1133340988745637d785fb9766dff2d8a2ba7cf6565d5721973887f5ac15db6f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c370c526ec64b6c46de4157cf33689b07c8cad8e87e47600fb8f7cfa43bbbcdf
MD5 b702f10a75dfe8f78865b3ae31bcb6e9
SHA1 59b1ead42992121f63aae99f8f77661240e2ed81
SHA512 850f98549a0a978bf9880a49d4ea0a87f768054e47885152608daee8b6cc83cfd8ca412894f08f3e826c5cd3a1196d730b0c6ca19e698fef325447d4de8f61f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c66d7d97d63692b89c0940fd1f5b08132a77fcb027d15519cec225482505cee3
MD5 5e61f0f7f342423e155cb2724f5bdd82
SHA1 89732e658b2129035d3c4ab49daf2b471fb26ab8
SHA512 a6de603f667bcabc607b1be733fb7e531185c7a07276d248fd5eafd0601b87dac1af06ab01640bd44daae34e5d6ece8d72bc8be06c6c63cc29c13b846a9d0442
MD5 SHA1 SHA512

Submit Download

svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCACBCCAACAACAACBCCBCCABABBCBBBABBAAABABAACAAAACBBCBAA.exe
Size 15.9MB
SHA256 8d2128bc5aa6341ab53ef9592d2cf2666e8e94ffcc219994a213b851698cab4e
MD5 3d7bce7e3eec7d69ffffe524acd03cf4
SHA1 7b6ab307f0fd0a27cf5bb29bfae1c8618b2f2d56
SHA512 912d8a53fd5d029536be46d7c5e4a82aa875ad5147d675803f7e69bffa983e43cc8cfe18984c6e23ba3a6f2b504ee7bf8dec76d95e70340b24c49ae3252ec635
SSDEEP 49152:U+ES+ES+E7+ES+ES+EV+ES+ED+ES+E7+ES+ES+E7+ES+ES+E7XpH+ES+ES+E7+E2:b
TLSH
T1ABF63C09F98344B1D96B11B04DCFD3BF8A60BA2187128EE7FB4DC75BA933B916438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1072-78-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/1072-55-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/1072-37-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/1256-62-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/1256-36-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/1256-0-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/1256-24-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/1256-84-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/1256-11-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/4656-89-0x0000000002B90000-0x0000000002B91000-memory.dmp

Download