d63d8aa8cc4900667a555b579cd8d24e07a7e43525133cad48a736e80131ae54

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 13:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe
Size 3.2MB
Sample260912-qhpypscd54
SHA256 d63d8aa8cc4900667a555b579cd8d24e07a7e43525133cad48a736e80131ae54
MD5 0d9b03ffbcdd70f3eaed8890e219b8e8
SHA1 79706a9d19759e611b0ed70c21406c00073ea4d1
SHA512 be867b6e21c811d9c54c86b66f4ebbea0ea235e617f6fdb554338cfc85792d4dd56552988cc0a0e3ca685405a736ec7627e4d6da270f7fd711491e8019aa7eda
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EE:f
TLSH
T1EFF53B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4444	svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
4664	svchost_CBCBBACBABCCCCCBABABBCBBBABACACABBABBCBBCBBACABCBBCCCAB.exe
4684	svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBBAABBACBAABBCBBCCBACBACACCCCCCCCBABACAAAAACCCBABCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe"	2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCCBCBCAACCCACCACBAAAABBBBCAACAAABABBABBACBBCABAACCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBBACBABCCCCCBABABBCBBBABACACABBABBCBBCBBACABCBBCCCAB.exe"	svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
612	sc.exe
3664	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4208	cmd.exe
5812	cmd.exe
5920	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBBACBABCCCCCBABABBCBBBABACACABBABBCBBCBBACABCBBCCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5040	2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe
5040	2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe
5040	2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe
5040	2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe
4444	svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
4444	svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
4444	svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
4444	svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
4664	svchost_CBCBBACBABCCCCCBABABBCBBBABACACABBABBCBBCBBACABCBBCCCAB.exe
4664	svchost_CBCBBACBABCCCCCBABABBCBBBABACACABBABBCBBCBBACABCBBCCCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5040	2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe
Token: SeDebugPrivilege	4444	svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
Token: SeDebugPrivilege	4664	svchost_CBCBBACBABCCCCCBABABBCBBBABACACABBABBCBBCBBACABCBBCCCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 5812	5040	2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe	88
PID 5812 wrote to memory of 4404	5812	cmd.exe	90
PID 4444 wrote to memory of 2800	4444	svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe	91
PID 5040 wrote to memory of 5920	5040	2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe	94
PID 5920 wrote to memory of 612	5920	cmd.exe	96
PID 5040 wrote to memory of 4208	5040	2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe	97
PID 4208 wrote to memory of 3664	4208	cmd.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_0d9b03ffbcdd70f3eaed8890e219b8e8_elex_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBABCBCCCCACAACCBBBCBBAACABBBAABCABCCBACAAABCACBBACBBCCABBBBCBBACAABCACAABBBCCBAABCCABBAAACAAABAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACCBABCBCCCCACAACCBBBCBBAACABBBAABCABCCBACAAABCACBBACBBCCABBBBCBBACAABCACAABBBCCBAABCCABBAAACAAABAABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBAABBCCCBBBBBCAAAACCABBCCABAACBBBACCBCCCBBCBAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe" start= auto displayName= "UserDataSvc_BACBAABBCCCBBBBBCAAAACCABBCCABAACBBBACCBCCCBBCBAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBAABBCCCBBBBBCAAAACCABBCCABAACBBBACCBCCCBBCBAAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe" start= auto displayName= "UserDataSvc_BACBAABBCCCBBBBBCAAAACCABBCCABAACBBBACCBCCCBBCBAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBAABBCCCBBBBBCAAAACCABBCCABAACBBBACCBCCCBBCBAAAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4208
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBAABBCCCBBBBBCAAAACCABBCCABAACBBBACCBCCCBBCBAAAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACBABCCCCCBABABBCBBBABACACABBABBCBBCBBACABCBBCCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBBACBABCCCCCBABABBCBBBABACACABBABBCBBCBBACABCBBCCCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4664

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
1⤵
- Executes dropped EXE
PID:4684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f44f78af0b18bafaaa77f0c0d5b13961bb8b772ad8538827dc38c40255301c3
MD5 7175a5eb728e165cfaf4bbcc7494a548
SHA1 4b354bd8caa34a9db7884586d89733edf7a94eeb
SHA512 47e9341278ef6d08b3d5530fdfe4a61603d3933f62d8ffbb1765edb9a09ded6c9d53dab5e9293e4a93588db34b611f3fe70e73d0b3e87a9b04bf93a0d141fbc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bdfccc7aedb5cd0f67e52aae8dd9f543db98b1540fb21f472ee74b6a6c7d3e96
MD5 c7e979334379157d899e740a92d67c40
SHA1 aaa806f4505b5a37a4dbb73df17c846258250022
SHA512 8c23ecfaa1e33513742067d2a68185db4d070f3c462db9b82ba3746557c739d222aa243c401a74f8ce1c6e0fedc92187173b4667abc1044789366c8f44feaa41
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ddfb6ac977b64e7f1e2a4f995a35a94e98a4e83371b97c9fec9c4956b5a8165b
MD5 07c42795bb874110f2b4e88f5571cb1e
SHA1 f9119cea56d81e491b5371382a1d988efd6303f6
SHA512 e650e3d40c0b65aa374591a2016e8ae3a3432cee65541445d6a55daedd4c2e82e7e1bbdd76dcd2cddaff22e969dfd12264a86892778dad448514ec822e018e45
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 175497fed7973004099ca77070061218a61f16b691695f66bc82868104bef5c7
MD5 3df58fc9d72b63fc3b6944cdc73fa75e
SHA1 d7f6d483758c6ea9e1a26bdb01346d1642224986
SHA512 921354295d7aa550077d4e67b657791d23bb1a17569e968404933b2e1758a0101053cf947839ab6d295dd1dee4c26fba6d6c49a438f4f98e65ca27aa47e6a0e6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c33d3cbba560f1fa3ab66355fa007137cdb593013c388e2ade370d32040f5a8
MD5 816130b1d8baf6221d8f8423f841be5f
SHA1 c4243248b2fd62c861f58cd032c2b861ac5e8ef6
SHA512 dc21343b6c7083bf5f38090e5111d0b7e58aaa9c68f2051e498c940db5cf8b8e6e831573fc947b3475f810d4f4540473137bff6a6b94ee781434ef405781fa18
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f57c8cc303483f9dedcd11a4d9999b39abec74567938727bb95ba3dbb6e1c8f2
MD5 104fcc9f5919909f390c9da41955f87b
SHA1 258dd2c6dee469fa805cba0f9e331d99b199d794
SHA512 c11ab4330541febffdd923349db8300d29fa3f2032b984866173d20fdc48a91e2648102c94783b160c245e7bb0a51cada78bbe3f79395028c32c3d824e3fe368
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4afc0b821eb245d4b5a911ba5b502a5a7fe18b0369b61393eb8870d86e33d09
MD5 26e811c8ef91b18eac64f762b197eda4
SHA1 0a32fc81ec337af66486034ab6c5281d885b389c
SHA512 940df90ffb0e9716703e49fafd29bfa37e094afcd2f22f8b2f98561aa4dd0fd6a92f444c57ef8823012e00b1c345df1cb6dce93e5ff16b297135cefe5a58e10b
MD5 SHA1 SHA512

Submit Download

svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBBBCBCBABAAABABCBABBAABCCABABCBABAAAAACBBACBBCCBC.exe
Size 3.2MB
SHA256 d63d8aa8cc4900667a555b579cd8d24e07a7e43525133cad48a736e80131ae54
MD5 0d9b03ffbcdd70f3eaed8890e219b8e8
SHA1 79706a9d19759e611b0ed70c21406c00073ea4d1
SHA512 be867b6e21c811d9c54c86b66f4ebbea0ea235e617f6fdb554338cfc85792d4dd56552988cc0a0e3ca685405a736ec7627e4d6da270f7fd711491e8019aa7eda
SSDEEP 49152:U+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EN+EN+EN+EN+EH+EN+EN+EN+EN+EE:f
TLSH
T1EFF53B09FD4344B1D92B51B04DCFD2BF8660BB25C2128DF7FB4ECB5BA923BA16428255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2d0cf91b8a14fcf1da20e5af8bdbb8e01f27b59794d7368df7a6b9bc4ae1d4ff
MD5 b142f7287cf8fe5341525c7b2d76b068
SHA1 dd640c67a7e0333d9b589be40ad441f3b0cd5878
SHA512 822df3da11c99f298069bf69994dbef2546abf706c74030c5a91bbbe52dc90f1fce1087294bf7cf82522702b7237950027f8e3f2fd69f5330b7c6416df4922ed
TLSH
T154118FA1F0A6D893F571A4C787279BC6089C27FF586CAB18224B411DF789C369E150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4444-34-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/4664-74-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download

memory/5040-8-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/5040-0-0x00000000000F0000-0x0000000000111000-memory.dmp

Download