46bc6f626b159e26079bfdfe10e96dad51552bc68f26255e59a4504bbf94f81e

Analysis

max time kernel
150s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe
Size 11.0MB
Sample260810-cgnscss1bw
SHA256 46bc6f626b159e26079bfdfe10e96dad51552bc68f26255e59a4504bbf94f81e
MD5 b82ce3aa3bc0fa35df32f2889dc2a744
SHA1 de08f2c39fcb44acd68940b640e1facc9d88cae9
SHA512 84647cb76837c739825fb86eab5c91d9c90131bd935e1169379e1f08f54e28ddd70b96e0ca4d24694d9bac15acf466616e4bffc9efd454f0d84bd43753cac576
SSDEEP 49152:U+ElwMV+ElwMV+ElwMzq+ElwMV+ElwMV+ElwMzq+ElwMV+ElwMV+ElwMzq+ElwMk:i
TLSH
T18BC67E1AF6980CE1E873517C8586C625EB72B4251B21CBCBB27C832F2F276D5AD39711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3992	svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
3140	svchost_AACACCBCBCCAACCAAAABBACBCCCCBBAACCCBBAAACCBABAACAACCBCA.exe
4216	svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABCBABBCAAAAAAAAACAABAACACBBBCCACBCBAABCBCCCCAACCBACABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe"	2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBAAACCCBCCACAAACBCCACABAAABAACABBBBCABCAABBAACCCABABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACACCBCBCCAACCAAAABBACBCCCCBBAACCCBBAAACCBABAACAACCBCA.exe"	svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3788	sc.exe
2360	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5104	cmd.exe
1076	cmd.exe
1876	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACACCBCBCCAACCAAAABBACBCCCCBBAACCCBBAAACCBABAACAACCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5212	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5428	2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe
5428	2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe
5428	2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe
5428	2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe
3992	svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
3992	svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
3992	svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
3992	svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
3140	svchost_AACACCBCBCCAACCAAAABBACBCCCCBBAACCCBBAAACCBABAACAACCBCA.exe
3140	svchost_AACACCBCBCCAACCAAAABBACBCCCCBBAACCCBBAAACCBABAACAACCBCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5428	2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3992	svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
Token: SeDebugPrivilege	3140	svchost_AACACCBCBCCAACCAAAABBACBCCCCBBAACCCBBAAACCBABAACAACCBCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5428 wrote to memory of 5104	5428	2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe	92
PID 5104 wrote to memory of 5212	5104	cmd.exe	94
PID 3992 wrote to memory of 1156	3992	svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe	95
PID 5428 wrote to memory of 1076	5428	2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe	98
PID 1076 wrote to memory of 3788	1076	cmd.exe	100
PID 5428 wrote to memory of 1876	5428	2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe	101
PID 1876 wrote to memory of 2360	1876	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b82ce3aa3bc0fa35df32f2889dc2a744_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBABBCCBBCCCACCCCCBCCBBACAABBCACCBBBCACCBABBABCBAACAABBACACCCABCBCBACABABBABAACBCCAABBBCACAAACBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5104
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCCCBABBCCBBCCCACCCCCBCCBBACAABBCACCBBBCACCBABBABCBAACAABBACACCCABCBCBACABABBABAACBCCAABBBCACAAACBACBBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5212
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABACBCABACAABCCBCAABBAABBABBCAAACABBBCCABAABCBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe" start= auto displayName= "UserDataSvc_AABACBCABACAABCCBCAABBAABBABBCAAACABBBCCABAABCBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABACBCABACAABCCBCAABBAABBABBCAAACABBBCCABAABCBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe" start= auto displayName= "UserDataSvc_AABACBCABACAABCCBCAABBAABBABBCAAACABBBCCABAABCBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABACBCABACAABCCBCAABBAABBABBCAAACABBBCCABAABCBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABACBCABACAABCCBCAABBAABBABBCAAACABBBCCABAABCBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3992
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1156

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBCBCCAACCAAAABBACBCCCCBBAACCCBBAAACCBABAACAACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACACCBCBCCAACCAAAABBACBCCCCBBAACCCBBAAACCBABAACAACCBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
1⤵
- Executes dropped EXE
PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 820b429e37acbb2a23941f88b092ce0dca085201a44192e014f4f1712c3eff03
MD5 ea0f8263184aec505420a159705eb23b
SHA1 172f4e0a244324e373c561d14940cf96b975de43
SHA512 1570244a0c41e2dc4754616c00f88b30e7199a8e5566b1e8952d1f023ab2c58551b5ed705ff200180fb610f697aa58780b54af7641e92e4e6a772c69d1d43744
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 705dfaf35be8cdcb0fd809c0a04578d04f876eced048151cc4e18c56c302e0a0
MD5 e7361f5cfa7c717bf4a3a4a303a5b9a4
SHA1 ef0817ff0d05511787ba0d04140378711ae80deb
SHA512 7308fa2489bddd6b38a20d65cd4658c3200d1be4d7c3d3e04cb1bfd7b00596c8c6b0c3a717d8a8223445cac291c46455c80e63be946b08abb307b14e2521a39d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a08a70e0abe08c3a8751ef3a1ec1035ef70ab3dae57643615c9de119c64bbd18
MD5 c727d3cc70ab7e8a59fe87557e31ffef
SHA1 60e75a01fae68043e7886248a5cf2965e5fe4f02
SHA512 3e6bb064206671923991693c660dfc2ccdcd22169afcdc81c995dc8bc5212bfc0f695e77dcaa26733ea94b421b1efc4aabc03988dc8563c9a8f97f2da6028658
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26d741c313980110d55e3afd7bc0b98217f773949b2c6bbe1ecd3cb8b0cfd66c
MD5 e6803e73a75f9c0dcecc388f8bcca6d2
SHA1 32f513a542307ec99a65c7f1f0bac634efb2f3db
SHA512 948acaee873853661e056690f7909889b2d4e2300ab974d340f31392cf4881a54942169db80a5debec1d6cbf4580c1579eab3e763051893c7d9df8fa0c6e2609
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1eeac5ae4069699a9633634bad6cbf7d4e049dc80b4d897c6ad7b9f038d5578e
MD5 720e41b7ef257338ae5434f6473a5219
SHA1 7542fa48ebe0d865382b45d7b3d41c4a5ad4a2ad
SHA512 1944a08975ffddb63138997a7143d4a405701f24a6e9dfaf28d1d1f70794605a0dac14da2841a0fa9af1a92de1a75087ec00bbe3fb965610fd8e29499dce11f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c3f15821bd407cb724fcec475bbd5cd0bd61a58402e236512f3de64bad7c2b7d
MD5 cc4e9b02ca53d61f5e25000f4c55a373
SHA1 c22ae12dfbba8365e7cb6dd91e145f236f066b74
SHA512 65adf4ec2dbbcc8041115b6ff3ccd93b702be747db5f8da36ecb98d3f92065b878d9999619cd39ff4597e5ffc3cba47a84320fdb29a398dbc73e5c585c740bb6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a723909691c3271d80cef6f1dd94aa5985306f091af00ac0285cf83df8b77562
MD5 87c6c2fea3221a46de4a7c0530444f5f
SHA1 cda1bc95442750d639a9e639ec968bac68f8de0f
SHA512 2d93342a816126617d005e515d6153ad51958f0cc430d38e99797866db49f5242bbc8f5c8cecb23fd72dfd2445b9dbb3b8f92405c04d087a6ac30af6b8b4b3af
MD5 SHA1 SHA512

Submit Download

svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBCABBACACBACBCBCCBBCBCAAAAABCCCCBABACAACACACCCCBBBCBA.exe
Size 11.0MB
SHA256 46bc6f626b159e26079bfdfe10e96dad51552bc68f26255e59a4504bbf94f81e
MD5 b82ce3aa3bc0fa35df32f2889dc2a744
SHA1 de08f2c39fcb44acd68940b640e1facc9d88cae9
SHA512 84647cb76837c739825fb86eab5c91d9c90131bd935e1169379e1f08f54e28ddd70b96e0ca4d24694d9bac15acf466616e4bffc9efd454f0d84bd43753cac576
SSDEEP 49152:U+ElwMV+ElwMV+ElwMzq+ElwMV+ElwMV+ElwMzq+ElwMV+ElwMV+ElwMzq+ElwMk:i
TLSH
T18BC67E1AF6980CE1E873517C8586C625EB72B4251B21CBCBB27C832F2F276D5AD39711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 71d4b04c851297b953e5169dfb268d7f5c77401184846b421bd80cf33d9a15a1
MD5 3095f94d18e7cb3b6562fccd9f272e48
SHA1 df923a58b5e25f184eee324110218f3e5eb628ef
SHA512 3b8c89bc630fe98e67783bc83d04869db331b6f05fa43161442a7e500b597c474f7e1639dcbb1e6923b8e368c8a27c4aaf4f3c2a178a2c1e6c4fef33d6683583
TLSH
T1A8117B62E8F9D817FA336CCF85399B731CE0379B6C586E5422085218BB45C70CD558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3140-64-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/3140-82-0x0000000000DF0000-0x0000000000E11000-memory.dmp

Download

memory/3992-34-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/5428-0-0x0000000000560000-0x0000000000581000-memory.dmp

Download

memory/5428-8-0x0000000000560000-0x0000000000581000-memory.dmp

Download