ea4f2c9556c4f473b116456a4f2cded903db3fa5a73243bb3b59bedb6f9d6705

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe
Size 36.1MB
Sample260810-cj8wbas1fs
SHA256 ea4f2c9556c4f473b116456a4f2cded903db3fa5a73243bb3b59bedb6f9d6705
MD5 abe4bcbf47426d025aed78a965ba0186
SHA1 4c54d7d0ab70378829f261365d70edff59bca286
SHA512 b55fba6fd3faab47be823596e63ee4617cbbbb7d52edc77ed7cf72185355331ae588a1608d1f44d8e4fc414c4a7d27d1cad23aad005ba6ac67ce82987dfe171b
SSDEEP 786432:jhasrhasrhasKhasrhasrhasKhasrhasrhasKhasrhasrhasKhasrhasrhasKha2:4
TLSH
T1C287F73CADA442A6D472C671C8A2B5EDEA2179127B005FCF61D2534E4D3FBD26C70E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
700	svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
3612	svchost_AAACABCAACAABACAABCCAACCBCCCBACACBCABBBBAACBCAABBACACBB.exe
5292	svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBBBAABACBBCCBCACCCACCBABBCBBCABBCACCACAABABCABBCCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe"	2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBBBBABACCCCCAACACCCCCBBBCAAACBBBABCCABCCACCBBCAACCCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACABCAACAABACAABCCAACCBCCCBACACBCABBBBAACBCAABBACACBB.exe"	svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4692	sc.exe
2960	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2288	cmd.exe
5400	cmd.exe
4728	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACABCAACAABACAABCCAACCBCCCBACACBCABBBBAACBCAABBACACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3692	2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe
3692	2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe
3692	2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe
3692	2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe
700	svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
700	svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
700	svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
700	svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
3612	svchost_AAACABCAACAABACAABCCAACCBCCCBACACBCABBBBAACBCAABBACACBB.exe
3612	svchost_AAACABCAACAABACAABCCAACCBCCCBACACBCABBBBAACBCAABBACACBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3692	2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	700	svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
Token: SeDebugPrivilege	3612	svchost_AAACABCAACAABACAABCCAACCBCCCBACACBCABBBBAACBCAABBACACBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 2288	3692	2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe	92
PID 2288 wrote to memory of 4036	2288	cmd.exe	94
PID 700 wrote to memory of 1332	700	svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe	95
PID 3692 wrote to memory of 5400	3692	2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe	98
PID 5400 wrote to memory of 4692	5400	cmd.exe	100
PID 3692 wrote to memory of 4728	3692	2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe	101
PID 4728 wrote to memory of 2960	4728	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_abe4bcbf47426d025aed78a965ba0186_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBCCACBBBACABCBCCAAABCBACBBBCCBCCAACAAACACBBABACCABACBCBCCABAABACACACCCCBCBABABCCACBBBCCAABAACABCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBCCACBBBACABCBCCAAABCBACBBBCCBCCAACAAACACBBABACCABACBCBCCABAABACACACCCCBCBABABCCACBBBCCAABAACABCCAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BABBBACACBACCBABBBBCCAABCCACCAABCBBCAABBBABBABCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe" start= auto displayName= "UserDataSvc_BABBBACACBACCBABBBBCCAABCCACCAABCBBCAABBBABBABCCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5400
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BABBBACACBACCBABBBBCCAABCCACCAABCBBCAABBBABBABCCACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe" start= auto displayName= "UserDataSvc_BABBBACACBACCBABBBBCCAABCCACCAABCBBCAABBBABBABCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BABBBACACBACCBABBBBCCAABCCACCAABCBBCAABBBABBABCCACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BABBBACACBACCBABBBBCCAABCCACCAABCBBCAABBBABBABCCACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2960

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:700
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCAACAABACAABCCAACCBCCCBACACBCABBBBAACBCAABBACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACABCAACAABACAABCCAACCBCCCBACACBCABBBBAACBCAABBACACBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
1⤵
- Executes dropped EXE
PID:5292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6f77541dfc4b99affa02c2f81225b94c3ee534a331b1d60a88cef88ad6d5e7ae
MD5 f36bc28254fcc2aa9fba10d78d161e5e
SHA1 93dc115f304a28b83bca47ee73b490c3b378c9e1
SHA512 b1c474d27c6bb0e9cdd198d097b1ad1a0a502887a10aafea2203f9f062f9e9a3414eee637ec3694eaaac5322f71a526e7f7fadd95c0d96ad2626bb7eb006f539
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82f650f7bb689b0a6439a224df029b4d8f631530b4ef3b5ae781cc7ce7b62bf8
MD5 448a1aeed3c93b654b0401d6789bdc04
SHA1 9119d33b983f0ca5e994bcfe5a717cd74aa54b6f
SHA512 54d227855c9a194380cd23a69cdae78abf989cc2695c3905706a69ffbad692f2ba997ecaf8b77edd59198f55389d8f622a359f5e95f2fc5d8da0ea0ff06606bd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eef5ac4583ad3460904cccd9e63cd1c3e63f6526bf645b8138c0fce32875ddac
MD5 f67036f27fa6a957c11dd878368c5d20
SHA1 707209a642db2b4d7609611d493649b0002127f8
SHA512 e905b9e07229e1b785822ff30ed9e9239ee86a337b0ec10e002137cf27fdef402d28ebfeb2f945e0a08109b267425f21785256e6632d400eb2f713942ce5e525
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dfe8e6f0787fb0b199db6a728ff14dc76efae7e66f2cce4a5855cb12c907da31
MD5 da47f2864174344938877ddf275d11ce
SHA1 95291862e541b2b71eae6b55af1cb0eff3fd375a
SHA512 bb9865330271532178637e2bacc3defd3d4e4f12ced66913c3dc34cd3fdf69f75441ff0fffd60f197fca3fa3309f3d8dccb7a95175f3c7ad9ec2213173e5214d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 167b029783ae44e9fd80447cf63c1e7099fecb850f25f6c99c8ae19daab9e864
MD5 47ce5102df8873bac5a7f0f5d4b088b7
SHA1 f4a7d652e52d7896841b3c44a3351e7168565fec
SHA512 7e9863665e2ef6ee0d815769e79763164b1950e1ab55d0ef9190d39b2ea357cc4d5ceca55b2ddef5513c4a22c51418ada5c3cf3ab896196e96e44e7642ab70d1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 39a21f062b00bf7a0fe6c6836d5622a86bd36604eb8c3fa19d3d1b9b1939e6ff
MD5 6470f902f8852e0d4051347fc806c3c6
SHA1 b5b7bbf0457362e70cb38e2fdc469489bcb37746
SHA512 6ec17b4de5f232e7a08429dcaca605747b880690fcc0045f4eca5651676358938ee37dc0845b8b9db0131fe1f6933603cb18a382f9dd333368c4ffbdbe951ee6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f518fe10b3407a5a446a9855d1e7596634d8e10c9b32026aee99ec9e35c6d873
MD5 acc2acec5198ed9c9b12a30773d88635
SHA1 3f391083042b66bbec0f134b31f055f88a38315f
SHA512 60545e9afe46a523428542aecaef00d8de38f2f18bb1b13d0f02fbf29c93daf68334ee16dd5d336a108ec3d397d88758dc1fec5bb18ad0a9dceb609c88ca8f77
MD5 SHA1 SHA512

Submit Download

svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBABBCBABBCAABCCCABABACACBBBCAACBBCCBCBCAAACCBACCC.exe
Size 36.1MB
SHA256 ea4f2c9556c4f473b116456a4f2cded903db3fa5a73243bb3b59bedb6f9d6705
MD5 abe4bcbf47426d025aed78a965ba0186
SHA1 4c54d7d0ab70378829f261365d70edff59bca286
SHA512 b55fba6fd3faab47be823596e63ee4617cbbbb7d52edc77ed7cf72185355331ae588a1608d1f44d8e4fc414c4a7d27d1cad23aad005ba6ac67ce82987dfe171b
SSDEEP 786432:jhasrhasrhasKhasrhasrhasKhasrhasrhasKhasrhasrhasKhasrhasrhasKha2:4
TLSH
T1C287F73CADA442A6D472C671C8A2B5EDEA2179127B005FCF61D2534E4D3FBD26C70E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 49d399aa7084a97d8f27a11c2a02e0ce73c7d7f192516262995a15715b48dd74
MD5 478ff0789ee7b57dadbedafaaad9055d
SHA1 36fb9f3e5e51729f4a09bcceb7b0a7eadcc9f6c8
SHA512 f21901002757993fa7c4082344d34290c2a0a00140cd7a5beb39e001f0484989ed608de9d96a8a7042eb0376d1df1fde4746736df0d4a669325bca45e0bebd50
TLSH
T1D4118661D4F9D867F833A8CBA119DB6308E4779BA8586E1423444118FF86C31DD590D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/700-34-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/3612-64-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/3612-82-0x0000000000350000-0x0000000000371000-memory.dmp

Download

memory/3692-0-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/3692-8-0x0000000000270000-0x0000000000291000-memory.dmp

Download