6c0f288fb0efe3276a58c0f290cdf610149a4f7a1b2564da2b98b10e27a3284e

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe
Size 21.3MB
Sample260810-csxjmszale
SHA256 6c0f288fb0efe3276a58c0f290cdf610149a4f7a1b2564da2b98b10e27a3284e
MD5 825123a6006bc9f1b916a273c0da49e7
SHA1 adc7ce58029c0d84675af558770fb94f4b6ac91b
SHA512 369ae2f9260b6d0cfcca5054af5d5e5d535531fb7e68778303f43290ae22722ff3ba59f36fd334759c3d54afbc834baed31f38284ef2723f6d83b1ef8e6d6b5c
SSDEEP 98304:T7pW7pW7pW7pn7pW7pW7pW7pn7pW7pW7pW7pn7pW7pW7pW7pn7pW7pW7pW7pn7p3:I
TLSH
T143374B02B7ED9034F5F32B309EB592658ABABC629E35C64F63C4561D0D71A90E934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1860	svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
4708	svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
2704	svchost_CCCBCBBCCCBCCCBBABACABAABCBCCACBABCBCAABAABBACCACBBACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAAAAABCCACBCBCABABBAAACABABACABACCABCBABBABBBBBCCACAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe"	2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAABCBCBCCBAACBBACBBCCAAACCBBCCACCACABCACABCAABCBBAABABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBCBBCCCBCCCBBABACABAABCBCCACBABCBCAABAABBACCACBBACCA.exe"	svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
544	sc.exe
6024	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6100	cmd.exe
1620	cmd.exe
5620	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBCBBCCCBCCCBBABACABAABCBCCACBABCBCAABAABBACCACBBACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2500	2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe
2500	2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe
2500	2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe
2500	2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe
1860	svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
1860	svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
1860	svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
1860	svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2500	2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe
Token: SeDebugPrivilege	1860	svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 5620	2500	2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe	92
PID 5620 wrote to memory of 2424	5620	cmd.exe	94
PID 1860 wrote to memory of 3444	1860	svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe	95
PID 2500 wrote to memory of 6100	2500	2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe	96
PID 6100 wrote to memory of 6024	6100	cmd.exe	98
PID 2500 wrote to memory of 1620	2500	2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe	99
PID 1620 wrote to memory of 544	1620	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_825123a6006bc9f1b916a273c0da49e7_elex_hawkeye_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBCACCBACAAACACBCABBCBCCBACCCAACBACBABBBCBCCBACBACBACAABAABACACCCCACCBCABBBAABBBBABCACABCBCCCACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBCBCACCBACAAACACBCABBCBCCBACCCAACBACBABBBCBCCBACBACBACAABAABACACCCCACCBCABBBAABBBBABCACABCBCCCACABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBAAABAABBCBCAAAAAABCBCAABACCACABCAACCACCCABABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe" start= auto displayName= "UserDataSvc_BBBAAABAABBCBCAAAAAABCBCAABACCACABCAACCACCCABABCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6100
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBAAABAABBCBCAAAAAABCBCAABACCACABCAACCACCCABABCBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe" start= auto displayName= "UserDataSvc_BBBAAABAABBCBCAAAAAABCBCAABACCACABCAACCACCCABABCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6024
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBAAABAABBCBCAAAAAABCBCAABACCACABCAACCACCCABABCBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBAAABAABBCBCAAAAAABCBCAABACCACABCAACCACCCABABCBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
1⤵
- Executes dropped EXE
PID:4708

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBBCCCBCCCBBABACABAABCBCCACBABCBCAABAABBACCACBBACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBCBBCCCBCCCBBABACABAABCBCCACBABCBCAABAABBACCACBBACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcceced69b5875cb3cdd26333186dcc9186cda6b59880a7eaa9042ad641bb676
MD5 0a00e6ab279293ff5172ce588a3d783a
SHA1 0e15812cfc0f1629c1f97e518404bf0d55a12224
SHA512 1c29662881bbf83233010a4bb3c20f5d3634ef3f08089702709e7addbaec2a7725d1818b9d5998746c925f25d4cf714c8cc60b9c8a58b7f4fbc0905890d88229
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a016f930108144e70c63e1a757c3f906742ea7726e45cd3ccc6631a7c87a0f0a
MD5 d93f9996df206bfd492f28c5115380a4
SHA1 08bbc4e7f14d9ed68d44ebe36065548c8bc25396
SHA512 f94989dc87c8cb7c9477720ea86d34080b1adc92872b2cdcce260cfefaebe06bdb8f4302a1370830025bd5b467b726b9d3fc94688cdd384f1d53bbfd07136bec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 edd6cb8517f1114f88a75c3687c9d1e3e596697d03babad5ac0e0f0b36c00038
MD5 51067d730cbaa30d3941faa75448dd78
SHA1 4e04cb11d909de42d897ce20b6660111280daa94
SHA512 15fae57a4710c4f364d689e5b8b74d9a8ee1b60578ca23289a40cf205a7558da4aac0e06a923d95bfa56acee3b843838f9ba2d8c0198b9a53925e585c7e19102
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d3716a57bdc6a56b466f088c6e55d01dfa3d126fa76e427fa932301a93f2d492
MD5 364684547fe12cb280664f1efb780bca
SHA1 29cc93aa0d041e61c9ef24e72935fa1702afc893
SHA512 f68487aeafbc9bf7fed16a8dcd2dd8fdf8275721d894b90e7d5f17f38a7cf0b16949b33a33963c64f9babd202ebb0477f2652394593eb89a5b95aa72c59a4e1a
MD5 SHA1 SHA512

Submit Download

svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBCCCACABCBACACBBBBBAABCAABBBCCABCCCCBCCCBCCBCBBB.exe
Size 21.3MB
SHA256 6c0f288fb0efe3276a58c0f290cdf610149a4f7a1b2564da2b98b10e27a3284e
MD5 825123a6006bc9f1b916a273c0da49e7
SHA1 adc7ce58029c0d84675af558770fb94f4b6ac91b
SHA512 369ae2f9260b6d0cfcca5054af5d5e5d535531fb7e68778303f43290ae22722ff3ba59f36fd334759c3d54afbc834baed31f38284ef2723f6d83b1ef8e6d6b5c
SSDEEP 98304:T7pW7pW7pW7pn7pW7pW7pW7pn7pW7pW7pW7pn7pW7pW7pW7pn7pW7pW7pW7pn7p3:I
TLSH
T143374B02B7ED9034F5F32B309EB592658ABABC629E35C64F63C4561D0D71A90E934B33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1860-24-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/1860-37-0x00000000007D0000-0x00000000007F1000-memory.dmp

Download

memory/2500-0-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download

memory/2500-7-0x0000000000B80000-0x0000000000BA1000-memory.dmp

Download