f7d366db3d6e26b4c9c30eed90a3156d674308937e975718cbe9cd467efe5fa6

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe
Size 13.2MB
Sample260810-ec2jrsam9v
SHA256 f7d366db3d6e26b4c9c30eed90a3156d674308937e975718cbe9cd467efe5fa6
MD5 e9ce4a2356d3f87f2da8ca23fb06b16d
SHA1 beb2e99e46a357303a13a4f21173c0c09c06b0d1
SHA512 4223d833255621e8ddaf05988455ba81baf95090591fb1bc5176345b5ca02d11c5eaab9f81dfb9f4dd7f1ef8e56b4c46293d09bce771349ca47f24276cc1606d
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2J+EPiw2k+EPiw2k+EPiw2k+EPiw2J+EPiw25:x
TLSH
T130D63B0977ED4814F5B7B23489B68669DAB2B8915B31C7CF5280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3972	svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
1728	svchost_ACCAABACACBCBCCCCCCAABBABABBBCCCCAAABAACACCCACCACCACBBB.exe
5440	svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABBCBAAACBCBCABCCBCCBAACAACCCACBACABACCCBACBACABCBCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe"	2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBAABBBCBBBBACBBCABCBAAABACBBBCCBABAAACAABABCCABABCBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCAABACACBCBCCCCCCAABBABABBBCCCCAAABAACACCCACCACCACBBB.exe"	svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3584	sc.exe
3384	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2028	cmd.exe
5472	cmd.exe
2816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCAABACACBCBCCCCCCAABBABABBBCCCCAAABAACACCCACCACCACBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1424	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4532	2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe
4532	2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe
4532	2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe
4532	2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe
3972	svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
3972	svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
3972	svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
3972	svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
1728	svchost_ACCAABACACBCBCCCCCCAABBABABBBCCCCAAABAACACCCACCACCACBBB.exe
1728	svchost_ACCAABACACBCBCCCCCCAABBABABBBCCCCAAABAACACCCACCACCACBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4532	2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3972	svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
Token: SeDebugPrivilege	1728	svchost_ACCAABACACBCBCCCCCCAABBABABBBCCCCAAABAACACCCACCACCACBBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2028	4532	2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe	94
PID 2028 wrote to memory of 1424	2028	cmd.exe	96
PID 3972 wrote to memory of 3856	3972	svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe	98
PID 4532 wrote to memory of 5472	4532	2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe	102
PID 5472 wrote to memory of 3584	5472	cmd.exe	104
PID 4532 wrote to memory of 2816	4532	2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe	105
PID 2816 wrote to memory of 3384	2816	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_e9ce4a2356d3f87f2da8ca23fb06b16d_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABCAACABBBCBCBACCABBCAABCABCBACCBABBACBACAABBACBCBCAABAAACAAABBAACBBAAAAACCBCBCACCBAACCABCCCBCBBACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2028
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBABCAACABBBCBCBACCABBCAABCABCBACCBABBACBACAABBACBCBCAABAAACAAABBAACBBAAAAACCBCBCACCBAACCABCCCBCBBACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBBCBBCAAACBABCAACBBABCABABCABACBCCAAAABBBBCBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe" start= auto displayName= "UserDataSvc_ACBBBCBBCAAACBABCAACBBABCABABCABACBCCAAAABBBBCBCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5472
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBBCBBCAAACBABCAACBBABCABABCABACBCCAAAABBBBCBCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe" start= auto displayName= "UserDataSvc_ACBBBCBBCAAACBABCAACBBABCABABCABACBCCAAAABBBBCBCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3584
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBBCBBCAAACBABCAACBBABCABABCABACBCCAAAABBBBCBCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBBCBBCAAACBABCAACBBABCABABCABACBCCAAAABBBBCBCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAABACACBCBCCCCCCAABBABABBBCCCCAAABAACACCCACCACCACBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAABACACBCBCCCCCCAABBABABBBCCCCAAABAACACCCACCACCACBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
1⤵
- Executes dropped EXE
PID:5440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SubmitGrant.exe

Path C:\Users\Admin\Desktop\SubmitGrant.exe
Size 40.2MB
SHA256 c14555656596167e8c716a0975b694a4225ffff05bcb1f22e7a878284635f2b6
MD5 9a5120ba87279f09345fd3d9922d991b
SHA1 c0474fb1a5a1749a1676faf664c1a8b388838beb
SHA512 a79420f2be9da7eb40305b21d1758944f0f942647923c72842d03775c2d1bfd18a9133c64aa4ac77a32ba6787898a1d0e35297318b626b2d0187fc0f6189a6f6
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2J+EPiw2k+EPiw2k+EPiw2k+EPiw2J+EPiw2V:jSc7Ej6Z
TLSH
T11D973B0977ED4814F5B7B23489B68669DAB2B8915B31C7CF5280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa36c82dc67b8f78162f631811a744d172e0aae500d366fec8f13bca9495fd6a
MD5 efd4504af8d572e8a7ad59f14426c335
SHA1 181a922126952b2a2098a8561e041a767a9e7a07
SHA512 44a3b6167a2e4046a0be456bdeab84dc23bfa48710d29da0a3de2d7f3db1028aa04fc05eb9700cc98abe9e294e95994c4a8190e4cc61f08e42588c5ef066475b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 986971e422a07467699db2cdf45f114cfcb50c316f1cb6b77d4c9b8c43c0adde
MD5 286cd3ba36ee3eeff6824b0d8913c96d
SHA1 6b7986619d69054ea0b4a069a4a8399f89b3a5e0
SHA512 9680c8fb41194b9f8ac8d08a7e3e0cbc7b66c342a8ef40254e3147e387647a08dae51bdf3775a5fb3a1bd9b00edf347fcf7735f0daebba6dd92f87ea214fb9fe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b340e9cd7cac3c5fca912ec921e0b77bf99e1e34e11b9074a180c6b86020761a
MD5 fdb235bac0cd7eb4c2dbfadcf161ba3b
SHA1 f777897af20e91ea8dda4e910bbad418e286152d
SHA512 e1ebf50b5cbaa6fc5d96eac3f94863f3454abdb54ee1d990ccf7ed41ed22457bfa700e4fc793f21283496331b84f7b5d2dd610599e254a873424f1015c46fbcf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4c48e3ea789298169b3b707cb6b082ff9f23fe13c6eed2b85819a2f41bd4ca5e
MD5 6af0fe67002c2b898c6f8f74d5e361e0
SHA1 f5afe5a2ac6f9162266a9f0947430d8b033b2b32
SHA512 a156e8f2dca56ec87cd7acee23dca17910ae58c3cc4b6fac5ec3747d2880c5a8ae9d2077c729de29069ceec130de8f68cc8106376e81fd6ee01fc42d4ddc17e9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 387529b5b5d244346e0d9b0d803b92b3a54205921782bfe4e3593889a312935d
MD5 5d3e17b73b19a57c35a513fc170c0a32
SHA1 d2daa0bfc63b42d30f1af379f63bad50be0db128
SHA512 56749be203c562524182bc9994e70f4dc608f61e0a3ee9abc1c673b234b6e3b1c32c5823737738569050146273a19f9fede76bad5795b06798912afe3e046f11
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f96349cd1cbeb8a85a54ec7c78459b1050cd73a2b67e6602e8b39d82c67e5b84
MD5 a6a9421fbfe3f2f97f7924540a4d5584
SHA1 78ea4fa9e3e82db1ef519b1aee7d9223cfd773ed
SHA512 701cd98b33e585cbc021834b48eb782a4bee593bca163f8c3b5e3a12e94dc466b4909803be68ba4aab875cbad4779834bf7c03a9268d58328ae9650c2dd2b54b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b3437ead44d2265b3601b6687596c2635b3bdb4a338dfff8846f7347e94e2295
MD5 8c32e7d3815361435eed56eda02f04ab
SHA1 57330b659a6464abec2ab64598d63451134aa117
SHA512 0c10dd4323500e27c638b29b60f3c253db105054a69de709253dfadda9ba0cd56583360c9df0304750689366e6796a8e189ab8b2bf27ad352562b9f25903b843
MD5 SHA1 SHA512

Submit Download

svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABACCABCCCABBCCACCABACACACACCAAACCBACBBBCCBACBACBAA.exe
Size 13.2MB
SHA256 f7d366db3d6e26b4c9c30eed90a3156d674308937e975718cbe9cd467efe5fa6
MD5 e9ce4a2356d3f87f2da8ca23fb06b16d
SHA1 beb2e99e46a357303a13a4f21173c0c09c06b0d1
SHA512 4223d833255621e8ddaf05988455ba81baf95090591fb1bc5176345b5ca02d11c5eaab9f81dfb9f4dd7f1ef8e56b4c46293d09bce771349ca47f24276cc1606d
SSDEEP 49152:U+EPiw2k+EPiw2k+EPiw2k+EPiw2J+EPiw2k+EPiw2k+EPiw2k+EPiw2J+EPiw25:x
TLSH
T130D63B0977ED4814F5B7B23489B68669DAB2B8915B31C7CF5280833D0E73BE4AD34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1b24e1c2e162212c404b1b6c5be5fef827d067111904fbb02ae9f12dada08c24
MD5 fdbcd69b903e3ecbabc2cfa4d102cc22
SHA1 c02e741f7a8f59dd380c103d2e937d1feaa12c90
SHA512 e1dbfa0c861eedd5eddb1e03a42bc973edb9b9820216ab43f548e7da8ae21cf516738daaf66172a256c4e81d954708ec9ce83531845195dbdea2f862a30fd905
TLSH
T147112BA0C4FAD853E933249F611F9F6208F8728FAC586A28124D56187B49C36CD558E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1728-107-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download

memory/3972-47-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/3972-69-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/3972-106-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/4532-48-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/4532-70-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/4532-0-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/4532-23-0x0000000000870000-0x0000000000891000-memory.dmp

Download

memory/4532-12-0x0000000000870000-0x0000000000891000-memory.dmp

Download