49f8e3abed48820baf420c72f556de852a694b409ec70ab2a302da6465053f4a

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe
Size 35.3MB
Sample260810-ep3ycs1bnc
SHA256 49f8e3abed48820baf420c72f556de852a694b409ec70ab2a302da6465053f4a
MD5 b2f7721d392b612398557f7049af6573
SHA1 9ca72dfde9c20eeeebdd91c01f341a7f97e279f4
SHA512 462c5bd84846f2484710880be440ef8b75615c3d36d6897fca5084836ec7d05a085d9e6d017911301f92c6c4ab54f22987cc4a55216bed06811c391a7bec6913
SSDEEP 196608:vBBBBBBBBJBBBBBBBBJBBBBBBBBJBBBBBBBBJBBBBBBBBJBBBBBBBBJBBBBBBBBs:g
TLSH
T1FB878C10B7818035F5B329728ABFD739552CB9714F6986CFE388072E5E70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1696	svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
2908	svchost_CAAABABBCACACABAABACACCBBCACABBBABBCABCBBBACCBAAAACBCAC.exe
5504	svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBCCBCBCCABBCBABBACCAABBAACABBCACCBCBACBCCBCCAACBBBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe"	2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCABCAAACABABAABBCACBACBCCBACBAACCBCAACABCCAAACBACACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAABABBCACACABAABACACCBBCACABBBABBCABCBBBACCBAAAACBCAC.exe"	svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4792	sc.exe
2532	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1784	cmd.exe
5648	cmd.exe
5560	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAABABBCACACABAABACACCBBCACABBBABBCABCBBBACCBAAAACBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5904	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
6104	2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe
6104	2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe
6104	2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe
6104	2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe
1696	svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
1696	svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
1696	svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
1696	svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
2908	svchost_CAAABABBCACACABAABACACCBBCACABBBABBCABCBBBACCBAAAACBCAC.exe
2908	svchost_CAAABABBCACACABAABACACCBBCACABBBABBCABCBBBACCBAAAACBCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	6104	2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe
Token: SeDebugPrivilege	1696	svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
Token: SeDebugPrivilege	2908	svchost_CAAABABBCACACABAABACACCBBCACABBBABBCABCBBBACCBAAAACBCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 6104 wrote to memory of 1784	6104	2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe	92
PID 1784 wrote to memory of 5904	1784	cmd.exe	94
PID 1696 wrote to memory of 2104	1696	svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe	95
PID 6104 wrote to memory of 5648	6104	2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe	98
PID 5648 wrote to memory of 4792	5648	cmd.exe	100
PID 6104 wrote to memory of 5560	6104	2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe	101
PID 5560 wrote to memory of 2532	5560	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b2f7721d392b612398557f7049af6573_elex_stop_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCCBBBACABABACCBCACABCCBAACBABCABCCCABCBAAAAACBCCCAAAABCABCCBACABCBBBABACCABCABABACBBCBBBBBCCCCCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACCCBBBACABABACCBCACABCCBAACBABCABCCCABCBAAAAACBCCCAAAABCABCCBACABCBBBABACCABCABABACBBCBBBBBCCCCCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5904
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACABACABCCCCAABBBCAACACACCACCAABACCAACAABAACCCABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe" start= auto displayName= "UserDataSvc_AACABACABCCCCAABBBCAACACACCACCAABACCAACAABAACCCABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACABACABCCCCAABBBCAACACACCACCAABACCAACAABAACCCABBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe" start= auto displayName= "UserDataSvc_AACABACABCCCCAABBBCAACACACCACCAABACCAACAABAACCCABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACABACABCCCCAABBBCAACACACCACCAABACCAACAABAACCCABBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5560
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACABACABCCCCAABBBCAACACACCACCAABACCAACAABAACCCABBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2532

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABABBCACACABAABACACCBBCACABBBABBCABCBBBACCBAAAACBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAABABBCACACABAABACACCBBCACABBBABBCABCBBBACCBAAAACBCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
1⤵
- Executes dropped EXE
PID:5504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e59f7a56cda9c54bb2906720dac876c1ffff762d8138853fb2398b88ee0056f
MD5 ca7458e0e02921f33ef18ef5fb9d2f64
SHA1 c63dff669d024143b891e9d79616f4460a9bf5b7
SHA512 6480a8fce6d0ec82f3e0b74f4e2cd39b545fe76adc96d259a30a4f0b668104e7fb293b010150d9190c7fd53862ac9c5c2924f8b5251c0eab636c0c3bc656d5cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c04a2a86f01c2cca4eba5e0a5190860a64f8a7c5b529ad7952eeb69689fcf98a
MD5 f9fb64c03f8adc4776b650764486d900
SHA1 2b93517416bced1b19fa2958da9ffb1a24f4b107
SHA512 e8a687e2e94210e0ea01e7aabf2845730a4d97d4ee76625a19261d3fae991d84447afbc0a439b7c89bcf0ab1e191685645358a33244233e7e0d6b2c855f754d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 afe4e50337e97a6778300558afc934f94d5e8afe0df9a773b369cb2d9ed39963
MD5 97675faf26bf8392e40fffb7d0bcbf4d
SHA1 80ee8dd0396094557a0914ff3e9b0bcaee9416be
SHA512 7f40a00e25d0c637a27b7a112485ab91bd460b267eb8e30767a1ff336126af9d77b3d630d57a1f59342c86ead61e1f9d99f2ede69381562ccabc62ea9878080c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0897327a50745eb1b9baba228d6568cdaad7f75f2b8ba2d783dd21a698591e1e
MD5 8abd0ab262515e3b8be3a830670e2353
SHA1 b1df1c6ffce605abdd6849e35b06c1346f196793
SHA512 9ffb1d7ef0aa6a66d3d6a632e253b734ab2f62529f45d3546389dc461a60df43960443f2fcbb01fcf0035d64786438aec9ba6e70c12555b35a4a7fdaef1539fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3d0d9c042bd095a5f6010a944f68c097609a2ecd93636fc2d4ef6c29477599aa
MD5 b54190c60e49dc0e3683fc4606c08c88
SHA1 5b689f5321d6dc2c0d46b9db6b4a3f4bfd46e25e
SHA512 918f01e450cb57e7a62bf12bba0201d252ae00f30d0593fd6c0d455ba177d24f87a67bacb3289bbc688c1f97dc7b30854c4e4112d5af936366c247a219e43e94
MD5 SHA1 SHA512

Submit Download

svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACBBABBCCAACCACBAACBCBBCABACCACACCCCCABCBABCACBCAB.exe
Size 35.3MB
SHA256 49f8e3abed48820baf420c72f556de852a694b409ec70ab2a302da6465053f4a
MD5 b2f7721d392b612398557f7049af6573
SHA1 9ca72dfde9c20eeeebdd91c01f341a7f97e279f4
SHA512 462c5bd84846f2484710880be440ef8b75615c3d36d6897fca5084836ec7d05a085d9e6d017911301f92c6c4ab54f22987cc4a55216bed06811c391a7bec6913
SSDEEP 196608:vBBBBBBBBJBBBBBBBBJBBBBBBBBJBBBBBBBBJBBBBBBBBJBBBBBBBBJBBBBBBBBs:g
TLSH
T1FB878C10B7818035F5B329728ABFD739552CB9714F6986CFE388072E5E70AE1A93471B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c1892db587d0ff00869d6ca121cb7bd0b3ae1e639efde70173692ea53e3cded0
MD5 bb14c2c86d958a4dff0cbf1eed21d60f
SHA1 dcc9b3a207529167b0a2371e4d729cafda43828b
SHA512 959f226c474cbaf9cc62516d2fa41056952013fdcf5b56693f8dec59e20c5adf31cd9cc532b7759fa2b16586aa4628f323970033b21aeb60ac1a529d06dcfcf3
TLSH
T125115B52A8E9C413ED3368CB562D8BF30DB4779B6CAC6A002204031CBFC9D30EE810E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1696-32-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/2908-79-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/6104-0-0x0000000000540000-0x0000000000561000-memory.dmp

Download

memory/6104-8-0x0000000000540000-0x0000000000561000-memory.dmp

Download