4d6bcaa1c0846b9afa83f612d236732f7b9e1ecd3a1caee58930ab33c8c12382

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe
Size 25.2MB
Sample260813-e32mfs1hlg
SHA256 4d6bcaa1c0846b9afa83f612d236732f7b9e1ecd3a1caee58930ab33c8c12382
MD5 7eee333e95256a5ae442ef549779012d
SHA1 a6d723141b4cc3db8e981e7b384d42129f12456b
SHA512 af6b83360b0b5b12956687268ce2dca30a0d81dd6e5e45a58463e76c465c8a2f262bd6163a21607558c998102ea5fddd89b62e00732800e56dccf22d52ad8c3b
SSDEEP 49152:U+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ESo:R
TLSH
T199474B09F98340F1D97B51B04DDBD2BF8A71BA2187228EFBE68DC61B6D23B905834751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3136	svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
4788	svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
1244	svchost_BABBACCAACBCACBABCCBBCBBACAABBAAACBCAACABBACAABCCACCBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBBAAABAACACBCBACBAABCACBAAAAAACACCBCCAACABCBACBCCCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe"	2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCCABBAAABCBCCBBCBBABBABCAACCABCBAABCBAACCBBABBBABABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBACCAACBCACBABCCBBCBBACAABBAAACBCAACABBACAABCCACCBCB.exe"	svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4216	sc.exe
4716	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
248	cmd.exe
5028	cmd.exe
5768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBACCAACBCACBABCCBBCBBACAABBAAACBCAACABBACAABCCACCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4476	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2508	2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe
2508	2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe
2508	2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe
2508	2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe
3136	svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
3136	svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
3136	svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
3136	svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2508	2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3136	svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 248	2508	2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe	91
PID 248 wrote to memory of 4476	248	cmd.exe	93
PID 2508 wrote to memory of 5028	2508	2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe	94
PID 5028 wrote to memory of 4716	5028	cmd.exe	96
PID 2508 wrote to memory of 5768	2508	2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe	97
PID 5768 wrote to memory of 4216	5768	cmd.exe	99
PID 3136 wrote to memory of 5796	3136	svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_7eee333e95256a5ae442ef549779012d_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACAAACCABABBBAACACCACCAABBAAABABCCABACBBBCBBBAABBBBBABACABABBABBAABCBCBCCABBCBACBCCABBCBBCCAACBACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:248
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACACAAACCABABBBAACACCACCAABBAAABABCCABACBBBCBBBAABBBBBABACABABBABBAABCBCBCCABBCBACBCCABBCBBCCAACBACBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4476
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCACBBCABCCBCACACBAACCAACBBBAABABCCBBAAABACBCCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe" start= auto displayName= "UserDataSvc_CCCACBBCABCCBCACACBAACCAACBBBAABABCCBBAAABACBCCBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCACBBCABCCBCACACBAACCAACBBBAABABCCBBAAABACBCCBBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe" start= auto displayName= "UserDataSvc_CCCACBBCABCCBCACACBAACCAACBBBAABABCCBBAAABACBCCBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4716
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCACBBCABCCBCACACBAACCAACBBBAABABCCBBAAABACBCCBBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5768
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCACBBCABCCBCACACBAACCAACBBBAABABCCBBAAABACBCCBBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
1⤵
- Executes dropped EXE
PID:4788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCAACBCACBABCCBBCBBACAABBAAACBCAACABBACAABCCACCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCAACBCACBABCCBBCBBACAABBAAACBCAACABBACAABCCACCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ebf4aa573356e0bf44634568b7fc2d4a87c0bbfd2c364cd80a1a1047031e4a27
MD5 49c52f192f4a83b05371fcbe0c0b385e
SHA1 78ed630f25df856a159a480fc389325b09164a2d
SHA512 8c695ce150609d16ae3860c562ea80f0b88ea5ae1cf1ddfec831c028a82d42ab390d92c78261ff21f069846528b19dc44f2985bb41490c381064ca17d9b58c29
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c5527995a579c954bdc1cdd00ec45d65b9d1334211575577f9c44e9e0421ea0e
MD5 c70d8a666c6e3c80084d25ccb7cee0f6
SHA1 afdd332c7a066dc97da8827b3191b7946a0b8582
SHA512 6d941ea1c450e74bf86f76888d9e6193b9905644422286546fdade9e80fcbd5320ca8319dd48ba94b5aca9dceeab7f0adb5224ece44ecb172a8f00ea6c3e4c2b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bba6f57268154f040dbb10c5b2cb4bea979f245202c95d9ed340c3234415eacc
MD5 d522f15d9d02551f81c4b3dcbd6f2680
SHA1 9a126069416a6859487509fc2a10e160c3a2aa36
SHA512 09f06d7c7cc12f343dcbff0381f6236e5d78d9c08fde148f8850e9546854df5eba3cca266a6eecb0e9aa86dd6635fe3e83898fb0274e33ca95ef426c140769da
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0a3a2c32ccc06bcb2d9c57eb206bebe1e4a58e9d91afee4b982c378cf39b3d2d
MD5 71c84ba24ae1d1efb3b8a6695642495d
SHA1 9645269e183d21d5dcacc7bdeb7df1cda9fee9da
SHA512 11504b7998509c320c2f4cc46dcd23c7556bfe1f5d9b8963b30a256c826f50e312c8aad349c3cfe15b3a16398703a2516743274cc2ac51687b1fd2680b2e8844
MD5 SHA1 SHA512

Submit Download

svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCAAAABACCBCCBBAABABBBCBCCBABCBAAACCCACCAABACAACBACAA.exe
Size 25.2MB
SHA256 4d6bcaa1c0846b9afa83f612d236732f7b9e1ecd3a1caee58930ab33c8c12382
MD5 7eee333e95256a5ae442ef549779012d
SHA1 a6d723141b4cc3db8e981e7b384d42129f12456b
SHA512 af6b83360b0b5b12956687268ce2dca30a0d81dd6e5e45a58463e76c465c8a2f262bd6163a21607558c998102ea5fddd89b62e00732800e56dccf22d52ad8c3b
SSDEEP 49152:U+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ESo:R
TLSH
T199474B09F98340F1D97B51B04DDBD2BF8A71BA2187228EFBE68DC61B6D23B905834751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BABBACCAACBCACBABCCBBCBBACAABBAAACBCAACABBACAABCCACCBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBACCAACBCACBABCCBBCBBACAABBAAACBCAACABBACAABCCACCBCB.exe
Size 16.1MB
SHA256 4d373dd9a493588b5069d180eaa2b056bba31bf8575c6708a7b3655a3d2aef2a
MD5 ea08faffc9455842b2988d65322d9a8e
SHA1 3bfce6f5642036f650f0b41b0d5d1ae2ec5cb82d
SHA512 6b6ac6a43ad7db96d6e881016752869dcf51b2cdd2711560f02701657fd29b20224485b1e0499c235fe2be497c46e9422f9e3c77387f99142956c1e5db69cbdb
SSDEEP 49152:U+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ES+ES+EyJC+ES+ESA:X
TLSH
T179074B09F98340F1D97B51B04DDBD2BF8A71BA2187228EFBE64DC61B6D23B905838751
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2508-0-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/2508-8-0x0000000000850000-0x0000000000871000-memory.dmp

Download

memory/3136-24-0x0000000000230000-0x0000000000251000-memory.dmp

Download

memory/3136-37-0x0000000000230000-0x0000000000251000-memory.dmp

Download