2c7cc90290d5ea2c56ad5899aef4e4fd4cc079569818190962c7a7839e75149f

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe
Size 15.1MB
Sample260813-ej7dlagf82
SHA256 2c7cc90290d5ea2c56ad5899aef4e4fd4cc079569818190962c7a7839e75149f
MD5 a585663169706a2643c10b417b233138
SHA1 21fdc5e730e5d60b48ea2e301befa7c4f01cf41b
SHA512 89936c5bd5be2dc1a62aefa37dbf9f11fbc52c84ab2f75c504ad669ed5e4b784303c776f0f1a400cb50f674c642f6ee016b5720723c9841600edbddf21b79cda
SSDEEP 49152:U+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+EoUe+Ee+EW:V
TLSH
T1D5F65C09F94340B1D92B51B04DDFD2BF8A60BB2587128DFBFB4DCB1B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1564	svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
1764	svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
4852	svchost_ABCAAABCAABACAABCBBACAACAAACABBCBCBCABBCABBACCBAAABBCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCBBCABAAAABACAACAABBCCACBCCCBBAABCCACAACAAAAABCBAAAAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe"	2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBAAACBABABABABCCBCABABCAABBABABCBACCCCCCCBCCAABCCACCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCAAABCAABACAABCBBACAACAAACABBCBCBCABBCABBACCBAAABBCAB.exe"	svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
864	sc.exe
3060	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
116	cmd.exe
1172	cmd.exe
4908	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCAAABCAABACAABCBBACAACAAACABBCBCBCABBCABBACCBAAABBCAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4524	2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe
4524	2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe
4524	2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe
4524	2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe
1564	svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
1564	svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
1564	svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
1564	svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4524	2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1564	svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
216	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 116	4524	2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe	110
PID 116 wrote to memory of 2940	116	cmd.exe	112
PID 4524 wrote to memory of 1172	4524	2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe	120
PID 1172 wrote to memory of 864	1172	cmd.exe	122
PID 4524 wrote to memory of 4908	4524	2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe	123
PID 4908 wrote to memory of 3060	4908	cmd.exe	125
PID 1564 wrote to memory of 3376	1564	svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe	127
PID 3376 wrote to memory of 4044	3376	notepad.exe	129

C:\Users\Admin\AppData\Local\Temp\2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_a585663169706a2643c10b417b233138_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBABCCBCCAACCBBCCCACABCBBBBAAABBBAAAACCBBCCCBBBACCBCACBCBAAAABACCBCACAABAAABCCCBBCABACAACCBBCACBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBABCCBCCAACCBBCCCACABCBBBBAAABBBAAAACCBBCCCBBBACCBCACBCBAAAABACCBCACAABAAABCCCBBCABACAACCBBCACBCBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2940
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACAACBABABBABAACBBCCABACBAACCBBCABBBBACCCCBAAAAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe" start= auto displayName= "UserDataSvc_ACAACBABABBABAACBBCCABACBAACCBBCABBBBACCCCBAAAAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1172
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACAACBABABBABAACBBCCABACBAACCBBCABBBBACCCCBAAAAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe" start= auto displayName= "UserDataSvc_ACAACBABABBABAACBBCCABACBAACCBBCABBBBACCCCBAAAAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACAACBABABBABAACBBCCABACBAACCBBCABBBBACCCCBAAAAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4908
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACAACBABABBABAACBBCCABACBAACCBBCABBBBACCCCBAAAAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4044

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
1⤵
- Executes dropped EXE
PID:1764

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABCAABACAABCBBACAACAAACABBCBCBCABBCABBACCBAAABBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCAAABCAABACAABCBBACAACAAACABBCBCBCABBCABBACCBAAABBCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff10bc7d6701602d330c98a19950b6ee5666153b50ec94900854ada7b3f7056b
MD5 04567d37d3cd048fcfc160e4d8a9e2e6
SHA1 1e16af57dd9dbea4badf4225446026e92577e8e7
SHA512 1b430dd91dd055e31c087f9811b98f9349c495a661f871289fa39d2a40b58f85d486d0ccfca992c7d09bbf77080cbac9a7d966d95683423d38bd0a5473a2b736
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3094298b6557534d0cb2d86b5abead86a81aede4b7bd7e9c7e7c00253a80ba1
MD5 2f563fd45d722247864352cc77085e7c
SHA1 cc45d338f3481840ab9a8d947de3697d9f723f52
SHA512 51eafa2681b5861d392609084c662d677f437ebd1c0eb66c2cb115407abfc9e1a565d12249708c2cbaf6a90e43a6b8ac7beaae0f373c1c3d778ef918d8460e1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26e431c48b87e40f9764208c5e921001c23c5c15bbb90fc510c76f87b5e43b15
MD5 9ccc41142f36897b92156f47509cd53b
SHA1 633b3d626dfcebed9fbb586c15f75ddfa53b985c
SHA512 7bdf52d922f7be49886aff8346bfff661284757f761bcef6190e7642455b5639947cb237ba99fa84f31031d4cb3723279f091346ba9ce927e5c0a490bc98c524
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 95fa5daf3b75fd9afc162f2b3ee0659a95a87bc8604b11ce8b5b2bcf0311f476
MD5 93b98bad0e1991488e09bdff020e4347
SHA1 0e5a1c8ac0546bd9d59ef606578924aa09bf1ad5
SHA512 2bd98a4d94e447d8209555adfcd118b18d2151eea7d1d1a8421b265126c9ffa2674127e079e98f7b8e69df44f6c431dfeae2a1e586b2f8ddef195b47daa8f13c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 145c46c49f1c0499d483b726d5f65bce424d2ca3c4f41f6604097a91156c7cd3
MD5 3941ea29b813c9d07196508209c141b4
SHA1 a21f6848cefc73bb442b318e9059605d23d79ab0
SHA512 064689eb297d1a73b0abb3632fd9e0dec48003a555752d5ae401700aec07af364dfd1062ffcf76aec64b72b3091ded3306041b67f06214d7dbda33e0483df76b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bc596b96fb31c331f2ef825e840fda008a45272624afce82f00451a139617001
MD5 d0854b47df47959faf2e5bc4838c4d9f
SHA1 7daec0a4edb7f09cc297e2a68ee3a836625b29db
SHA512 95850be27305798dab85169e911f7eaa01a2ab6dedae1c7b3cfdbb3f81efc25ca08bd7eeecb0e1ef6624fdad68613e14904d7b65e58bd5c72d1ff2d891882acb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 38f7e43923a97b9df95e4b19109e503dbd6e3ec19ce6541f952bcb4890ff4026
MD5 53f1f8d7c26de7893169ecd4a5324187
SHA1 373a627dbe052770e3586274e897d679f5ba4745
SHA512 dc5923bc3567377834e880b8cc06cf0d2a739eb2714a7ad5f894026f6393f20c3ea0e228b480d409f68a49b78c35d8d19d59b6cf349804764479017fc212b72c
MD5 SHA1 SHA512

Submit Download

svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACCBAABCACBBBCACCBAACCBBCACCAAAABCBABCBACAAAABABCCCCC.exe
Size 15.1MB
SHA256 2c7cc90290d5ea2c56ad5899aef4e4fd4cc079569818190962c7a7839e75149f
MD5 a585663169706a2643c10b417b233138
SHA1 21fdc5e730e5d60b48ea2e301befa7c4f01cf41b
SHA512 89936c5bd5be2dc1a62aefa37dbf9f11fbc52c84ab2f75c504ad669ed5e4b784303c776f0f1a400cb50f674c642f6ee016b5720723c9841600edbddf21b79cda
SSDEEP 49152:U+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+EoUe+Ee+EW:V
TLSH
T1D5F65C09F94340B1D92B51B04DDFD2BF8A60BB2587128DFBFB4DCB1B6923BA16438255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1564-53-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/1564-35-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/1564-104-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/1564-76-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/1764-95-0x0000000000180000-0x00000000001A1000-memory.dmp

Download

memory/3376-88-0x0000000005850000-0x0000000005851000-memory.dmp

Download

memory/4524-87-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/4524-10-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/4524-62-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/4524-36-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/4524-23-0x0000000000CB0000-0x0000000000CD1000-memory.dmp

Download

memory/4852-103-0x00000000002F0000-0x0000000000311000-memory.dmp

Download