0f8913a5859c161fc073828d37031e1f37211419b0fe4d6d1117872ee4f2c996

Analysis

max time kernel
149s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe
Size 4.1MB
Sample260813-qqmhjsbc48
SHA256 0f8913a5859c161fc073828d37031e1f37211419b0fe4d6d1117872ee4f2c996
MD5 333af8dfa3a55004e44623df560c388d
SHA1 c1eb5dc890049bf19ec4318759f58b359a0e2eeb
SHA512 5877358f57d859800a8f38fc5a01bd97e71b7855f8f2e04651ed0877af8801ab26d0cc22e8d87ea56d786cbdc5945f68bdbea4425ee9bcd87111e4c34f3e18eb
SSDEEP 49152:U+ES+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOV9:T6969696
TLSH
T105163B09B6DA04E4E577567089BB817AC932BD314721D9EFA284C27E9D33BD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
5432	svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABBBABCABCACABACCACBAAACCACABACBACABCCCAACBBBAABCBABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe"	2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4768	sc.exe
3592	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3360	cmd.exe
1264	cmd.exe
2444	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1740	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
6104	2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe
6104	2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe
6104	2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe
6104	2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe
5432	svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe
5432	svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe
5432	svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe
5432	svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6104	2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5432	svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6104 wrote to memory of 3360	6104	2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe	96
PID 3360 wrote to memory of 1740	3360	cmd.exe	98
PID 5432 wrote to memory of 2760	5432	svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_333af8dfa3a55004e44623df560c388d_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCACAAACBAABABBCCCCAABBAACABBCBABACBABCBBACCACCCCABBCBBABCBCBABBBACCAAAAAABCCACABBBCCBBCCCBACACBCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBCCACAAACBAABABBCCCCAABBAACABBCBABACBABCBBACCACCCCABBCBBABCBCBABBBACCAAAAAABCCACABBBCCBBCCCBACACBCBAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBACABCABABBBBABACABAACACABAACCABAABBBCBBCBBCCCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe" start= auto displayName= "UserDataSvc_BBACABCABABBBBABACABAACACABAACCABAABBBCBBCBBCCCBAAB"
  2⤵
  - Executes a command shell one-liner
  PID:1264
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBACABCABABBBBABACABAACACABAACCABAABBBCBBCBBCCCBAAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe" start= auto displayName= "UserDataSvc_BBACABCABABBBBABACABAACACABAACCABAABBBCBBCBBCCCBAAB"
    3⤵
    - Launches sc.exe
    PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBACABCABABBBBABACABAACACABAACCABAABBBCBBCBBCCCBAAB"
  2⤵
  - Executes a command shell one-liner
  PID:2444
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBACABCABABBBBABACABAACACABAACCABAABBBCBBCBBCCCBAAB"
    3⤵
    - Launches sc.exe
    PID:3592

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5432
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe
1⤵
PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ResetOut.exe

Path C:\Users\Admin\Desktop\ResetOut.exe
Size 12.8MB
SHA256 84c4ba5a2b31493c87396efd4a17f4224471d54aad79d2e9698b1dc1631c82e9
MD5 f619aeb11e527cf46f01c00506e1ba76
SHA1 b1aa0db3c383b9493bd690e23f183a7824749e60
SHA512 bbdd8f9a9fcf31758e5ac97f18d2a89e7f17018a57237c099310e43a72357ade63d177fa8637e060227db3972ab1980be7057134fcab7dc9dedd888a4c4036b8
SSDEEP 49152:U+ES+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOVu:T696969u696969u6969699aSzJ
TLSH
T1D5D64C09B6DA04E4E577567089BB817AC932BD314721D9EFA284C27E9D33BD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetOut.exe

Path C:\Users\Admin\Desktop\ResetOut.exe
Size 1.1MB
SHA256 6ae9788b5e82307a189d94244ec62bd0a750144654de88559e2f37b9530bde43
MD5 79f7cc18896c8863690767cf30349528
SHA1 b079ad3458d0f80f0d94514d33f36f575f271602
SHA512 f351a2896f6e103baec50fc37e5331751f206e0118192e906e5d93b6a62e62fb86273c8e16577a25bef3e82047f416dc419292521d752da249f35d27ad87d4f6
SSDEEP 24576:m9+EM0q9+EM0aIh7C89+EM0q9+EM0aIh7CP9+EM05:U+ES+EBhOu+ES+EBhOV+EL
TLSH
T19F453C09F6DA04E4E577567089A7817AC532BD314721CAEFA284C27E9E33BD4AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetOut.exe

Path C:\Users\Admin\Desktop\ResetOut.exe
Size 29.3MB
SHA256 f696f5b31d5d664f8876552e0757b47531459ff67910df80a946c2f66c82a984
MD5 77f781ddd5a8e4b5a83ea4aa1378fdda
SHA1 88b281ed4cd79d27d56bcca36e66a84df2d8900d
SHA512 895bbc076bc88ddd15156640a53e20dd3bfb1257ea2a04368ae518685ee5b1069af6d565fc8721d65dc6be244814682d4f22ae7232e02a44372e450a76b1a4b5
SSDEEP 98304:T696969u696969u696969u696969u696969u696969u6969699aSzC:GzC
TLSH
T107673B09B6DA04E4E577567089BB817AC932BD314721D9EFA284C27E9D33BD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetOut.exe

Path C:\Users\Admin\Desktop\ResetOut.exe
Size 33.4MB
SHA256 cf942724349a3bd0d61dc4f76dd1804067370d50b728d5df1066d93458c5bb24
MD5 1ee292266b5dc07407e07faff089d812
SHA1 6172d969733f61e27d1be1d210621c64e65566b8
SHA512 5e48b1461f1e662f63ce268343abb82b2b39cae3456d3ab6762f1a2272cc2f2a89a2d5a968ed51e27a75fcbbe3deebacd143aacbead17580eb2a034feec63b58
SSDEEP 98304:T696969u696969u696969u696969u696969u696969u696969u6969699aSzw:gzw
TLSH
T19E773B09B6DA04E4E577567089BB817AC932BD314721D9EFA284C27E9D33BD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ResetOut.exe

Path C:\Users\Admin\Desktop\ResetOut.exe
Size 14.7MB
SHA256 99595a239d4288cdaf3be8798fc18bd7527f3452ac7058c2aa5e300676c5272b
MD5 123769b306667cf932d7727a7d2b1bc6
SHA1 a95b589ddd65f795ecc007ab7485d3e5be8ee9be
SHA512 6ff5ce75ba5fe5276472355e6712c6bf19387f194b393d53fc65a2af781ae5eaabfe7018d00f57cf48d8af20f9993ba8ee9170292f150b8b5912fda75259e13f
SSDEEP 49152:U+ES+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOVB:T696969u696969u696969u696n
TLSH
T1F2F63B09B6DA04E4E577567089BB817AC932BD314721D9EFA284C27E9D33BD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9d4d4f838e55b009f0d528b3cde4f776547b06b5bacad2d3b615393d4d764649
MD5 6b6d78f6695b183bab3b00cbbc029869
SHA1 735b9c33ed887da494793e805e7469088bde1bb3
SHA512 bbe39faa919bc9e3a6bcdf555095888ddc490ace38be6699bf88f6fa6dd8e9fe57eca6c347e0c739932adb32143c9a8079f5b3e351549b8b70ef8cde2dbeae4e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4dcfd2cbbb006f61cd2b4e60c92e8e3a6dd3a278c9655524e5cacdf168241bc4
MD5 fa7fa0cfbeed0600c6f340d59b1492cc
SHA1 9d91d4e21a9f4a7c6d3a4b368547aecff21dabe3
SHA512 f73bde7ab8d7185baa9d7c2372864fc22fc086794083b259291f3073b893620a4af1d07fadbae45379305a9684b0f9dcf678385cf5a7ecb1bf435af434581327
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 82cf6a91138933e82d0d1a2bf45b8845e890f1a44ce5533c146f7daed5e4cbd9
MD5 6e9e82808259388b982efd88d30eedcf
SHA1 113c73e882283ce214c6371d2b652c8233dd1a48
SHA512 35da5455735d4c05152f48213349c6b067ec7c9e320500fec5461c1072543a6a6d8efb810d8aaab2d40b545f3c96528699eed5215b6cf1b8d6a8b70a866f35e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cb2143fc71768bb888e97b75795c1d660b7bf28fd5f82ae291ca6c16cf497fd5
MD5 65b6e9face047fe11532b286d36fc9f9
SHA1 2a207abb26bb7c42787202bc2a6e709690680076
SHA512 ebf95eef377a5713c881df366bc1d5822b1e536840d9fa38c930104553baca93da526b5816fa22eb22dd26ab85125fd8ee16abece248987d1069c7274a3d79e9
MD5 SHA1 SHA512

Submit Download

svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABCAAACBABACACCBBAACACBBBCACABCAACBABBCAABCCCABCCBACC.exe
Size 4.1MB
SHA256 0f8913a5859c161fc073828d37031e1f37211419b0fe4d6d1117872ee4f2c996
MD5 333af8dfa3a55004e44623df560c388d
SHA1 c1eb5dc890049bf19ec4318759f58b359a0e2eeb
SHA512 5877358f57d859800a8f38fc5a01bd97e71b7855f8f2e04651ed0877af8801ab26d0cc22e8d87ea56d786cbdc5945f68bdbea4425ee9bcd87111e4c34f3e18eb
SSDEEP 49152:U+ES+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOV+E9B+ES+EBhOu+ES+EBhOV9:T6969696
TLSH
T105163B09B6DA04E4E577567089BB817AC932BD314721D9EFA284C27E9D33BD0AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5432-52-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/5432-34-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/5432-73-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/6104-35-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/6104-60-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/6104-0-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/6104-23-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/6104-12-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download