e343b0520b58d20cd83a474a89d1a2173800b974878c6582d8e8e34fde786478

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 22:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe
Size 557KB
Sample260814-2ydfdstcka
SHA256 e343b0520b58d20cd83a474a89d1a2173800b974878c6582d8e8e34fde786478
MD5 cfcd64300820566471985ac594c36d1a
SHA1 f699d3b916b726ea5447bc80c8049d051dd41893
SHA512 bd8aeaa4eb8f1adfa92fc972c9c8761896b05289248cbb8cc17d1267502477808f0acd9e0d663bda785aae177c51aafd44ed8824d2856f3179f4500b8fac0efc
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojAeqYymh7vagvq:m9+EM0q9+EM0aIh7Cl
TLSH
T107C43B09B6DA04E8E577567089B7817AC532BC314721DADFA284C27E9E33BD4AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3764	svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
5808	svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
2484	svchost_BCCBACBAACCBABACABBCCCCABABABAABBBABABABACCCACACBACABCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCACABBCAAACCACCAABCABBACCBCCBBCBACBACBABCABCBCBACBCCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBACBAACCBABACABBCCCCABABABAABBBABABABACCCACACBACABCA.exe"	svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABBCCBBCBCCBACACCABCACACCBBBACCBCBBBBCBBAAAABACBACACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe"	2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4884	sc.exe
3052	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3828	cmd.exe
5776	cmd.exe
5812	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBACBAACCBABACABBCCCCABABABAABBBABABABACCCACACBACABCA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3600	2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe
3600	2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe
3600	2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe
3600	2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe
3764	svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
3764	svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
3764	svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
3764	svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
2484	svchost_BCCBACBAACCBABACABBCCCCABABABAABBBABABABACCCACACBACABCA.exe
2484	svchost_BCCBACBAACCBABACABBCCCCABABABAABBBABABABACCCACACBACABCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3600	2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3764	svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
Token: SeDebugPrivilege	2484	svchost_BCCBACBAACCBABACABBCCCCABABABAABBBABABABACCCACACBACABCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 3828	3600	2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe	92
PID 3828 wrote to memory of 5404	3828	cmd.exe	94
PID 3764 wrote to memory of 720	3764	svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe	95
PID 3600 wrote to memory of 5776	3600	2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe	96
PID 5776 wrote to memory of 4884	5776	cmd.exe	98
PID 3600 wrote to memory of 5812	3600	2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe	99
PID 5812 wrote to memory of 3052	5812	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_cfcd64300820566471985ac594c36d1a_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBCACABAACCABCACBBCBCABACBABCAACBCCBABBCABACACBABABAACAAAACACCBCABBCAACCBCBBABBAAABBACCACCCBCACAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3828
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBCACABAACCABCACBBCBCABACBABCAACBCCBABBCABACACBABABAACAAAACACCBCABBCAACCBCBBABBAAABBACCACCCBCACAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBAABCBCBAACACCBABCBCAAAABCCBCAAABBBBACBBCAAACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe" start= auto displayName= "UserDataSvc_BBAABCBCBAACACCBABCBCAAAABCCBCAAABBBBACBBCAAACABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5776
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBAABCBCBAACACCBABCBCAAAABCCBCAAABBBBACBBCAAACABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe" start= auto displayName= "UserDataSvc_BBAABCBCBAACACCBABCBCAAAABCCBCAAABBBBACBBCAAACABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4884
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBAABCBCBAACACCBABCBCAAAABCCBCAAABBBBACBBCAAACABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBAABCBCBAACACCBABCBCAAAABCCBCAAABBBBACBBCAAACABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3052

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3764
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
1⤵
- Executes dropped EXE
PID:5808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACBAACCBABACABBCCCCABABABAABBBABABABACCCACACBACABCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBACBAACCBABACABBCCCCABABABAABBBABABABACCCACACBACABCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5023c8e9b23d8598c5331dd4fb678e648362fba249a0db4746b635dd8ceddf07
MD5 b96d57233fd09a9fc3f61b083bb017e6
SHA1 e52c0b8a7a28461518630c047da55256eb348dc4
SHA512 614a278ee6c1a571aa7b79cf523f37d807ff815e9f1a4dd8746a9f4778fd04bd4452dce2ecd124ed02997b31a5580c5625a4978d3f9dda7ca7a0167e879037e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 539415385eaa17cdaa4c4f39d6894aa2e6338ee8354c64be3a709c61a5d41d0a
MD5 d62c400c07f332fb770f6ee2e5a2c855
SHA1 63297ca9d41965837fff82632ff3574a4f2e6c34
SHA512 c6d0d07ee903e751b3a4bd468e2878ca4e12fe82225aef1a5f4c91bb8284871fe71cda6fa20ebc694724d4a4d205cf9a9e8889dc9842cd4ddb1b9036f6304597
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9412e28faec92346857f7fb6cd0c8ed0820b18f3ceae29bbd7488900388ae020
MD5 c5194242ede785fdaa74edf38e901cbc
SHA1 3fbc29a49a7a12211af2bc715c0be4918128dd7c
SHA512 07b16ebed90e41ef6b6a9165c3866ce5240acfbf4db8e0b8b6aeaee8783ca2e69c5c7f5fc4de92db3a741a0ad33a264351a13146c3fe1144a9c6b52b71d3fe3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 21096337fc16b86182b7bcfcc5a27545c9328da3f396a6b97dab8fa6578aad52
MD5 73af6f0a9f7bd1645c2b60d50133bfe7
SHA1 c4a79e50daaf89b9341c0b249b01e3adf7c01270
SHA512 b3b8a3b02f206dca5f048951f51217213ccb464f4af0d586f3656854b39a0fa9ff04cd3bd3e328c45927a18d9100d675f4460daf00aab73f03c9ef825076554d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 85624bed3f099e70ccd0c275d1e09f4b8c82e8e8c9934d9030adfd6428adcb35
MD5 79b02be4ba14c7f6ce40d3581ae89b33
SHA1 bf3c6ce9fffef5d6343a1217b961cc21a4646227
SHA512 d26c4e8cca430b42d7cc94790f79e2354b58628c56456149bf73ea46339d010f6934df39f29ea442124c398e8c6831a03737fcf064be933e3636909124bd5072
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 aa8fef882f523785bc6df65719a14c2fbf2d79541805cdf1b25a0c01ea934a51
MD5 083d33068d41d632d8c5848e29b7117e
SHA1 df6a8d677258887526fedd88b46d664e6b7f411f
SHA512 145661ed06266d136b0e776aa5f3968a256bb1d65229d0360185fb45d773293af2371e99af88fede11ffd8f2dba45f2068ffa22a5ca75a8cd93fefd25e136a8e
MD5 SHA1 SHA512

Submit Download

svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCABCABCCCAABABAACAAACBCAABCABABABBACAABCABABABCABA.exe
Size 557KB
SHA256 e343b0520b58d20cd83a474a89d1a2173800b974878c6582d8e8e34fde786478
MD5 cfcd64300820566471985ac594c36d1a
SHA1 f699d3b916b726ea5447bc80c8049d051dd41893
SHA512 bd8aeaa4eb8f1adfa92fc972c9c8761896b05289248cbb8cc17d1267502477808f0acd9e0d663bda785aae177c51aafd44ed8824d2856f3179f4500b8fac0efc
SSDEEP 12288:mgUFgEsnojA9gUFgEsnojAeqYymh7vagvq:m9+EM0q9+EM0aIh7Cl
TLSH
T107C43B09B6DA04E8E577567089B7817AC532BC314721DADFA284C27E9E33BD4AD34F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 ccfb47760f21c62ec7a8371e4b7879e7dbb5b25dab509edc11b76ab6b5eafbe4
MD5 fcb690558d1d3f997abd77c6ddd841b5
SHA1 8e592b9ee7c071db1113022d0df597eb5198f6c3
SHA512 77a8fcaf50dce0ebf836c6b541bc5e160346e68810985fa8899ea5cafe9b074dd6457fa70ea394c0a7bbfad818f7c1de49f3811b894784721500cff09c405653
TLSH
T13911CE5194F6D817F9232897EA29AB430CB13A9FA85C6E14324B8218A7CEC31CD150E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2484-72-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/3600-7-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/3600-0-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/3764-23-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/3764-36-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/5808-67-0x00000000008E0000-0x0000000000901000-memory.dmp

Download