787a60ef6c6ec12c96f81c67e6c9a82723709e90ba107b137c8c7927b91b1b38

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe
Size 31.4MB
Sample260814-c8k6jsbl3v
SHA256 787a60ef6c6ec12c96f81c67e6c9a82723709e90ba107b137c8c7927b91b1b38
MD5 f7961e1f3b52ca8a7a700a405e97c536
SHA1 f857df854031da1a2ad0e2f1debcaeb86ee48f3c
SHA512 aee1cf4b2bd45f764a7e65906cf32489e81197e8bebe271db34d604b30ec15e32122f3db9ad22ca12ccac93c7976e6fbbbc62af5564ef284fdfa8b4048d4e23d
SSDEEP 98304:irCrRrCrRrCrerCrRrCrRrCrerCrRrCrRrCrerCrRrCrRrCrerCrRrCrRrCrerCX:j
TLSH
T170772A1F22BC00B6C96ED179E2D18156D6B0B03127622AEFA160CB7D9F5F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4516	svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
4776	svchost_CBBABBBAACCCBCABBABBCAACBCCBACBBCBCCBCBCACCACCBBCACCBBB.exe
3264	svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABCAAACCCABBBBAABABCABCACABAACCBCBCCCCAACABACABCCCACAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe"	2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCCBAAACACBABAAACCCCCBBAACCCBACAABACCAACACBBCACBCBCCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBABBBAACCCBCABBABBCAACBCCBACBBCBCCBCBCACCACCBBCACCBBB.exe"	svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4652	sc.exe
2224	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2668	cmd.exe
4940	cmd.exe
5928	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBABBBAACCCBCABBABBCAACBCCBACBBCBCCBCBCACCACCBBCACCBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1080	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2192	2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe
2192	2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe
2192	2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe
2192	2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe
4516	svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
4516	svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
4516	svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
4516	svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
4776	svchost_CBBABBBAACCCBCABBABBCAACBCCBACBBCBCCBCBCACCACCBBCACCBBB.exe
4776	svchost_CBBABBBAACCCBCABBABBCAACBCCBACBBCBCCBCBCACCACCBBCACCBBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2192	2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4516	svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
Token: SeDebugPrivilege	4776	svchost_CBBABBBAACCCBCABBABBCAACBCCBACBBCBCCBCBCACCACCBBCACCBBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2668	2192	2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe	92
PID 2668 wrote to memory of 1080	2668	cmd.exe	94
PID 4516 wrote to memory of 1400	4516	svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe	95
PID 2192 wrote to memory of 4940	2192	2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe	98
PID 4940 wrote to memory of 4652	4940	cmd.exe	100
PID 2192 wrote to memory of 5928	2192	2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe	101
PID 5928 wrote to memory of 2224	5928	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_f7961e1f3b52ca8a7a700a405e97c536_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACAAAABBAABCCBACCCABCBCBBABBAACBBBCCAACABCAABBCCBACACBBAABACCAAABCBACACAACABACBCCAAACCBABBCBBCBBBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCACAAAABBAABCCBACCCABCBCBBABBAACBBBCCAACABCAABBCCBACACBBAABACCAAABCBACACAACABACBCCAAACCBABBCBBCBBBABAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABCCBBBAABCBCAACCCCBBCCCABCCBBAACAAABCACABCBCCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe" start= auto displayName= "UserDataSvc_AABCCBBBAABCBCAACCCCBBCCCABCCBBAACAAABCACABCBCCACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABCCBBBAABCBCAACCCCBBCCCABCCBBAACAAABCACABCBCCACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe" start= auto displayName= "UserDataSvc_AABCCBBBAABCBCAACCCCBBCCCABCCBBAACAAABCACABCBCCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABCCBBBAABCBCAACCCCBBCCCABCCBBAACAAABCACABCBCCACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5928
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABCCBBBAABCBCAACCCCBBCCCABCCBBAACAAABCACABCBCCACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2224

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1400

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBBAACCCBCABBABBCAACBCCBACBBCBCCBCBCACCACCBBCACCBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBABBBAACCCBCABBABBCAACBCCBACBBCBCCBCBCACCACCBBCACCBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4776

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
1⤵
- Executes dropped EXE
PID:3264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a738b111898af929620c19e5f9aef30330ffc6c37b0e85ffd76d24061d94878
MD5 4c8d2a64fb85de240a0ea092bdc5af2a
SHA1 4039afeb8ee609d1f8da8a546d54452d87a2be56
SHA512 c254d83d6cedda0b50acc056bac1212354a6b2bd02302f3097ffe307ab327513eea32522ec83e76118746161ddf15b3756026f28ba0e1345a8eee467a69e9f92
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f606bdaafb18efcab2e6cdf399344f69c987fd46cb990927af77073af58b52c6
MD5 d6efdf19b57b9439b7ee3fea8f75d7f7
SHA1 64b48305f4b75d36535d4557a402d3464ce0d9b7
SHA512 1b956d244d5429ed735be43572e0d0bad4e5afe7c42a67506984c6efda333070c92993e63751947977618bbd2d824705852670304c305d287aa5924eced4acd3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 67c9021222a8e2fc424666ae326528fcb55fe46a7808e404bdaaf7a96c39812f
MD5 a01bbea5bc00487e4f995b9b39c21376
SHA1 60c13e41dfb04dcaf3d0a6175ffd030fe883c2a5
SHA512 bb096c107f3b500ebab8971d5c219633082abf874a90569a2ab02c5ba9476fffea1d4ca59949049df4777b2137ad82c0bbf0bc7435d57b0c1a2bca6aaec02c19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d61f1d057042eb1b150fb33bccfe1ffc6b9b71e5f4eb28a5d222d31564ffeb3
MD5 5f274ed79da9f640e2333dd82ff3cf86
SHA1 c457a02f010a4b4d1d4b72b19a5024f6c60d2c13
SHA512 39985970cc9b395e9bad09770996fabcf264697c7f0d91df7bb7c1e5edfc40bb135edd043f6e8dbe2ca4b6dff8f4a901007974c50cf7bd11a1f30e6b016500e5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f4f4244a64208e1f00ff95a450065d35abcac3248f19852c77f87290364582a2
MD5 71bba0bf81d8519ba548e58f9bdc3b32
SHA1 facf22fe24e02a501e93f46593f65146275f1cb2
SHA512 289105ccc3a1d295998681b8d483ce3dbd328c1a5e37f03d808aa1f4931a43e01474669ad45f4e5d0a42731d31237313ce2451d755a4356b06756d91ea3efa17
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6d5307d1ce9304033b348ead094d8d1bc4609292eda8b697cd30884f3b36ddbf
MD5 da9106c7ae4148e235c1f9cae9e323d6
SHA1 a663303cc6e4b0323b45e02711415c0426c6201f
SHA512 c8e1b32dc98ebe250c9378ea2191a766b60d526da09142d95328d3a678b0a77654582761df6066b2b52bddb5755fe764a9d3fd3de5bf92228005cfd4f9e74e09
MD5 SHA1 SHA512

Submit Download

svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABCBACACCBCBBBCACACCCABBCCCAABCCCCBBABBACCAAAABCCCBCC.exe
Size 31.4MB
SHA256 787a60ef6c6ec12c96f81c67e6c9a82723709e90ba107b137c8c7927b91b1b38
MD5 f7961e1f3b52ca8a7a700a405e97c536
SHA1 f857df854031da1a2ad0e2f1debcaeb86ee48f3c
SHA512 aee1cf4b2bd45f764a7e65906cf32489e81197e8bebe271db34d604b30ec15e32122f3db9ad22ca12ccac93c7976e6fbbbc62af5564ef284fdfa8b4048d4e23d
SSDEEP 98304:irCrRrCrRrCrerCrRrCrRrCrerCrRrCrRrCrerCrRrCrRrCrerCrRrCrRrCrerCX:j
TLSH
T170772A1F22BC00B6C96ED179E2D18156D6B0B03127622AEFA160CB7D9F5F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 043be76f4c96995091c1a7945474c9cd85952fa27cbb3fb9c2d6c288e6fdb48f
MD5 f1d95c98886faa168289ce2e951c6c3e
SHA1 672b19b884b17625d805d3f153bcac5d20740f45
SHA512 031622a69f895e934e099b8c436540723c3d936aa984186d932c64268f37e3deb8c3e8db9320d13099b9ebda48038055dcf8a6038159d2edfe3a41327a8008d1
TLSH
T14A11A340F4F5DC17E833E8CB57298BB208B477EB9C5CAA55220A812CBB56C324E154E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2192-7-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/2192-0-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/4516-23-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4516-33-0x0000000000780000-0x00000000007A1000-memory.dmp

Download

memory/4776-79-0x00000000009D0000-0x00000000009F1000-memory.dmp

Download