2864626f1c8c9b104aaffd270fb498a6561d6039a0dac5e0d2f35c5137fe9587

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe
Size 3.3MB
Sample260814-dybpsseh77
SHA256 2864626f1c8c9b104aaffd270fb498a6561d6039a0dac5e0d2f35c5137fe9587
MD5 b75b80b70fb46ec42211cdeccb50f6e4
SHA1 eaeff1e648c06cfbe3d6e007f55789ffea24d8aa
SHA512 66bf71f5f8f62c03b68665b55940ac4296db1f43a3e2288a71517845649ba295599fcdfc31afc97df954faeb9b6ba29a499f8138e204d8a5a7404ed30a336395
SSDEEP 49152:U+EPiw2i+EPiw2i+EPiw2i+EPiw2i+EPiw2i+EPiw2i+EPiw2i+EPiw2y:U
TLSH
T16BF53B0977ED4854F5B7B23489B68669DAB2B8915B31C7CF5280833D0E73BE4AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2392	svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
1956	svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
1992	svchost_CBAACBCCABBABBABCCACCBCBAAACBCAABCACAAAABCBBCACCAAAACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCACCACCAACACCCBBCCCACBBBAAACCCCCABAACCCBBABBCCBCCCAABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAACBCCABBABBABCCACCBCBAAACBCAABCACAAAABCBBCACCAAAACCA.exe"	svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BBBCACACBACCBBCBABBCBBBCABCBBBBBBBCCCCABCAACBBBCBAACCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe"	2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2536	sc.exe
3684	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4784	cmd.exe
2932	cmd.exe
3768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACBCCABBABBABCCACCBCBAAACBCAABCACAAAABCBBCACCAAAACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4132	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3828	2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe
3828	2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe
3828	2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe
3828	2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe
2392	svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
2392	svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
2392	svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
2392	svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3828	2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2392	svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4020	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3828 wrote to memory of 4784	3828	2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe	97
PID 4784 wrote to memory of 4132	4784	cmd.exe	99
PID 3828 wrote to memory of 2932	3828	2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe	101
PID 2932 wrote to memory of 2536	2932	cmd.exe	103
PID 3828 wrote to memory of 3768	3828	2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe	104
PID 3768 wrote to memory of 3684	3768	cmd.exe	106
PID 2392 wrote to memory of 3836	2392	svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe	108
PID 3836 wrote to memory of 2632	3836	notepad.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_b75b80b70fb46ec42211cdeccb50f6e4_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAAABCBCABAACCACAABBBCCCABCCACBBACBCBCAABCAABAAABBACCCABBBBCBBCCCBBAAAAACAACCBBCABBBBCACCCBABAACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCAAABCBCABAACCACAABBBCCCABCCACBBACBCBCAABCAABAAABBACCCABBBBCBBCCCBBAAAAACAACCBBCABBBBCACCCBABAACAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4132
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCCACBCBBBABABCABAABAACABAAABABAABABCBAACBAAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe" start= auto displayName= "UserDataSvc_CCBCCACBCBBBABABCABAABAACABAAABABAABABCBAACBAAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCCACBCBBBABABCABAABAACABAAABABAABABCBAACBAAABCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe" start= auto displayName= "UserDataSvc_CCBCCACBCBBBABABCABAABAACABAAABABAABABCBAACBAAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCCACBCBBBABABCABAABAACABAAABABAABABCBAACBAAABCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCCACBCBBBABABCABAABAACABAAABABAABABCBAACBAAABCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3684

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3836
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
1⤵
- Executes dropped EXE
PID:1956

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4020

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBCCABBABBABCCACCBCBAAACBCAABCACAAAABCBBCACCAAAACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBCCABBABBABCCACCBCBAAACBCAABCACAAAABCBBCACCAAAACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b3411d1b0cae6c66b96005213187f5837fdb6788a308933a09441028dcd64e60
MD5 11aba1ad6a0d35d4390b8a2ce646592d
SHA1 5a63dcaef0347a28e216ed38565e4c235c66efef
SHA512 d8bb47d12e58811b0a9649ae6246138803ad219e171d5a53ff8a6612c991d3b7f8b10adcb7c3f928c3da840ea869db3d8ccf8d9e9e6093f24ec3fb22bdc16efe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 575decd2704488ab1aab71eb4a65eb63bb370e21136e83f2a8e6d0d642205fab
MD5 3a9d2f6b992637ae06c6d09f75ae3c52
SHA1 f2df9390fa462f4ad9a287b477d73dca05a4fabd
SHA512 801d8e3cd3e87c778ff4650af8d2868c847c02991dae1642437454c92a7f19f560b34b5cbbeb4275b1c5e5a12b86bf6019d04cb234039895846f0398cd549491
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 341fd5cee117372615ee8dd6170521b827d40615bc353de5c6813685ceac53f9
MD5 458084e28c170bce712c01f7242a7f40
SHA1 1c7d3176df2d81aa35e7f0be5505caa2947ad361
SHA512 173b4c7d293357023b1c6bc7f576433200f2811302dc4a53bded7b5534bbc94d7378aa85aae6b879d6e14cdf826299f8291a8d728c193f1a92473f6d246658ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 965fbc64eedefb12ffcde6dcbde01253d0052b3323d57fe480becd5a5bf40294
MD5 1fcc1e0bccaa89b178ef962ada130af4
SHA1 9cdd6132b12b36db64deb84017403f616bd5bf00
SHA512 f2e3bf22ca8a7d2d897c9ec7d75aa24ba0b085660c27ad6ee9c89d8097584905c880585afe65e4b0071e37535fe3508570ba5cdaadaeb36dac42da8b4c5726fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7bc8b7fff5c4a3aed9dbc2ea43016ada88da917de271c4ad58a108fe72b9f551
MD5 d163280952fd6ac314d18f9ca0a2ee7d
SHA1 18d2e263cbc73ec9220af9b751df0e6dfba4ace9
SHA512 689c0c7921ece67bdd75982ec34038409d4952eebd8af30f938e2153d71ad8f9d0a72168d1bcf497b74ad84ed3a9a89c144a85f95faa05374d4c56b622357d69
MD5 SHA1 SHA512

Submit Download

svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACBCBCBAACACBACACBABBBBABACBACAACBAAABCACCCBBABCACB.exe
Size 3.3MB
SHA256 2864626f1c8c9b104aaffd270fb498a6561d6039a0dac5e0d2f35c5137fe9587
MD5 b75b80b70fb46ec42211cdeccb50f6e4
SHA1 eaeff1e648c06cfbe3d6e007f55789ffea24d8aa
SHA512 66bf71f5f8f62c03b68665b55940ac4296db1f43a3e2288a71517845649ba295599fcdfc31afc97df954faeb9b6ba29a499f8138e204d8a5a7404ed30a336395
SSDEEP 49152:U+EPiw2i+EPiw2i+EPiw2i+EPiw2i+EPiw2i+EPiw2i+EPiw2i+EPiw2y:U
TLSH
T16BF53B0977ED4854F5B7B23489B68669DAB2B8915B31C7CF5280833D0E73BE4AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1956-74-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/1992-80-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/2392-25-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/2392-38-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/3828-6-0x0000000000710000-0x0000000000731000-memory.dmp

Download

memory/3836-67-0x0000000005380000-0x0000000005381000-memory.dmp

Download