f1aae4e662a7675746d3918640096f9827c353125f3bced64259e74675bdabdf

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe
Size 7.0MB
Sample260814-dyyvbsteqd
SHA256 f1aae4e662a7675746d3918640096f9827c353125f3bced64259e74675bdabdf
MD5 b5822f9fe02237cef427ac702ad333a2
SHA1 bc734e00325d62e2a6d8aa8ece5e75f51a206228
SHA512 672fd1325952b38e52c82063a4902429c401b71c9abd31059635515b888135a718cffcc029bf38b4cb5d9f1dc1660fd802923b8ccc63e238b68aa4f9c087f2ad
SSDEEP 49152:U+ES+ES+ES+EWmhOSL+ES+ES+ES+EWmhOSL+ES+ES+ES+EWmhOSL+ES+ES+ES+E3:xMMMMMMMMa
TLSH
T188765C08F69740A5D977517089ABC27A89317D3147218EEFE6C8C63FAE33BD1A834B51
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5008	svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
5168	svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
3888	svchost_BCCCAACBAAABACCBACCCAABBBCCAABABAACAAACACACBBBAABBACCCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBABCCCACBBCABBCCABACBBBBAAABBCABACCCBCCBBAAABBAABBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe"	2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACACCCBACBABCCCABACBBACAACCCCACCBCACAABCCAAACCBCBCBBCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCAACBAAABACCBACCCAABBBCCAABABAACAAACACACBBBAABBACCCC.exe"	svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3060	sc.exe
4668	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5920	cmd.exe
1464	cmd.exe
944	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCAACBAAABACCBACCCAABBBCCAABABAACAAACACACBBBAABBACCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3668	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3372	2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe
3372	2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe
3372	2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe
3372	2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe
5008	svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
5008	svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
5008	svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
5008	svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
3888	svchost_BCCCAACBAAABACCBACCCAABBBCCAABABAACAAACACACBBBAABBACCCC.exe
3888	svchost_BCCCAACBAAABACCBACCCAABBBCCAABABAACAAACACACBBBAABBACCCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3372	2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5008	svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
Token: SeDebugPrivilege	3888	svchost_BCCCAACBAAABACCBACCCAABBBCCAABABAACAAACACACBBBAABBACCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 1464	3372	2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe	93
PID 1464 wrote to memory of 3668	1464	cmd.exe	95
PID 5008 wrote to memory of 5596	5008	svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe	96
PID 3372 wrote to memory of 944	3372	2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe	97
PID 944 wrote to memory of 3060	944	cmd.exe	99
PID 3372 wrote to memory of 5920	3372	2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe	100
PID 5920 wrote to memory of 4668	5920	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_b5822f9fe02237cef427ac702ad333a2_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBBACBCCAACAACACBCAAAACCACBCAACACBBCACBCAABCCBBAAABCBAACBCABBABBCBCCABAAAAACBCBCBABCBBAAAACCCBBAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCBBACBCCAACAACACBCAAAACCACBCAACACBBCACBCAABCCBBAAABCBAACBCABBABBCBCCABAAAAACBCBCBABCBBAAAACCCBBAACBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3668
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBCBACCCCBBBABCCAABABCCABABCBBCACBACBCAABBCCCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe" start= auto displayName= "UserDataSvc_ACCBCBACCCCBBBABCCAABABCCABABCBBCACBACBCAABBCCCACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBCBACCCCBBBABCCAABABCCABABCBBCACBACBCAABBCCCACCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe" start= auto displayName= "UserDataSvc_ACCBCBACCCCBBBABCCAABABCCABABCBBCACBACBCAABBCCCACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBCBACCCCBBBABCCAABABCCABABCBBCACBACBCAABBCCCACCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBCBACCCCBBBABCCAABABCCABABCBBCACBACBCAABBCCCACCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5596

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
1⤵
- Executes dropped EXE
PID:5168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAACBAAABACCBACCCAABBBCCAABABAACAAACACACBBBAABBACCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAACBAAABACCBACCCAABBBCCAABABAACAAACACACBBBAABBACCCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3792c50f2809f1096db79102f15b8e2b4ecd65277202d1b714407215bc43d132
MD5 5e49ee7b6b5d837d5aaed73dc6d57c24
SHA1 39e5500d46b5243f92ebdbf15f7afca00aa9b074
SHA512 955b1354ecf1b38013844c29b74db70901eba855e39692eedca7fea9ce323f30fb1ba57edfd2b86c7280bad379a22887f922ad849c953f65df85b129b931c68b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9abb7d6d09eccd961a7358ca0efc1744c1e6fab49ff70f48f9af7c89a9ce2ff9
MD5 f894719f4cf3d42aaeba508b62cae5f3
SHA1 c19d1d80fad9be99427acfd69d36ed4d43799f95
SHA512 1bc930d4a016701299333c248be64b6d8aabf21bd7650b079db7266c72fdfc0343d1cb7b1e2ced2fc5c359cdd0cc6d9dafa153f5ec9b4639f2baba8bb2fa0e8e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2ab0ce7f65086b28e35bc165a0fc28e26b3f5cda4bf3de4bbbb1710e240008bb
MD5 62e4c15c20862ab6af57caca2d173e13
SHA1 41278827b60f7dda9cd4c3d5bb01f1660e901407
SHA512 d7926b3a665cf42c85b090fa3bcf7a5fae680c49858524efeb59579b1a77901b5cf32953e27b1c8e87e881eee9d527a5b8ab4067feeeca0f7e693dc162000886
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f75c5c8ec7c0e48c5ddf03b8eee354b80ef252c744ee45fd28e77ee488963f2
MD5 5b9a01fe878b36537bf2360c10236649
SHA1 01a9beefec61b3301e2753b849382b077025c93f
SHA512 aa3dec7f724ea1f4493111a6175aae3d90d33c8205a95a5fbea922e988fcad8e5fb308a58f467521d54c9a195f7d0032849bcd2278022b3f7da691319afe8fbc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57975afbc5ab4cda5498600d884b95c5edefacb3b460bdafb70a45b7824b991d
MD5 a2e87fdaa053b91425e21f7d5f5870d6
SHA1 713f739a23f47ee9509411a22b8206dc44a4f7aa
SHA512 01a278f803470d8660c14913509c641771a362394fa8aa1323b75b27debcb7d42e1fbaa67fd4b66354b0a3951dd0cabca8850de926c0063c8d08038816fe0f5c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 811f7aad581de2db472ccee0b19c708af6ddc364bff87ca2325805572d996259
MD5 d812d8171b4d203101503010f9d7490d
SHA1 886041d0630f470720d6a7e6c4bb80e4ca750f11
SHA512 cb36798da17c1db3cff8d4d3d72e6addf44b9428972c4c0d62f7fb7d9e8350e92cffc9fe5b8ea2701cc0c0aaa70f3fe42d11cc3e6deba399d13ba2bc6ae9f138
MD5 SHA1 SHA512

Submit Download

svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCCBCABBACBBCBCCABCABCCABCAACBCABACABABCABABBABACBC.exe
Size 7.0MB
SHA256 f1aae4e662a7675746d3918640096f9827c353125f3bced64259e74675bdabdf
MD5 b5822f9fe02237cef427ac702ad333a2
SHA1 bc734e00325d62e2a6d8aa8ece5e75f51a206228
SHA512 672fd1325952b38e52c82063a4902429c401b71c9abd31059635515b888135a718cffcc029bf38b4cb5d9f1dc1660fd802923b8ccc63e238b68aa4f9c087f2ad
SSDEEP 49152:U+ES+ES+ES+EWmhOSL+ES+ES+ES+EWmhOSL+ES+ES+ES+EWmhOSL+ES+ES+ES+E3:xMMMMMMMMa
TLSH
T188765C08F69740A5D977517089ABC27A89317D3147218EEFE6C8C63FAE33BD1A834B51
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 20e7c916fd0ffb12153d11b6125d4d8e238582f6ad1a2c5175036546a99634b8
MD5 81876044c706441c2fc752399226343d
SHA1 fb16a71258d3037e7071b2b076b2452d6ea067c2
SHA512 4b0f51e0f55195a7896b85b4df23c6816251799d724c54983a6e9f68812dc1638942ff517d3947aff06af9045266f03946125580b18f0a3b7859450790bbd62c
TLSH
T18311E760E4E5E8A3ED3234DAA71E8B430CF0765F68587AA513054328EBE5C32CE558E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3372-0-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/3372-7-0x0000000000290000-0x00000000002B1000-memory.dmp

Download

memory/3888-81-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/5008-36-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/5008-23-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/5168-76-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download