759d2f8f57cbc589efa9dbdf75df9708d29f68f2d5b88855c0ca94dac456fd15

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
Size 5.7MB
Sample260814-e9efhavwew
SHA256 759d2f8f57cbc589efa9dbdf75df9708d29f68f2d5b88855c0ca94dac456fd15
MD5 43690212e65dc21ba6e54e9638b993c6
SHA1 ad066ed32f8d77885da690487bde868cd4215112
SHA512 cc294cec5bdce5561b101549ff5e0864a1e654ca3bfb35a3ebbad82805f9ec92d1484c9cb8d365299b51f09d6c233409418904062964045c65bca49a14b782d0
SSDEEP 49152:U+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2vd:V
TLSH
T1D756F80977FD4854F5F7B23489B28659DAB2B8915B32C7DF5280823D0E73AE4AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3432	svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
4508	svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
3516	svchost_BCBCABBACACBACAABCACCCCBBBABCBBABCCAABCACBBCCBCACBBABAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACACCABBCBBCACACBCCBCCABCABABABCCCBACCABAAAAACABBCACABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe"	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBCCCAACCAACBACBABBABCCBBAABBCAACCACBBCCCBBBACBCAACBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBCABBACACBACAABCACCCCBBBABCBBABCCAABCACBBCCBCACBBABAC.exe"	svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4284	sc.exe
2104	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4036	cmd.exe
2308	cmd.exe
4368	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBCABBACACBACAABCACCCCBBBABCBBABCCAABCACBBCCBCACBBABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3296	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
3296	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
3296	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
3296	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
3432	svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
3432	svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
3432	svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
3432	svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
3516	svchost_BCBCABBACACBACAABCACCCCBBBABCBBABCCAABCACBBCCBCACBBABAC.exe
3516	svchost_BCBCABBACACBACAABCACCCCBBBABCBBABCCAABCACBBCCBCACBBABAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3296	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3432	svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
Token: SeDebugPrivilege	3516	svchost_BCBCABBACACBACAABCACCCCBBBABCBBABCCAABCACBBCCBCACBBABAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1716	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 4036	3296	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe	109
PID 4036 wrote to memory of 4692	4036	cmd.exe	111
PID 3296 wrote to memory of 2308	3296	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe	113
PID 2308 wrote to memory of 4284	2308	cmd.exe	115
PID 3296 wrote to memory of 4368	3296	2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe	116
PID 3432 wrote to memory of 2920	3432	svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe	118
PID 4368 wrote to memory of 2104	4368	cmd.exe	119
PID 2920 wrote to memory of 4064	2920	notepad.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_43690212e65dc21ba6e54e9638b993c6_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACBCCAABACBBBBBBBBBBAABCCAABBACCBCABACAAACACBAAAABAAACACBCAAABACCAACBACCCBCCBCABCBAAACCBAACACCCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCACBCCAABACBBBBBBBBBBAABCCAABBACCBCABACAAACACBAAAABAAACACBCAAABACCAACBACCCBCCBCABCBAAACCBAACACCCCCCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBACCBCBBABBACBBCBACCABBCCCACCABACBBBBCCCABCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe" start= auto displayName= "UserDataSvc_CABCBACCBCBBABBACBBCBACCABBCCCACCABACBBBBCCCABCABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCBACCBCBBABBACBBCBACCABBCCCACCABACBBBBCCCABCABAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe" start= auto displayName= "UserDataSvc_CABCBACCBCBBABBACBBCBACCABBCCCACCABACBBBBCCCABCABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCBACCBCBBABBACBBCBACCABBCCCACCABACBBBBCCCABCABAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCBACCBCBBABBACBBCBACCABBCCCACCABACBBBBCCCABCABAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3432
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2920
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4064

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
1⤵
- Executes dropped EXE
PID:4508

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABBACACBACAABCACCCCBBBABCBBABCCAABCACBBCCBCACBBABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBCABBACACBACAABCACCCCBBBABCBBABCCAABCACBBCCBCACBBABAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f4c2644600b10eb17c556a779e37c8cb395c31c6b73a7f77538212a26886c15
MD5 134585c5c1ef0c3d3ebd783c3e9f0d3e
SHA1 a083c1f99add05f11815bb5bab29c5ea49a31bf3
SHA512 dbafed573dd47fb7e42311f0b2a81f188715198b93fcfab9850712103569f5675ff397856d84e5227c7809bbd44d99641474688b22fe64be3749c7ccdf920219
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8732f1b65a552ac4183f2459229f24d1345dd9cc190cda3602f10f72080d9a8c
MD5 7a25707432db09c468f82fd4ead65479
SHA1 5a66080113c91036f05462187eb27bb135e8928d
SHA512 1a48c2b39ce885253331e787f1ac21efa7a31474e57a5fb12177a9060e715277fa7f0a29a7be494c6affa46a2eae7f8857c4228d3f1e90590ebd1230ca76701a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 443ab3e34c53b58262f90fe300ebc246e3896227147a7e92b4b75bb495ed4793
MD5 9fe1470903482ed45dcee0a3eb6f8d94
SHA1 e4e9284f26ddf57e0a8b4f0ba9b020ba67ddca61
SHA512 82ffc9e36a1bd1ecb27aa999a1686384bcfaed390961d07d0970bdbdade62402a4fba4a8016709e4efe084c88b8f9cb843e8cad86308a649221421afea5b8123
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5d643cfde4aafb03d9a6a23a6368e40ff88f5056863a907f2359b2f10de5138e
MD5 a67cfc40655f3676fa728542b04ca232
SHA1 e69b7276ec1afc2e7de7063e0f2f5a1fd0130526
SHA512 de20f8d25d8456a62826c7bc4cadeeafde890b64cca98395500f263246aeb2ef24200dbedb5a08ef7c9f9a63701efcf0de612f6def98940286ae990138fe289e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 14d60151f19ba434ee5238ffcbec83598e89b6861b5c8083997737ec0c5fe35b
MD5 55cc14892426ee922457e62ff433ac84
SHA1 8095aa2ccafc73fe2bb566431441eb7e0c402c1e
SHA512 5eb43b8b8bee3792f7bba94f641b8e272f1a415b96b297684313d70a085197bd3267b0a700a108eb80d8d38f0a86f49465864e8e9c5f6374be229aa2d8cc64e5
MD5 SHA1 SHA512

Submit Download

svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABBABACCABBBBBBCACAAACABCBBBBCAABABACCAAAABACACABBA.exe
Size 5.7MB
SHA256 759d2f8f57cbc589efa9dbdf75df9708d29f68f2d5b88855c0ca94dac456fd15
MD5 43690212e65dc21ba6e54e9638b993c6
SHA1 ad066ed32f8d77885da690487bde868cd4215112
SHA512 cc294cec5bdce5561b101549ff5e0864a1e654ca3bfb35a3ebbad82805f9ec92d1484c9cb8d365299b51f09d6c233409418904062964045c65bca49a14b782d0
SSDEEP 49152:U+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2viw2J+EViw2vd:V
TLSH
T1D756F80977FD4854F5F7B23489B28659DAB2B8915B32C7DF5280823D0E73AE4AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 0b79491435f1b2aa5f04d0e43b58e6de7ef8b788821c70e969b9c91f559dbe26
MD5 925f6ddd7e80ebfccafad6df193e4de4
SHA1 edf85676fe3954562ea132e05a8c346aa069b6cc
SHA512 b2bd0adf81111b9225f3875e49d485c80148d079ed8fc36ad9fb5b12e708641cfb36d5f6e22509e628bef8929aa4c6748b246a0be7ec82693c235e05ca38b3d0
TLSH
T1BB112B10E8E5DC33D83278CBB61DCBD20CF5B39BA9586E5023058228BF55D304D594D3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2920-66-0x0000000005190000-0x0000000005191000-memory.dmp

Download

memory/3296-6-0x00000000005D0000-0x00000000005F1000-memory.dmp

Download

memory/3432-38-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/3432-25-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/3516-89-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/4508-74-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download