16add5baaddcc4e2ca3e08a64baf175ad4f1357e5d0a930608efb0460e577015

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe
Size 9.2MB
Sample260814-eja1dsck6z
SHA256 16add5baaddcc4e2ca3e08a64baf175ad4f1357e5d0a930608efb0460e577015
MD5 82517f3e4b770a2e082a4f7b16ca9d2e
SHA1 9eb0a572211badc6214282dd03b2a236681d00b7
SHA512 b6a6ec163e6e098e2087f27d5bebaf48f683db9dc91d0580fbf243599bc66ec2063b4c7dbe9155cd3632b31c38b70205285b5d8b1ddeac54233b0231c85a8ab7
SSDEEP 49152:U+EPiw21F+EPiw21WU+EPiw21F+EPiw21WU+EPiw21F+EPiw21WU+EPiw21F+EP+:U
TLSH
T19CA62A0677ED4854F4B3723489B68665DAB2BC619B31C6DF6280833D1E73BD0AD34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3836	svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
2744	svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
2556	svchost_BAACBCCBBAAAABBACCAABACAAACCCABACCCACBABBBBCBACAACAABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCABBAAACCABABBCCABBACBBACCCCCBABABACCACBCBBCABAAAAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe"	2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCBAACCBABACBBBBACCBBCAAACBAAAACBAACBCBACBBACABCCCBABAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACBCCBBAAAABBACCAABACAAACCCABACCCACBABBBBCBACAACAABBB.exe"	svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4816	sc.exe
1640	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4576	cmd.exe
1804	cmd.exe
372	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACBCCBBAAAABBACCAABACAAACCCABACCCACBABBBBCBACAACAABBB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4652	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4724	2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe
4724	2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe
4724	2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe
4724	2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe
3836	svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
3836	svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
3836	svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
3836	svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3836	svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1136	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4576	4724	2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe	96
PID 4576 wrote to memory of 4652	4576	cmd.exe	98
PID 3836 wrote to memory of 1752	3836	svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe	99
PID 1752 wrote to memory of 4132	1752	notepad.exe	100
PID 4724 wrote to memory of 1804	4724	2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe	102
PID 1804 wrote to memory of 4816	1804	cmd.exe	104
PID 4724 wrote to memory of 372	4724	2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe	105
PID 372 wrote to memory of 1640	372	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_82517f3e4b770a2e082a4f7b16ca9d2e_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABBCABBACCCCBCCCCBABBBAABBCAABCBAABBCBBCAABCBCBAABABABCCAABCAACBCCCBBBAACCCCACCACCBBCACBBAAAAAACACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAABBCABBACCCCBCCCCBABBBAABBCAABCBAABBCBBCAABCBCBAABABABCCAABCAACBCCCBBBAACCCCACCACCBBCACBBAAAAAACACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAAABCCAABCCBBBACCCCACAAAAAABACBABAABBBAABBAACCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe" start= auto displayName= "UserDataSvc_CAAABCCAABCCBBBACCCCACAAAAAABACBABAABBBAABBAACCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAAABCCAABCCBBBACCCCACAAAAAABACBABAABBBAABBAACCCCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe" start= auto displayName= "UserDataSvc_CAAABCCAABCCBBBACCCCACAAAAAABACBABAABBBAABBAACCCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4816
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAAABCCAABCCBBBACCCCACAAAAAABACBABAABBBAABBAACCCCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:372
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAAABCCAABCCBBBACCCCACAAAAAABACBABAABBBAABBAACCCCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1640

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3836
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1752
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4132

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBBAAAABBACCAABACAAACCCABACCCACBABBBBCBACAACAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACBCCBBAAAABBACCAABACAAACCCABACCCACBABBBBCBACAACAABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 222c8a759832f28ace97e55f316c35be494e0aa393c04c58c3ee45cb3016e265
MD5 32ff1a69ea8a557470f88ecadfd75a46
SHA1 ed2589ff1793f7682638c1cddc092c6f68c4a3ee
SHA512 8f605b86a617f1ac443195f755add4542aac3a052ca7e26aa3177be2ce4fcc1b4af9e699b46b3b2db9f9b3e84e9046f91f2a533ca732e3de12aa2af1e6c2e45d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1005cdf2e2bb6328f161229541d01f12e7218cbb3d6a9f17f52124725c240e3
MD5 292b630b0ea63eaad3167cdb2591418c
SHA1 653fa832322c54aa896c9488fd1998da1a578e4b
SHA512 a64b337e178b638aac82cbe54054e3036055d3c4fe649dc758bae979abc483990dac1ef2f615654721a2f5a54072ac11dbed877893f50d40e99bcc0966f2fd4d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2a163044d4eb3fe81ccfa63521fd20f3d45f5ded62c11a2c5706764001cab3a0
MD5 636a45903fc13030c7fe2121eb54fa38
SHA1 2de43684424f72769bfec32e8636bca497d9f5af
SHA512 6bf384089d69990009363c51021bcd6065475eaa3ae41c90395656b5ac734a19bca4b247df88cb69033cacd46f8922c1c059d38f17d3f83de5c62c4d2bbcd532
MD5 SHA1 SHA512

Submit Download

MoveAssert.exe

Path C:\Users\Admin\Downloads\MoveAssert.exe
Size 384KB
SHA256 4696444ece7291a8df56034a80550fb20ba53a50f42520e1b5d73b17d512866d
MD5 a494cfbc0ad7ed38a88218952df101bd
SHA1 2ab79d663022d438f7ba62d2d4a164f080babdbb
SHA512 19954b9392d19552ecc68343b3591c236f7001957c2b0b0ea539d0f718d1653389e29c16b7ddb488c4a5c598dec73f90afda119cd5abe04f687b853de2cde1f8
SSDEEP 6144:m+dTTUFgEs3XojAdF0VPUgjnRtnNlW4+WD8TbVC2arT:mgUFgEsnojAMTjkWIw2y
TLSH
T15D842B0977ED0854F5F7B23489B68669DAB2B8515B32C7DF5280833D0E73AE4AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9f72489084561436f9682733124d838b1bbcf85f885e78664e00228c3071fd60
MD5 535f87a163daccbe627dbe8c938d9652
SHA1 969a43224f4c4f10d53450360fda5549ef41cfe7
SHA512 4e076099a3c5195497202c1ac130f6c76d4cf2b10f8f861d40e0d91cc7eba5220b1c914e77745928d2dd8e753c0649dd192d0dcce13b83b97c94fe9cd871dad7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 adfeb48a1218d44811bb028cc46d9051b1bf665272b94944b08a5284013b0245
MD5 5eb6e8b5a0141c03331d0a4f71093758
SHA1 61acfd5b4cfc838c1694b949525feb844529ae91
SHA512 92c5900acef4416760b7fd8a67992f05648776192156fe79142cec3d4fab62aceec63b440db49aa66c3ed9ea373a4fc51f266071ffa64cc8d2905e7b5f23654e
MD5 SHA1 SHA512

Submit Download

svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACCABAACAACABCBBABACCAAACBACBBBBCBBACBCCACAAABBCACCBC.exe
Size 9.2MB
SHA256 16add5baaddcc4e2ca3e08a64baf175ad4f1357e5d0a930608efb0460e577015
MD5 82517f3e4b770a2e082a4f7b16ca9d2e
SHA1 9eb0a572211badc6214282dd03b2a236681d00b7
SHA512 b6a6ec163e6e098e2087f27d5bebaf48f683db9dc91d0580fbf243599bc66ec2063b4c7dbe9155cd3632b31c38b70205285b5d8b1ddeac54233b0231c85a8ab7
SSDEEP 49152:U+EPiw21F+EPiw21WU+EPiw21F+EPiw21WU+EPiw21F+EPiw21WU+EPiw21F+EP+:U
TLSH
T19CA62A0677ED4854F4B3723489B68665DAB2BC619B31C6DF6280833D1E73BD0AD34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1752-79-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/3836-76-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/3836-52-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/3836-37-0x00000000002D0000-0x00000000002F1000-memory.dmp

Download

memory/4724-62-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4724-0-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4724-36-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4724-24-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4724-89-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4724-11-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download