a4e0b1acebf82fe109bf1acc34c044d6f8437b331528a227dab60c0272aeb10d

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 01:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe
Size 268KB
Sample260815-b4477axtdx
SHA256 a4e0b1acebf82fe109bf1acc34c044d6f8437b331528a227dab60c0272aeb10d
MD5 29f3c437bb74ae7f9c663812af14788c
SHA1 3255afb9c241f2d012a6df821df8e57a56908768
SHA512 8b7285d1db13a38050cb16362f458702153c1e21ab1768349f5f173921a14a1e16c50a38e94eb8740cfe6f07f24fc95468fe42faa545123eaad81ffb40ef786d
SSDEEP 6144:m+dTTUFgEs3XojAu+dTTUFgEs3XojAbDmPWmhEwmxu8aK9GO:mgUFgEsnojAugUFgEsnojA3mPWmCbxus
TLSH
T1A9445D1AFA4240F1D52B91B049CBD3BFCB71B62546128FABE71EC74B6E337A15C28245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2588	svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
3396	svchost_CCBCABACBBBAACBAACABACCBCBCBBABBCBCCACBCBBCACCACACAABBC.exe
2412	svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCACCCBCCBACBAAAABCABBCCBACCACBAAAABCCACACACCAACCCBBACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe"	2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAACAAABABCBACAACACCBBABACCABBCCBBCBCCABBAACABBBBCCAABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCABACBBBAACBAACABACCBCBCBBABBCBCCACBCBBCACCACACAABBC.exe"	svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1464	sc.exe
2360	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
464	cmd.exe
5556	cmd.exe
4304	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCABACBBBAACBAACABACCBCBCBBABBCBCCACBCBBCACCACACAABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5208	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2652	2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe
2652	2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe
2652	2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe
2652	2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe
2588	svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
2588	svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
2588	svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
2588	svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
3396	svchost_CCBCABACBBBAACBAACABACCBCBCBBABBCBCCACBCBBCACCACACAABBC.exe
3396	svchost_CCBCABACBBBAACBAACABACCBCBCBBABBCBCCACBCBBCACCACACAABBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2652	2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2588	svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
Token: SeDebugPrivilege	3396	svchost_CCBCABACBBBAACBAACABACCBCBCBBABBCBCCACBCBBCACCACACAABBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 4304	2652	2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe	92
PID 4304 wrote to memory of 5208	4304	cmd.exe	94
PID 2588 wrote to memory of 2284	2588	svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe	95
PID 2652 wrote to memory of 464	2652	2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe	98
PID 464 wrote to memory of 1464	464	cmd.exe	100
PID 2652 wrote to memory of 5556	2652	2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe	101
PID 5556 wrote to memory of 2360	5556	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_29f3c437bb74ae7f9c663812af14788c_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABACBAAABCCABACBCBBABCCBCAACAACAABBABCABCBBBAAACABABCCCCACBBAAACACAAAABBAABABBCAAACBCAAACBCABBCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACABACBAAABCCABACBCBBABCCBCAACAACAABBABCABCBBBAAACABABCCCCACBBAAACACAAAABBAABABBCAAACBCAAACBCABBCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5208
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBBAABBBACACBBCABACCCAACCCBABCCBBCABAAACCBBABBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe" start= auto displayName= "UserDataSvc_ACBBAABBBACACBBCABACCCAACCCBABCCBBCABAAACCBBABBBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBBAABBBACACBBCABACCCAACCCBABCCBBCABAAACCBBABBBCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe" start= auto displayName= "UserDataSvc_ACBBAABBBACACBBCABACCCAACCCBABCCBBCABAAACCBBABBBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBBAABBBACACBBCABACCCAACCCBABCCBBCABAAACCBBABBBCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5556
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBBAABBBACACBBCABACCCAACCCBABCCBBCABAAACCBBABBBCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2284

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABACBBBAACBAACABACCBCBCBBABBCBCCACBCBBCACCACACAABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCABACBBBAACBAACABACCBCBCBBABBCBCCACBCBBCACCACACAABBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
1⤵
- Executes dropped EXE
PID:2412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c916ccf8eb107e60dd5c210312762ce76ee7e1a7784ffd5f3f2be69ae33fa2f3
MD5 a33a0436afa8e5501f7c5deb64e3a404
SHA1 ecb434987c0e931765f3fc769cec01696afd008d
SHA512 b2fd5afd506aa0d313b7f16ff1eebe9a8a571e92473448da24ce9cdbf4c7a8c924b6a2054eaf0ca42d53fa0b3a1b409bb4625e61874c962daf449d36829ba1bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e7231da9fcd0b18346f21ed53eac93d0d0cb31f844317f98246f8afc14d4f07e
MD5 5615898592a34ea700b270f2b94e39a5
SHA1 3115372b9a96296d863cf0316a30cf5661de4211
SHA512 c9f75aa7c73a84b8e39f5167683650b3025078b4051c77e51bff9ba13a2172d89882509ca806ad56b6dd838193ae2f66931b3fc5b8e99e52b3e11afc83e9d61b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 407db91b42e885f7fc9759f3094c50fb6710133bbc8e92c994977e0f91b379c5
MD5 c43bf31526f29491a14668d7348f0423
SHA1 5746277a94925482a1dcb0e50fcf1a9fb0c7444e
SHA512 dd2c3b718e8b636f25ce7993f5906e86dce125714a2a91045c076f6222c33e593569d1817a0cb0879164deb42582a14f54c30fb7002772c25a9981c3ac78c640
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f37763f3befa1f9a0ab944c535607502b6e15b04327559f8b42495586b4d20f1
MD5 0be997ee13ddfdec3672671d43fa9465
SHA1 b3dc9f992aa07f9dcce3849d5c542db40c168a45
SHA512 2fb0954de27aabd0862407135de6168afc472359d051925aff49f707bd6bdae835fca9f4e2def18979f710a4fc9900ca4a27895b7d703b90dc0c5c2eb8646998
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 400afd3d9ddbe7a8de3b5e009a5700ae993f11be32304e64e5ad9ec2296a1cd4
MD5 8dcdeca4c546e7529862b5c5d42eb3db
SHA1 5bee6423266eb8f5f89eba5bdd66cb95f74d8120
SHA512 8dd9b5ff332d9ca5ca1b2e307d8de68daa491cfed9791b612882ad73c0f303c58e556b5a173e39a59c649d3081c15c5ff07910b9b7eb02687e9c9e8423c29759
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ba07e1158969f9f04836e8ab2d1b5fb1ab66c9a7a3f992697ce3005eff70b843
MD5 163e20cc23e34c3d0e774dfb0362260f
SHA1 5c924aa845b93f3dd13f1cb3bfefbdfc996404c5
SHA512 388d2d71f6734cce15c8aa1d5c8e40902f3d2a74cbd24a647dfe1a804a8b9a293c363861e7694fca2e3805d8f0a151a93253d4a025b0e446ab1a99d39a0d5123
MD5 SHA1 SHA512

Submit Download

svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBCCBCBAABAAABABBCCABCCAABABCABCABCBCBBBCCBAACABACBCACA.exe
Size 268KB
SHA256 a4e0b1acebf82fe109bf1acc34c044d6f8437b331528a227dab60c0272aeb10d
MD5 29f3c437bb74ae7f9c663812af14788c
SHA1 3255afb9c241f2d012a6df821df8e57a56908768
SHA512 8b7285d1db13a38050cb16362f458702153c1e21ab1768349f5f173921a14a1e16c50a38e94eb8740cfe6f07f24fc95468fe42faa545123eaad81ffb40ef786d
SSDEEP 6144:m+dTTUFgEs3XojAu+dTTUFgEs3XojAbDmPWmhEwmxu8aK9GO:mgUFgEsnojAugUFgEsnojA3mPWmCbxus
TLSH
T1A9445D1AFA4240F1D52B91B049CBD3BFCB71B62546128FABE71EC74B6E337A15C28245
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 c0d9a9818565d7dd23cdcc06533b73a2b5419e389e18c69bbe1c5daf7b3a7865
MD5 1a3102a8832a2ab085e9c1b97fd00e0d
SHA1 f5e5ab204f70e96acfb486e8eabf68090a1528e1
SHA512 102bf9d9b0c76d7488eec9c8ed407814beb16867e6ccde5463d634505cc425b1e17574a9edc88516ed05764e80f8a2daf1368751053811777e3910aad634cf21
TLSH
T162119E51A4E5DC53F83264DB9E19DBD69CF83BAFA85C6E14230C4218B7ADC31CE154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2412-81-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2588-33-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2588-23-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/2652-7-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/2652-0-0x0000000000730000-0x0000000000751000-memory.dmp

Download

memory/3396-70-0x0000000000610000-0x0000000000631000-memory.dmp

Download