5e46f155dc6d36ea294fb0af09c8b218f260b11e29807046e83dfcdb938925c4

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe
Size 8.5MB
Sample260815-b8brfadk21
SHA256 5e46f155dc6d36ea294fb0af09c8b218f260b11e29807046e83dfcdb938925c4
MD5 1c67318a09d6a167656f83335fe5c086
SHA1 c25341743d4b9a6a8baadbb5205e5854b2c68efd
SHA512 24643c9873c804ec3f35171914d5b94d2b583decfa288646068a263423a2cfcc884f5cfa3f1fdbf3a965019ac38715f1900e7229a6ac1c9668ec90a534a00469
SSDEEP 49152:U+ES+ES+EvVRXpH+ES+ES+EvVRXpH+ES+ES+EvVRXpH+ES+ES+EvVRXpH+ES+ESZ:mXXXXXXXH
TLSH
T10A963A02B68144B1E462057049A7927E4726BC21CB238FDBA6946EEEFFF2BC15D34771
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
656	svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
1420	svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
3364	svchost_BBACAACCBBCCCBAABACCBBACCAAACBABBABBACACCBABBACACACAABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCBAACAACACBCBABBCBBAACBABAACBBBBCBCABBCCBAACCCCACBCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe"	2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACCAACACABACCCAABCAABBACACBBBCCBCACABABAABCCCACCBACAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACAACCBBCCCBAABACCBBACCAAACBABBABBACACCBABBACACACAABC.exe"	svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4408	sc.exe
2244	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3992	cmd.exe
2200	cmd.exe
4784	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACAACCBBCCCBAABACCBBACCAAACBABBABBACACCBABBACACACAABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4772	2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe
4772	2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe
4772	2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe
4772	2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe
656	svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
656	svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
656	svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
656	svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
3364	svchost_BBACAACCBBCCCBAABACCBBACCAAACBABBABBACACCBABBACACACAABC.exe
3364	svchost_BBACAACCBBCCCBAABACCBBACCAAACBABBABBACACCBABBACACACAABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4772	2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe
Token: SeDebugPrivilege	656	svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
Token: SeDebugPrivilege	3364	svchost_BBACAACCBBCCCBAABACCBBACCAAACBABBABBACACCBABBACACACAABC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1700	OpenWith.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 3992	4772	2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe	101
PID 3992 wrote to memory of 3664	3992	cmd.exe	103
PID 4772 wrote to memory of 2200	4772	2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe	106
PID 4772 wrote to memory of 4784	4772	2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe	109
PID 4784 wrote to memory of 2244	4784	cmd.exe	111
PID 656 wrote to memory of 2300	656	svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe	113
PID 2300 wrote to memory of 4840	2300	notepad.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_1c67318a09d6a167656f83335fe5c086_amadey_elex_icedid_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABAACBBCCAAABACCACCBBCABBCACBBBBCCCBACCCABBBBCCABABBCCABCCCBAABBBABBAABAAACBBAABACCCBBCCCBCBABCACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3992
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBABAACBBCCAAABACCACCBBCABBCACBBBBCCCBACCCABBBBCCABABBCCABCCCBAABBBABBAABAAACBBAABACCCBBCCCBCBABCACBAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCACACCABCABAABCACAACCBABCACCBBBACCCCABBCACBCCBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe" start= auto displayName= "UserDataSvc_CCACACCABCABAABCACAACCBABCACCBBBACCCCABBCACBCCBBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:2200
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCACACCABCABAABCACAACCBABCACCBBBACCCCABBCACBCCBBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe" start= auto displayName= "UserDataSvc_CCACACCABCABAABCACAACCBABCACCBBBACCCCABBCACBCCBBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4408
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCACACCABCABAABCACAACCBABCACCBBBACCCCABBCACBCCBBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCACACCABCABAABCACAACCBABCACCBBBACCCCABBCACBCCBBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2244

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:656
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2300
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4840

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
1⤵
- Executes dropped EXE
PID:1420

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAACCBBCCCBAABACCBBACCAAACBABBABBACACCBABBACACACAABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACAACCBBCCCBAABACCBBACCAAACBABBABBACACCBABBACACACAABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3eeea98c31e38256bc8b9d517c55fc2d847eac2a19029c455172280b64bf5480
MD5 080643705cd63ccc5d1fe57803ae13ff
SHA1 efc31fdc0c8f5fcd3edf0fa0ab1458fc4f79909e
SHA512 468e60b7579677a8e7bab058b21244356c31e0c1183a2c468fe8a3f19ac3d1460a5c937e1e5004dce7fc49de1a11ccc27b3aa25f64b1202e1e2240d20dbb5053
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bcfa108ae90515602358330f4bfa69cba77c02b56cb3b55539d0ff53db8e98e5
MD5 23d4e58a6a95706d77783eb325ade8bd
SHA1 18c2a58ea57325a5c77af674fbb1223c1200d6ee
SHA512 771a9c439f108b3a941f1780107912542deb4f4ba87f10cd2728282a6150ece5a33e22990220528d1e5dd3fefdfac33e291a7ccb66c67f6d3d78b00ee54c0a11
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c5350cde0444e310c8b4f8a8f1146e755401255123f1b8103b9698cd021695e0
MD5 0cedf36e2cf6017e2da7ff424911e0c2
SHA1 5cf79a990d8851898c6f9e5e915f62e9a403ab9e
SHA512 556ed87833dad51bb78f4d420ad007a84f2c0bdd5af8d026bb4231d6a8e79b5654d5b7fc9ebc10b36baa692aa686d241fd882fa2b50bcf844788656390be85d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ff0201de1fdedf49bf70153cb688acc30f034557963c400f0e5702bc770ea9b8
MD5 9b3129951b54dd737ca95c43a296610a
SHA1 2ce94d1f3b0347bc8328e4d2a572e02c63b437e7
SHA512 e22966fd32b333432481c8fb9573fb9e7b53e4e636248def32faf71cc2743a49f63e0efb083be41b610a95040426c4d6d12f2b9d3388782641f33c243698739b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bd0a26775e661b2d53a5bb88b8f0ab6160c5fb7b81fc3fdcf5f6d372ce41ef3a
MD5 52490d73bcbfaad695834f7fa3625e07
SHA1 ca3ab23cdc674e5f81b037af90067589e6489e4b
SHA512 96209028862f23297f34766109a24a2216cf8fa31c4ba96ce33b161b6c364bb2b49359089114b91e23ec06ea9cf278de3c4877984bc0e4cee35835ea3ff22d1a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d4f6c9403319bcf372b7ed79560d8f51b97658023fa318b48bf56f0321f5f0f1
MD5 4a2ca3343b278fd0e1628b0d27e34f9d
SHA1 901a832c56beab9391d6e2895bec44f2a762f325
SHA512 3c159b5e0b5937d2e94e0392fd4b825fee0df6398a457bf9ba1a7f3ba251dcd4a9f9f4658ce9da495e045af3e16ab59531b5afc3295e44f7760e5ae7ea7bb1d5
MD5 SHA1 SHA512

Submit Download

svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCBBCCBCCBBBCACCBAACCACAABAABACBBABACCCCBCCACACBACBB.exe
Size 8.5MB
SHA256 5e46f155dc6d36ea294fb0af09c8b218f260b11e29807046e83dfcdb938925c4
MD5 1c67318a09d6a167656f83335fe5c086
SHA1 c25341743d4b9a6a8baadbb5205e5854b2c68efd
SHA512 24643c9873c804ec3f35171914d5b94d2b583decfa288646068a263423a2cfcc884f5cfa3f1fdbf3a965019ac38715f1900e7229a6ac1c9668ec90a534a00469
SSDEEP 49152:U+ES+ES+EvVRXpH+ES+ES+EvVRXpH+ES+ES+EvVRXpH+ES+ES+EvVRXpH+ES+ESZ:mXXXXXXXH
TLSH
T10A963A02B68144B1E462057049A7927E4726BC21CB238FDBA6946EEEFFF2BC15D34771
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 5876941546f8345cb82a74a546d5fa9e8b929c5a7906823e1342dfdff261f225
MD5 ec53d825c0cfe8b6062300f226e81d48
SHA1 950e933de187189bf0ab7b9559c06e3465c3c1d2
SHA512 3f73c40cf4b7fbb4dc628ee23fde9c84d4964e87d177cebfce8566e95e055a7f99c4da442ea7de9ed3b3089ef65174f597393f8a638d94c2ab504365700f48c8
TLSH
T19F01D652D4E6E857F93229EFDA394F424CE47A8F689CAF04234D43196B11C369E154D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/656-38-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/656-25-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/1420-74-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2300-67-0x00000000023D0000-0x00000000023D1000-memory.dmp

Download

memory/3364-91-0x0000000000F70000-0x0000000000F91000-memory.dmp

Download

memory/4772-6-0x0000000000780000-0x00000000007A1000-memory.dmp

Download