a126e9990a6df168944e2e6453a7999d927b0d8223e12698ecc1c5e79f34b8aa

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 03:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe
Size 8.3MB
Sample260816-eekzsscn61
SHA256 a126e9990a6df168944e2e6453a7999d927b0d8223e12698ecc1c5e79f34b8aa
MD5 b4bcad6c3ab9612fbc1301c969bc72f4
SHA1 74c5248dfcaeecc15b8ca5674ed918bd6cb6dba6
SHA512 5d53f05c581cfb9dc3a0ffaec34a80e14d17e090b5c643a1978faf15312edf936960a8e855341d553485fd851ea0ab344533761e271cd95e0a010f05fcf7c04a
SSDEEP 49152:U+ES+ES+E2+ES+ES+Etiw26+EfU+ES+ES+E2+ES+ES+Etiw26+EfU+ES+ES+E2+R:C
TLSH
T179963B09FADA0461E87761704DEBC27E8671B9218732CAEFE649C72E5D33BD09834716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2780	svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
3764	svchost_AABAABBBAAAAACBCACBACCBACACBABCCCBABCACABABCCCAAABBBCAC.exe
1912	svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBCBBAACABAABCACBBBBBBCBBCCCCABBBBCCABBCCBABCCBCCCBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe"	2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACAAABBCCCAACABCBABBBAAACCBACCCCBCCCABABBCCCABACBCBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABAABBBAAAAACBCACBACCBACACBABCCCBABCACABABCCCAAABBBCAC.exe"	svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4588	sc.exe
2876	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4932	cmd.exe
5588	cmd.exe
5996	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABAABBBAAAAACBCACBACCBACACBABCCCBABCACABABCCCAAABBBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5692	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5180	2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe
5180	2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe
5180	2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe
5180	2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe
2780	svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
2780	svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
2780	svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
2780	svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
3764	svchost_AABAABBBAAAAACBCACBACCBACACBABCCCBABCACABABCCCAAABBBCAC.exe
3764	svchost_AABAABBBAAAAACBCACBACCBACACBABCCCBABCACABABCCCAAABBBCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5180	2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2780	svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
Token: SeDebugPrivilege	3764	svchost_AABAABBBAAAAACBCACBACCBACACBABCCCBABCACABABCCCAAABBBCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5180 wrote to memory of 5588	5180	2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe	92
PID 5588 wrote to memory of 5692	5588	cmd.exe	94
PID 2780 wrote to memory of 1192	2780	svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe	95
PID 5180 wrote to memory of 5996	5180	2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe	98
PID 5996 wrote to memory of 4588	5996	cmd.exe	100
PID 5180 wrote to memory of 4932	5180	2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe	101
PID 4932 wrote to memory of 2876	4932	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_b4bcad6c3ab9612fbc1301c969bc72f4_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCCBCBBCAABBCCCCABCCCCCBBCAAACBBAACBBABCAABAACCCCAABCCAABBBACBCBACBCCACBCCCABCCCABBAACCABBCBCACBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCCBCBBCAABBCCCCABCCCCCBBCAAACBBAACBBABCAABAACCCCAABCCAABBBACBCBACBCCACBCCCABCCCABBAACCABBCBCACBCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5692
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCCBCABAABABBBBAABCBBBCCCBCACABACBBCBABBBCCAABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe" start= auto displayName= "UserDataSvc_ACBCCBCABAABABBBBAABCBBBCCCBCACABACBBCBABBBCCAABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5996
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCCBCABAABABBBBAABCBBBCCCBCACABACBBCBABBBCCAABBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe" start= auto displayName= "UserDataSvc_ACBCCBCABAABABBBBAABCBBBCCCBCACABACBBCBABBBCCAABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCCBCABAABABBBBAABCBBBCCCBCACABACBBCBABBBCCAABBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4932
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCCBCABAABABBBBAABCBBBCCCBCACABACBBCBABBBCCAABBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBBAAAAACBCACBACCBACACBABCCCBABCACABABCCCAAABBBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABAABBBAAAAACBCACBACCBACACBABCCCBABCACABABCCCAAABBBCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
1⤵
- Executes dropped EXE
PID:1912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9277b4c71679f89c2113ce254540dc73034bc8e478dc0fb6c63007c0bcb3d125
MD5 3848d7561d1909bd97b3f40ca7d2bdfb
SHA1 2f49437d09ffbbfaf9f5c60f98a57a5ee8731059
SHA512 0b77800bc76b69918de974aac2410d434fbf0d80f7f59150c982484b30266ebdbe2954864033a1101da79b3ded24836f1371241156c40a32e150159eded0b9cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 78dd9cb38922c1780d1f64487492f429fc953f0e5045c90b8a6bef865b14ebde
MD5 2b403fa0e25b8ee3aef87d1df5d41f90
SHA1 ea89762614e673df0b6cdd6fa693ccc9380c61a2
SHA512 e1330463674fcfac7f666d35fec396a555af56139c2c07707c96bc893dd4e60813cbf698ce423f231140a330c77b3eec7ea8444e8a3b82036b343dac48ce7635
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 557d6f5c1a19ff1c1ab3aacc2ab0e032dd8090eebb7ff7c1778ca2279c2dd428
MD5 b738cf74d55f01628a04d309d049ad2c
SHA1 a3388624fd5cd652c015340a330701c39d03494d
SHA512 00e24465fcd6e72827fa0377f5078377cece54f0381e24586d4cc126380c242242e817c4e987410b08415d2b285b377bcfdbf5c4576ce8539add3e12717f9d17
MD5 SHA1 SHA512

Submit Download

svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACBCBABABCABBCAACCCBBACBACCAACAAAABBBBACCBAABACBBBCC.exe
Size 8.3MB
SHA256 a126e9990a6df168944e2e6453a7999d927b0d8223e12698ecc1c5e79f34b8aa
MD5 b4bcad6c3ab9612fbc1301c969bc72f4
SHA1 74c5248dfcaeecc15b8ca5674ed918bd6cb6dba6
SHA512 5d53f05c581cfb9dc3a0ffaec34a80e14d17e090b5c643a1978faf15312edf936960a8e855341d553485fd851ea0ab344533761e271cd95e0a010f05fcf7c04a
SSDEEP 49152:U+ES+ES+E2+ES+ES+Etiw26+EfU+ES+ES+E2+ES+ES+Etiw26+EfU+ES+ES+E2+R:C
TLSH
T179963B09FADA0461E87761704DEBC27E8671B9218732CAEFE649C72E5D33BD09834716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 81c5a14baed7c0a184abb12d23171044a6087da8544493acaceba82d46d66d89
MD5 fba5227c47f2a8a61c1f2a43b32bcb88
SHA1 4e21e8b0b9ce96c888d2a19bc949b4fbb348ac01
SHA512 8d185c3463ccd3a7928a1e246ea6e4203c110adc05488b9d34e349cda8f5de087394cfc62d7349c8ed16a34bf63196e11b161970948bb6475a8a91efdd7e0f18
TLSH
T18911EB6195F598A3EC2324CF552EAE120C95375B98A8AA2413C9421CF6A5C36CE194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2780-32-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download

memory/3764-79-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/5180-0-0x0000000000150000-0x0000000000171000-memory.dmp

Download

memory/5180-8-0x0000000000150000-0x0000000000171000-memory.dmp

Download