22670a73a83e50d4af0ee13311637454ba9f293d4d96e8f0bf2c95419e150a37

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe
Size 17.8MB
Sample260816-lsv59avcpg
SHA256 22670a73a83e50d4af0ee13311637454ba9f293d4d96e8f0bf2c95419e150a37
MD5 d2847820b395f22c75a441482f8a0336
SHA1 6517f8f4f1f6c62e1af75de95a3d8b8c2171781b
SHA512 19264ce86f0935712d3f3413c38e7699ddede4813379eafffb80d1961e7515ade6573143a81af5f1699bb47bf673a4311d61c215c2fd0636aa416366230ee698
SSDEEP 98304:NKRuy5aHKRuy5aHKRuy5aHKRuy5aHKRuy5aHKRuy5aHKRuy5aHKRuy5aHKRuy5a6:Nq4q4q4q4q4q4q4q4q4qz
TLSH
T10E178E02F6C600B1E5B7357049ABE27A5979BA214731C9EFE348462E5D32FC09D3876B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4396	svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
988	svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
2284	svchost_CCCABCBABBBBBABCCACACCBBACBACCBCCBBACAAAAACBACCCBCCBBCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCACBCABACABAACCBCCCBBACCCBBBBACBABBABBBCACBAABCCBAABCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe"	2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCABBBCCCAABBABBACBAACCACABBBAACBCABBCACCBABBBABCACBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCABCBABBBBBABCCACACCBBACBACCBCCBBACAAAAACBACCCBCCBBCC.exe"	svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2588	sc.exe
5112	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4080	cmd.exe
1648	cmd.exe
1688	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2532	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4232	2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe
4232	2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe
4232	2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe
4232	2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe
4396	svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
4396	svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
4396	svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
4396	svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4396	svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2492	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 4080	4232	2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe	103
PID 4080 wrote to memory of 2532	4080	cmd.exe	105
PID 4232 wrote to memory of 1648	4232	2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe	109
PID 1648 wrote to memory of 2588	1648	cmd.exe	111
PID 4232 wrote to memory of 1688	4232	2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe	112
PID 1688 wrote to memory of 5112	1688	cmd.exe	114
PID 4396 wrote to memory of 3644	4396	svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe	116
PID 3644 wrote to memory of 4540	3644	notepad.exe	117

C:\Users\Admin\AppData\Local\Temp\2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_d2847820b395f22c75a441482f8a0336_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACABCCBBBCABCCCBCCBCAABCCBBBCABCCABBCACCABCABBBBABCCBAABCCAABBBCCACBCABCCCAABCCBAAABBCCCCBCCABCBCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBACABCCBBBCABCCCBCCBCAABCCBBBCABCCABBCACCABCABBBBABCCBAABCCAABBBCCACBCABCCCAABCCBAAABBCCCCBCCABCBCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2532
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCBBBABAABCBAABABCBBBBCBCCBBCBBBBBCBABBCCAABCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe" start= auto displayName= "UserDataSvc_CABCBBBABAABCBAABABCBBBBCBCCBBCBBBBBCBABBCCAABCACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCBBBABAABCBAABABCBBBBCBCCBBCBBBBBCBABBCCAABCACBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe" start= auto displayName= "UserDataSvc_CABCBBBABAABCBAABABCBBBBCBCCBBCBBBBBCBABBCCAABCACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2588
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCBBBABAABCBAABABCBBBBCBCCBBCBBBBBCBABBCCAABCACBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1688
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCBBBABAABCBAABABCBBBBCBCCBBCBBBBBCBABBCCAABCACBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3644
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
1⤵
- Executes dropped EXE
PID:988

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABBBBBABCCACACCBBACBACCBCCBBACAAAAACBACCCBCCBBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABBBBBABCCACACCBBACBACCBCCBBACAAAAACBACCCBCCBBCC.exe
1⤵
- Executes dropped EXE
PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 188d84adb222569946e840851647b79b865bdac508e466dfec88e3fd8d6e35c8
MD5 c5556c6249133bf75fcc2d5c43c32112
SHA1 14735eba0261962830aa2a279a28d85380531f2f
SHA512 01b805aca81a839640f73fe4039b8f9647bc6cab30225543a32fe5b85b2283432f3b8d72355da249d5db66bbfc83c7b50e7cc4bcbd6c4c0b11ae05b6c97dd7fa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5b0d30a0c64687c270f88f4bbca23abb14cc2b950b95abdd129f9eea7149348d
MD5 975efa7bfd8354493939a73c2e40a0a3
SHA1 0b34d8b59c922e985e78ee6d892ceaba70c8dc3b
SHA512 c6f625b9ac4c366feaac144a8d640cd8119051097e34c020c22718ba71ee85e92c557af87017be42de7a9fd831db2605135bb5cdc94d162575d9019cab1c76d4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9fe8618698e9164f7423a8fe13635e580744250102b1834ebfe2e6dcf7e512c8
MD5 7c7275fc1e6750ebdecd58653bafe8dd
SHA1 e9948cd4977c708b4205ffd52eee0d6d3e647da1
SHA512 5d19c8fb1cd091fe0d2ed3c345cc4c8a21e5570d4a0e3ad95b9d0fbe0d30911029a48c730a8d229e6e02a3344556db6f3cae2c4108ec14c388e2259159affc1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1258aa1aed13bcd163846416752067c0c6da200c66a73751952d24751aba21a2
MD5 bd4e359bfdbfe43e8bff304a88f336d6
SHA1 1e83339bba5158c2a6a6de8fd6fe24af688840bd
SHA512 fbf810c28cf809332eb18f34895066e0e9f9192888f7a307f2ac0d8a6dcb4b6ec2822170ff385fa6954425f35fc0b42fcd4bc9638d12cb9b3a153dfedc12cf2b
MD5 SHA1 SHA512

Submit Download

svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCCACBABBBCCBBBBCCCBABBBBBACBCCCCABABABACACABBCBBACA.exe
Size 17.8MB
SHA256 22670a73a83e50d4af0ee13311637454ba9f293d4d96e8f0bf2c95419e150a37
MD5 d2847820b395f22c75a441482f8a0336
SHA1 6517f8f4f1f6c62e1af75de95a3d8b8c2171781b
SHA512 19264ce86f0935712d3f3413c38e7699ddede4813379eafffb80d1961e7515ade6573143a81af5f1699bb47bf673a4311d61c215c2fd0636aa416366230ee698
SSDEEP 98304:NKRuy5aHKRuy5aHKRuy5aHKRuy5aHKRuy5aHKRuy5aHKRuy5aHKRuy5aHKRuy5a6:Nq4q4q4q4q4q4q4q4q4qz
TLSH
T10E178E02F6C600B1E5B7357049ABE27A5979BA214731C9EFE348462E5D32FC09D3876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CCCABCBABBBBBABCCACACCBBACBACCBCCBBACAAAAACBACCCBCCBBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCABCBABBBBBABCCACACCBBACBACCBCCBBACAAAAACBACCCBCCBBCC.exe
Size 4.3MB
SHA256 6d3e340ef09ad05088545f3633e61c14df709fb40b80b8d7e68cc2c599ee750a
MD5 bcff03b72526b87366cde63424b024c5
SHA1 97493b4e7503dc23954f764768743d9ebfee1817
SHA512 9f354ed951b43d23da7784e06ac50e5125f8cafda4b3be75f4c03edbb82df07d92725d466ca15700596c254822590099472bacc2b6669b3ea487cfd7ff2c98b0
SSDEEP 49152:U+ES+E9B+ES+E9B+Er+YLgVLKRWTQ6Zs5DhgPW+ES+E9B+ES+E9B+Er+YLgVLKR5:NKRuy5aHKRuy5aG
TLSH
T1D1268D02FAC600B5E5B7257049ABD27A9939BA214721CDEFE348872E5D32FC09D34767
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3644-68-0x0000000000F20000-0x0000000000F21000-memory.dmp

Download

memory/4232-0-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4232-7-0x0000000000950000-0x0000000000971000-memory.dmp

Download

memory/4396-27-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download

memory/4396-40-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download