8a6480df7e5b3969366982112f7b54e7720b1c123626839ae421c2e35b4ce47b

Analysis

max time kernel
151s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 13:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe
Size 20.3MB
Sample260816-q979cscl91
SHA256 8a6480df7e5b3969366982112f7b54e7720b1c123626839ae421c2e35b4ce47b
MD5 7caf8b6aac0a1bd0b1eace47f2289a35
SHA1 8660a0d5dc40e29bc19b309977743bc6a4378b86
SHA512 acf365a914e711707fb39b154ce1b40dc2f1fa15fca8dab4b166863a9639911e2a83ca2f3d66a0ae4e10e7a28f39943f2accc519896c756b10a9819d2c1d116c
SSDEEP 98304:s7K7K7K7K7K7K7K777K7K7K7K7K7K7K7K79:P
TLSH
T1E0271909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3496	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
5192	svchost_BAABACBBACACCABAAACCBBCAACCACBAACBCACACBACCCBBCBAACBACA.exe
1820	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACBBABAABCCAACACABCBCBCBAAAABCAAABABBCCCCBAAACBBCACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe"	2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABCCCABCCABCBBBACBBACBBCBBABCBBCBACAAAAAABCBCCACBBABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAABACBBACACCABAAACCBBCAACCACBAACBCACACBACCCBBCBAACBACA.exe"	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6324	sc.exe
6672	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4868	cmd.exe
5220	cmd.exe
6756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAABACBBACACCABAAACCBBCAACCACBAACBCACACBACCCBBCBAACBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1800	2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe
1800	2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe
1800	2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe
1800	2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe
3496	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
3496	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
3496	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
3496	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
5192	svchost_BAABACBBACACCABAAACCBBCAACCACBAACBCACACBACCCBBCBAACBACA.exe
5192	svchost_BAABACBBACACCABAAACCBBCAACCACBAACBCACACBACCCBBCBAACBACA.exe
1820	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
1820	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1800	2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3496	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
Token: SeDebugPrivilege	5192	svchost_BAABACBBACACCABAAACCBBCAACCACBAACBCACACBACCCBBCBAACBACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1800 wrote to memory of 4868	1800	2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe	93
PID 4868 wrote to memory of 4964	4868	cmd.exe	95
PID 3496 wrote to memory of 4760	3496	svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe	96
PID 1800 wrote to memory of 5220	1800	2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe	99
PID 5220 wrote to memory of 6324	5220	cmd.exe	101
PID 1800 wrote to memory of 6756	1800	2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe	102
PID 6756 wrote to memory of 6672	6756	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_7caf8b6aac0a1bd0b1eace47f2289a35_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAAABAAACCCABBBCCBACAAAABACAACBCACBAABABAABBABABAACACCBBCBCACABCAAACBABCBBBCCCAAABCBCBCBCABACBCABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACAAABAAACCCABBBCCBACAAAABACAACBCACBAABABAABBABABAACACCBBCBCACABCAAACBABCBBBCCCAAABCBCBCBCABACBCABBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCBABACAACAABBCBCCAABAABCBCCACAAABBCAACACBCACCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe" start= auto displayName= "UserDataSvc_BAACCBABACAACAABBCBCCAABAABCBCCACAAABBCAACACBCACCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5220
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACCBABACAACAABBCBCCAABAABCBCCACAAABBCAACACBCACCBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe" start= auto displayName= "UserDataSvc_BAACCBABACAACAABBCBCCAABAABCBCCACAAABBCAACACBCACCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6324
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCBABACAACAABBCBCCAABAABCBCCACAAABBCAACACBCACCBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6756
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACCBABACAACAABBCBCCAABAABCBCCACAAABBCAACACBCACCBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6672

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACBBACACCABAAACCBBCAACCACBAACBCACACBACCCBBCBAACBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAABACBBACACCABAAACCBBCAACCACBAACBCACACBACCCBBCBAACBACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5192

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b1abf224afbc890851f0af2a3984a07ae9ce4cb445eac9ec2d48b344efc04b01
MD5 72aa0cf2ee050423f2ffcff96abf886f
SHA1 7564b3cbccbe251c3894928e0a06c0516ac8ad1d
SHA512 6da7099644c353bab7e164699cd4108153a1da94097ce484ea48c04bf78e28aed8892d643ca6145ffc1473d7b14287c4572b0fa67c1c371fe931ed7b0df0b1e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 41eefcfb63295716e2e3668e2a1f8e647278b6ef49673d8c6ead8267615232e6
MD5 08c9509354c42afa9372e99a77af4ccc
SHA1 8bd495988ae6726cf7c838ccd533e352b2cb41c8
SHA512 63b985a7097597f5bfb6ad68e8f327050b1f902e1a50ad3bb1def05f2ff6dcd23a3d1fb2526fdaeb1f38d7f3dfada87c974616874d29fd06c7aad99d58593589
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ebbd1fb453b217dad0f59e8c336c8e7a4601ed4a470a87e04b6e327df0646071
MD5 53ae9b19b78aaa6939a9c4e81468a2b1
SHA1 0d6fe3ceca5787c4e67abbb93fb879f58d9343a1
SHA512 c9370037fdc6c0e9ab5e99e05fd3ce02e38d86f50dd50d575eb6bb5d38ff799f35358bd266f56f582afcd4cd155d93671c787cfdd6104f3c403c8e564d7c4651
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cf4374e72390a321feb9e2162263bd16551f20c04a058a02e1dcddaecea84fc7
MD5 6597c0eb7366fb62f7ac90f3019dcbff
SHA1 aa2151a7d4847025b4bae9c65ba38838c81a3a6f
SHA512 22911ca8eaeca42c76bb1fe1146f04a1f5f825373c07cb6abfc32b3daaa133e0fb9f8601952542613ad579d80e9270fe8587dd5c385e620974f994fe094a1736
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a1094d1c5257e81cce1ffad03b5851b9c9e37bf1de538d0c2ba51bce2d4fd4fb
MD5 0e1aac25e5b122bf0c5540dfe65a2066
SHA1 871e96028286742ccf6cc7c3a109c2547f12a67b
SHA512 a01f66af2a3721ad3183ec061e61f7cf067ecbc72afd7f648ee2178d9868c7c01065da28c6e1bdc449ca2e26b035f96c0a9bf77ce79ec64a91072baaa03d649a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ddf2a8be6da54c9eed117e146307bad195e18679283f870ad15e254ad4b46ab7
MD5 6fb6cb1afaf0de528acdf45511e4e9b6
SHA1 711c8edd40f066d1b7d217480420e165fe2da424
SHA512 7299bda7172a2f9429cde2f3744a12d221cc9a0e8d6a5b641324a2b1c5f35c7887c012ee98fc1ca58fbe02091bbbb2d3882462b24b4b6c065e40f2f7072c5123
MD5 SHA1 SHA512

Submit Download

svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCCBCBBCBBAACBACBCACCCCCAABCAABCCCCBCAAACBACAABAABBAA.exe
Size 20.3MB
SHA256 8a6480df7e5b3969366982112f7b54e7720b1c123626839ae421c2e35b4ce47b
MD5 7caf8b6aac0a1bd0b1eace47f2289a35
SHA1 8660a0d5dc40e29bc19b309977743bc6a4378b86
SHA512 acf365a914e711707fb39b154ce1b40dc2f1fa15fca8dab4b166863a9639911e2a83ca2f3d66a0ae4e10e7a28f39943f2accc519896c756b10a9819d2c1d116c
SSDEEP 98304:s7K7K7K7K7K7K7K777K7K7K7K7K7K7K7K79:P
TLSH
T1E0271909F94344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75FA933BA16428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4570338119a89d133dca23100311262f2fa9e93e2b90c0802711a7ac5eae04b8
MD5 375086a748c823dcaf2030422e2b7147
SHA1 aaa672c8de2a2cf1b5163c261a627df18d8fac06
SHA512 a5e338d4c25186b3a4961b0a63a04437218cca04fbf6492726d41cf0c03f5558715c71fbcb2cdaf980073f1b70fcbd9266dad8c7a120ed97443978b1f3d5f3d0
TLSH
T137119493E4F5DC23FAB328CB9A2E9F430CE1379F985CAA14130C4219B7559355E554F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1800-8-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/1800-0-0x0000000000830000-0x0000000000851000-memory.dmp

Download

memory/3496-34-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/5192-81-0x0000000000170000-0x0000000000191000-memory.dmp

Download