61b7f32b51ae10afc25d3ebc67c142fbe0e80011a5f0bfa6eff78e78d3cbe9c5

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe
Size 20.8MB
Sample260816-rt4rnsdh82
SHA256 61b7f32b51ae10afc25d3ebc67c142fbe0e80011a5f0bfa6eff78e78d3cbe9c5
MD5 52de18b371814cac2b0a5b88462f4d12
SHA1 c8462ed2db565a466a7d7318e83fea233ab50e7e
SHA512 236893e2c8ec8d87b539a7e743ae707bff0be9c239fcb629f2290bbbcab339d6192e21875d3e21ee54420193fd327fde76e018b9448dff8feb5463cd99682141
SSDEEP 49152:U+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+ES+ES+EFiw2s+ES+ES+E7+ES+c:T
TLSH
T182274C09F98704B1D97B51B04CDBD3BF8A70BA2187228EEBE64DC71B6933BA16434715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4852	svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
4948	svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
5068	svchost_ABAACCAAACBCACCBBCCCCCABCCCABCBABCBCABABBABABBBACAABCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBABACCCBACBACCCBBBCBCBCAABABCCAACBCCCAABCCABABBACCCCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe"	2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACCCBCCCABAAABCBACBACCBACCBCBBABACBBABBCCCBAABCABBBCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAACCAAACBCACCBBCCCCCABCCCABCBABCBCABABBABABBBACAABCCB.exe"	svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3048	sc.exe
4668	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
752	cmd.exe
4536	cmd.exe
2556	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAACCAAACBCACCBBCCCCCABCCCABCBABCBCABABBABABBBACAABCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4232	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4508	2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe
4508	2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe
4508	2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe
4508	2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe
4852	svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
4852	svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
4852	svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
4852	svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4852	svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3800	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 752	4508	2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe	105
PID 752 wrote to memory of 4232	752	cmd.exe	107
PID 4508 wrote to memory of 4536	4508	2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe	115
PID 4536 wrote to memory of 3048	4536	cmd.exe	117
PID 4508 wrote to memory of 2556	4508	2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe	118
PID 2556 wrote to memory of 4668	2556	cmd.exe	120
PID 4852 wrote to memory of 3880	4852	svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe	122
PID 3880 wrote to memory of 3148	3880	notepad.exe	123

C:\Users\Admin\AppData\Local\Temp\2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_52de18b371814cac2b0a5b88462f4d12_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABABACAABBACCBBBBAAAAACBCCCACBACCACBABCABBCACABABAABAABAABCCBACCBBBCABBAAABBCAACCBABCBACCCABABCACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBABABACAABBACCBBBBAAAAACBCCCACBACCACBABCABBCACABABAABAABAABCCBACCBBBCABBAAABBCAACCBABCBACCCABABCACBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4232
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBABAACCCACCCACBCBBBBBBCCACCCCCAABCBCBBACCBAACCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe" start= auto displayName= "UserDataSvc_ACBABAACCCACCCACBCBBBBBBCCACCCCCAABCBCBBACCBAACCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBABAACCCACCCACBCBBBBBBCCACCCCCAABCBCBBACCBAACCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe" start= auto displayName= "UserDataSvc_ACBABAACCCACCCACBCBBBBBBCCACCCCCAABCBCBBACCBAACCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBABAACCCACCCACBCBBBBBBCCACCCCCAABCBCBBACCBAACCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBABAACCCACCCACBCBBBBBBCCACCCCCAABCBCBBACCBAACCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4668

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3148

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3800

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCAAACBCACCBBCCCCCABCCCABCBABCBCABABBABABBBACAABCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAACCAAACBCACCBBCCCCCABCCCABCBABCBCABABBABABBBACAABCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b5c436cf1516e0e40091d8980474f5c8d722801855ef6999936a8821a948e85
MD5 aca920c2858737616112cebf22c1ea11
SHA1 3d4332576b43865dc011a5133f1d2b7594d5fb35
SHA512 b8a1241ad3c603f52bcf5f91c9dd97d7c3ad214ba6ed52a54e5ee700cad6f529493679ef2615483a753c89011307cb0f3896a0ba19dd9902a206a3c5b8b6cc1e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be585fcf0ecf013bb84a2f496c2666e1ea9b15b46549191e8fdbde9551c7e707
MD5 ac1c9ffa9d0745ea9bea2eb8c993e372
SHA1 3e76af393ef5a3dbfb3af5e24ce23e648a6fe48f
SHA512 308a938fe386161ce697f7171a983e106ec40b2d181aae3abae9096ebaf3e18baf4ab7e359e64ddc40b6b256636db952e5b6d67e6c8193512ebfd0927caab28d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d843d20cc3243848ced1881caf38cd4a0d77657f6460faa4f624c279d540ff64
MD5 d88293f2c5363bdba9b06af5ed5ae69f
SHA1 b5a9fc2e4b69335094bd9c14d96dbf9b73fb8a66
SHA512 3e8c848c26ae0a04c29d1bb36ed985006be4b927168274525c2b357b6ff6b13482f1a4c82f6aac54dd059a32e7ddea0e57eed752a2ba5118274851264d9ca19a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3433b7878186e422898557054b914cdede453c7f2cdb5b3a0c932e2cb603ef6d
MD5 509bfdec7a9188983881c7d916ce171a
SHA1 8361de7c2d5a899688957bad56e91630318c30f8
SHA512 31ae19d28a560ebb7b974d261d8e80ea4d347b117727d00af8fe10cd9406b43bbe7233a913709e4194abf1a994bdec6ecf60462e30d6280640f0dd3af25e3ae8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 918afde1dfc451cca59641735e59636e1fe1394414ecd43d1f09bf5edaff0455
MD5 a11fb9a4bc9456bd8f60c12bea68f611
SHA1 d8b4f24c322c03268292487e5199bf9eb47ac8cb
SHA512 b450f58a81cc59fa1f4fd08c52456ebb9c5ecf18e8d1213d03138a9e8b99c570218d51bb0395096843cbf856440e9d71a078275d3cc6eb369f834547afdc826a
MD5 SHA1 SHA512

Submit Download

svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACACABCBACCAAACBCABABACCCAACAABCCCCABCAABBCBBBCAABBB.exe
Size 20.8MB
SHA256 61b7f32b51ae10afc25d3ebc67c142fbe0e80011a5f0bfa6eff78e78d3cbe9c5
MD5 52de18b371814cac2b0a5b88462f4d12
SHA1 c8462ed2db565a466a7d7318e83fea233ab50e7e
SHA512 236893e2c8ec8d87b539a7e743ae707bff0be9c239fcb629f2290bbbcab339d6192e21875d3e21ee54420193fd327fde76e018b9448dff8feb5463cd99682141
SSDEEP 49152:U+ES+ES+E7+ES+ES+ES+E8+ES+ES+ES+E7+ES+ES+ES+EFiw2s+ES+ES+E7+ES+c:T
TLSH
T182274C09F98704B1D97B51B04CDBD3BF8A70BA2187228EEBE64DC71B6933BA16434715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3880-88-0x0000000002680000-0x0000000002681000-memory.dmp

Download

memory/4508-62-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4508-10-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4508-36-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4508-87-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4508-23-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4852-53-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/4852-76-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/4852-35-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/4852-104-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/4948-95-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/5068-102-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download