a6b2b1ca1bef0f559c79f996a4fbc71efe4905c45e43315c57e319d6a024a25f

Analysis

max time kernel
151s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe
Size 90.0MB
Sample260816-sdxtvsdl5y
SHA256 a6b2b1ca1bef0f559c79f996a4fbc71efe4905c45e43315c57e319d6a024a25f
MD5 292f775f5394ff945631c3d238ca534a
SHA1 d1c26df9f2ad97bf6691da5c4e34315b21f61a67
SHA512 b3b1ebf3cf09f39493f4b0762247096da14b48d45b7f521df7aa36ca4374e384ecd3f4f1c6c57d5ee54163845c3e4ea737557734e3295e1587eeaeb1b96c3211
SSDEEP 49152:U+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+ES+ES+ES+EWLE+ES+EW5+Ez:u
TLSH
T1E8284B09F94340B1D92B50B04DCBD2BF8A70BA2587128EF7FA4DDB1B7933BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4948	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
1612	svchost_BBBBCCBCBCACACCBCBAACBBCCBBCBAABAAACBCCBAAAACCACBCBCBCB.exe
1828	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACABACCCACABAACBBBBBBBBBBCABAAABAAAAABBBCCCACBABCABABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe"	2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCAAACACABBABAACCCACCCCBABCABACABAACCCAABCBABABABAACAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBBCCBCBCACACCBCBAACBBCCBBCBAABAAACBCCBAAAACCACBCBCBCB.exe"	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4344	sc.exe
2732	sc.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1576	cmd.exe
6008	cmd.exe
5352	cmd.exe
1256	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBBCCBCBCACACCBCBAACBBCCBBCBAABAAACBCCBAAAACCACBCBCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6056	schtasks.exe
5644	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5116	2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe
5116	2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe
5116	2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe
5116	2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe
4948	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
4948	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
4948	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
4948	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
1612	svchost_BBBBCCBCBCACACCBCBAACBBCCBBCBAABAAACBCCBAAAACCACBCBCBCB.exe
1612	svchost_BBBBCCBCBCACACCBCBAACBBCCBBCBAABAAACBCCBAAAACCACBCBCBCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5116	2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4948	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
Token: SeDebugPrivilege	1612	svchost_BBBBCCBCBCACACCBCBAACBBCCBBCBAABAAACBCCBAAAACCACBCBCBCB.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 1576	5116	2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe	92
PID 1576 wrote to memory of 6056	1576	cmd.exe	94
PID 4948 wrote to memory of 988	4948	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe	95
PID 5116 wrote to memory of 6008	5116	2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe	98
PID 6008 wrote to memory of 4344	6008	cmd.exe	100
PID 5116 wrote to memory of 5352	5116	2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe	101
PID 5352 wrote to memory of 2732	5352	cmd.exe	103
PID 4948 wrote to memory of 1256	4948	svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe	105
PID 1256 wrote to memory of 5644	1256	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_292f775f5394ff945631c3d238ca534a_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBAABCBACBAABCCBCAAAAAACBCBCBAACCBCABACBBCCBCCCAABBBACCCCBCABBAACBCCBBBABABCAACAACBCBBABCABACCABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCBBAABCBACBAABCCBCAAAAAACBCBCBAACCBCABACBBCCBCCCAABBBACCCCBCABBAACBCCBBBABABCAACAACBCBBABCABACCABBABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCCAAABCBBBCCCBBACBBCAAACACABACBCACCCCBCBCABBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe" start= auto displayName= "UserDataSvc_CCBCCAAABCBBBCCCBBACBBCAAACACABACBCACCCCBCBCABBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCCAAABCBBBCCCBBACBBCAAACACABACBCACCCCBCBCABBBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe" start= auto displayName= "UserDataSvc_CCBCCAAABCBBBCCCBBACBBCAAACACABACBCACCCCBCBCABBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4344
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCCAAABCBBBCCCBBACBBCAAACACABACBCACCCCBCBCABBBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5352
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCCAAABCBBBCCCBBACBBCAAACACABACBCACCCCBCBCABBBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCACACABABBAAABCBACBBABBBBACBBCCBBCBACABCBCCBCBCBBACACACCAABCCBCCACBACCAABBCBACCABBCBBBCBBAACCBBABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCBCBCACACCBCBAACBBCCBBCBAABAAACBCCBAAAACCACBCBCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1256
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCCACACABABBAAABCBACBBABBBBACBBCCBBCBACABCBCCBCBCBBACACACCAABCCBCCACBACCAABBCBACCABBCBBBCBBAACCBBABCAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCBCBCACACCBCBAACBBCCBBCBAABAAACBCCBAAAACCACBCBCBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5644

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCBCBCACACCBCBAACBBCCBBCBAABAAACBCCBAAAACCACBCBCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBBCCBCBCACACCBCBAACBBCCBBCBAABAAACBCCBAAAACCACBCBCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBBBBBCBBACCCAABABBBABBBBBCBACBBACBCBBACBAABACCBCBCB.exe
1⤵
- Executes dropped EXE
PID:1828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 983eb3b70d8fd1b7622a158819fb0986e1bd8a2218a1837522b098e4d8946faa
MD5 084cd9fe7fd657b469397c5886ed477f
SHA1 2f8f8e0ccf21c95f2905e7c3fb35d6829fe5d98d
SHA512 0de4dd3d62711fbfcaa0cfabe4802f285571d9aff7f5777e841069cbca55c9365533ec8be1ac96796bf4c983d8dab6dc6d1784462c07938e8c2e2934edd1499c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 31c64efccf896f042d52d063cdadc1120a6a08ad23b695f8679bdfeb339cbed2
MD5 b4418aa7e96070df1f453b72dca4054b
SHA1 ed818966adac1e3e60794c84b67f7fdc3db527fa
SHA512 6d5e723abe05bc29bc68bac4904c828a7a199833551331e64ca2838bc1c0d9176fd958c4587fd79638fb80da28fe4860dd7468fd998b79fc60e7d61d05649e44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 df96e1e207539e40132d098d9d69c150e2c942f7f89443891f3dea8a08217072
MD5 347f2b5b0c1c0a3eec8a0f7d7e04e8dd
SHA1 bde120d063fee91336545e909cb65759596f6288
SHA512 11306503b430c90a2dcc331ee62613491f33dc58a96f55c36d11c6048b4b24764f5e3c5edb5cff7f90391ffcec64d9b9f07371fb8c09588bf453c3b482638e78
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 08ed12a883cd079118bdfc9f368741dc2e38fc4709e8d845f800ced06dd9a36c
MD5 f33e0436991dce9733efd36e11a77f95
SHA1 6c05242000714c75b20a5ed4d208f55b0191b62f
SHA512 c2c006c9ba567ec94f175d09bb73ca38aecee370106c6ddb42053cf981420a08448cbd2c0055c0f8a57c9c9ada56e8fe37c60cf8d98cf484c804dca169aebb10
TLSH
T198110A5079E6EC53F97368C7462D5EF30CD937AF18586A5523084119F25EC314E568F2
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 2030319c262ee4f3875fb54c90797b95e3c9d0ba53a0e3217ef4db347c909372
MD5 2cd685f5c2735fcadc6516570e1609e6
SHA1 fc0772dcec428df7120140fcbdf99b9ecdffe297
SHA512 9ae37d0920c587ab29c527314a7193398902aba1b5b06d83b344a5662e67a1e3334f7b986b41bf9180a55016a9bbb510e530578791958df86944711b2ed8031f
TLSH
T11111C310B5E6EC93E973A8CB962D9EE30CD937AF58585A51130C8219F39AC328D568F1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1612-77-0x0000000000B30000-0x0000000000B51000-memory.dmp

Download

memory/1828-79-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/4948-30-0x0000000000A20000-0x0000000000A41000-memory.dmp

Download

memory/5116-6-0x0000000000160000-0x0000000000181000-memory.dmp

Download