c76c67f15d690fb8ce96df09feac6647927ff1293eaee3a0bc912ad941190268

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe
Size 6.6MB
Sample260817-3rgpxaec64
SHA256 c76c67f15d690fb8ce96df09feac6647927ff1293eaee3a0bc912ad941190268
MD5 ed3077a657fccdc38704210d1c407d10
SHA1 b11a8aa595e4281ed25d4eaba161d66f9f31edb7
SHA512 2db3a45e7c90120f70c2307ce184c6774bfd971fa061c53565173524f0f45ffc8808355eb486cb2814bb3ac8ce80e1959782ea6d166c4e458b53cd84680104dc
SSDEEP 49152:U+ES+EWwy6i1zuajsaH+ES+EWwy6i1zuajsaH+ES+EWwy6i1zuajsaH+ES+EWwyD:BNNNNNNNNNW
TLSH
T1DB667D1EB29800F6C82F9074C747867BE670B43523216ADBB754C67E6B67AE1643EF04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4976	svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe
3420	svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACAAACCBCBCABBCAAAAABAAAACBBABBAAAACBCCABBCBCBBAABABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe"	2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCBAABCBBACCABCBCCCCCCACBBAAACABACBBACCBCBCABCBBCBBBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCBBCCBBAABACBBCACCBABACAACCBAAAACCCCABCBBCCACBCCACCA.exe"	svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1508	sc.exe
3184	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3144	cmd.exe
2560	cmd.exe
4332	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4800	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1416	2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe
1416	2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe
1416	2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe
1416	2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe
4976	svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe
4976	svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe
4976	svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe
4976	svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1416	2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4976	svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 3144	1416	2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe	92
PID 3144 wrote to memory of 4800	3144	cmd.exe	94
PID 4976 wrote to memory of 2144	4976	svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe	95
PID 1416 wrote to memory of 2560	1416	2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe	96
PID 2560 wrote to memory of 1508	2560	cmd.exe	98
PID 1416 wrote to memory of 4332	1416	2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe	99
PID 4332 wrote to memory of 3184	4332	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_ed3077a657fccdc38704210d1c407d10_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAABCBCAACBBCCBCBBABBBBAABAABCABABABBAAACABCBCCCCCBACABACCAABCCCCBCCBCBABACCCBAABAABACACACABACBBBABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3144
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAAAABCBCAACBBCCBCBBABBBBAABAABCABABABBAAACABCBCCCCCBACABACCAABCCCCBCCBCBABACCCBAABAABACACACABACBBBABCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4800
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBACABABCAABCABABBBCACCAABCACBBCBBACCBBAACCABCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe" start= auto displayName= "UserDataSvc_ABCBACABABCAABCABABBBCACCAABCACBBCBBACCBBAACCABCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2560
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBACABABCAABCABABBBCACCAABCACBBCBBACCBBAACCABCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe" start= auto displayName= "UserDataSvc_ABCBACABABCAABCABABBBCACCAABCACBBCBBACCBBAACCABCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBACABABCAABCABABBBCACCAABCACBBCBBACCBBAACCABCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4332
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBACABABCAABCABABBBCACCAABCACBBCBBACCBBAACCABCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4976
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2144

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe
1⤵
- Executes dropped EXE
PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1fcca61d0546ad08297898bfd6a9b4e3b4dd3b972de0956d2d7a4a5013bd129b
MD5 7b4bd978a055189e29e33f14028cedb4
SHA1 3b8e3e64c0fd087f9cfeabb4637ac3450d96dfce
SHA512 0e20e59864542feb414d58c6caaf87781eebdec6c71c9415a5e86ccac3123675e71b462d42c039231ce2544dad1672ad775a0add7e0178c19b5fcbcebb2d727f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c6cc67878cacbde9ca211432fc32c6a07665902c704b9b23f024c89d0219db32
MD5 15ea89192ab615a2ab1b9d7a62144b02
SHA1 adf253c53bc8c1dbc6651b09c37533f676a18ac0
SHA512 55678803542fde1662179814f01a5aadca571166ef6a2726273424978d13d2661139ab126f18979f0b5f78bec9de2974a458065a7f1273ca1c24c569e23b033f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c4bbfece25df3cd4a2972053265d47129d958742b487d4f2445c69e405be1de
MD5 e676d789bd85390254c1efea6720cdbb
SHA1 f915991636bf0e77eef6adabd8b5ec4f12e7c478
SHA512 b109f09d389d7056cab6af597b4c97cb8a9feb55248be86d09ba4eae8b789d54c20052b83ffb9f850b29235e304ae960483ff3938d2c198ba49302a44c468546
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 265fadf6507ce37336f234a5a74d48bae912790261cca8cb20afd10198e4d2d2
MD5 94a5c3de0727bc960934ee237593cac3
SHA1 7bbd094826f666d06bd0fce3737d087c5d2cf6f4
SHA512 02082c64bafcdc64bcb2512d9d0a85d88005a9eae1c8743502523473ee96baebf0d13cebbc09a0237fc8e52a4dc83f654a60433245d23ca877016fa1ac7b25b6
MD5 SHA1 SHA512

Submit Download

svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCCAABBCABCCCACBCBCCACBBAACBCACBAABCBBCABACBACBACACCC.exe
Size 6.6MB
SHA256 c76c67f15d690fb8ce96df09feac6647927ff1293eaee3a0bc912ad941190268
MD5 ed3077a657fccdc38704210d1c407d10
SHA1 b11a8aa595e4281ed25d4eaba161d66f9f31edb7
SHA512 2db3a45e7c90120f70c2307ce184c6774bfd971fa061c53565173524f0f45ffc8808355eb486cb2814bb3ac8ce80e1959782ea6d166c4e458b53cd84680104dc
SSDEEP 49152:U+ES+EWwy6i1zuajsaH+ES+EWwy6i1zuajsaH+ES+EWwy6i1zuajsaH+ES+EWwyD:BNNNNNNNNNW
TLSH
T1DB667D1EB29800F6C82F9074C747867BE670B43523216ADBB754C67E6B67AE1643EF04
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1416-0-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/1416-8-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/4976-24-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download

memory/4976-37-0x0000000000DB0000-0x0000000000DD1000-memory.dmp

Download