fcbd151bcacc8707944854c707f7f1a3a88252c5dbcedac09696e83e6c2de677

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe
Size 3.1MB
Sample260817-sxdkbsdn3x
SHA256 fcbd151bcacc8707944854c707f7f1a3a88252c5dbcedac09696e83e6c2de677
MD5 912eede547cd8ea8a63e2aa503820af9
SHA1 088d70d2ea35b6d83a0e21f024944bcfc83281b9
SHA512 da4a64dc8424ac91b54210a9c6935442151b305f31f9d34060f358956b6dd85bed66a8321f55468c2ff67ef6ae81f89434fca20ddd864976c1898481b7aa3540
SSDEEP 49152:U+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES:R
TLSH
T1BBE53B09FA9710F1D9774170499BD27B8630BE3187218EFFE689D63A9D33B906838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2608	svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
2964	svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
1816	svchost_BCCBABAACBBCACABBBBACCACCBCCCCBCACCBAACCACACCAABCCCBAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABBCBAAABACCCACAACCCABCACBBACBABACCAABBBCBABBCBCAACBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe"	2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABBBCAABABAABABBBABBAAABCACABAACBABBCCACBACBBACBCCAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBABAACBBCACABBBBACCACCBCCCCBCACCBAACCACACCAABCCCBAAC.exe"	svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2064	sc.exe
3160	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4344	cmd.exe
5752	cmd.exe
2464	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBABAACBBCACABBBBACCACCBCCCCBCACCBAACCACACCAABCCCBAAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4648	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4480	2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe
4480	2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe
4480	2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe
4480	2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe
2608	svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
2608	svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
2608	svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
2608	svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
1816	svchost_BCCBABAACBBCACABBBBACCACCBCCCCBCACCBAACCACACCAABCCCBAAC.exe
1816	svchost_BCCBABAACBBCACABBBBACCACCBCCCCBCACCBAACCACACCAABCCCBAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4480	2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2608	svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
Token: SeDebugPrivilege	1816	svchost_BCCBABAACBBCACABBBBACCACCBCCCCBCACCBAACCACACCAABCCCBAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4480 wrote to memory of 5752	4480	2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe	92
PID 5752 wrote to memory of 4648	5752	cmd.exe	94
PID 2608 wrote to memory of 2824	2608	svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe	95
PID 4480 wrote to memory of 2464	4480	2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe	96
PID 2464 wrote to memory of 2064	2464	cmd.exe	98
PID 4480 wrote to memory of 4344	4480	2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe	99
PID 4344 wrote to memory of 3160	4344	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_912eede547cd8ea8a63e2aa503820af9_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAAAABBAABCAABAACCAACCCCBBBBBBBACCBBACCBCBCCCAAABBBCACCBBACBBBACBCBBABACBBABBBBABCCCCCBCCBCAACCCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBACAAAABBAABCAABAACCAACCCCBBBBBBBACCBBACCBCBCCCAAABBBCACCBBACBBBACBCBBABACBBABBBBABCCCCCBCCBCAACCCAABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABAABBCCBBBAAABCCABCBCCBCACACCBBCAAABCCCABACBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe" start= auto displayName= "UserDataSvc_BAABAABBCCBBBAAABCCABCBCCBCACACCBBCAAABCCCABACBAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2464
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABAABBCCBBBAAABCCABCBCCBCACACCBBCAAABCCCABACBAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe" start= auto displayName= "UserDataSvc_BAABAABBCCBBBAAABCCABCBCCBCACACCBBCAAABCCCABACBAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABAABBCCBBBAAABCCABCBCCBCACACCBBCAAABCCCABACBAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABAABBCCBBBAAABCCABCBCCBCACACCBBCAAABCCCABACBAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
1⤵
- Executes dropped EXE
PID:2964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACBBCACABBBBACCACCBCCCCBCACCBAACCACACCAABCCCBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBABAACBBCACABBBBACCACCBCCCCBCACCBAACCACACCAABCCCBAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a5027d2219336a62f40fabee6e44d093a583a35aa79aaf2e2041b19304e1e5d2
MD5 818f68140d1a163bb423a20eb0520717
SHA1 08afb87abbb5b7bd6e4e69a56a8d16182fc79389
SHA512 97873c54959704bae10cd0051b6b7cc1381a902e336071ebc0a467894574fe9b78023d20357ee1ce293e4ccc8fadf3d2eca5e7e3223a16d429f3ec251391b55b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 00c49fd497a21d19343c68e55dfd31262625013530d7857f3250eb0675de7bb7
MD5 2764249fec7868874a18f730d4dbc432
SHA1 02da154cf8436e8ecf892e3cf132014a12e787e5
SHA512 663e187617315148828c383194500bc4115a7c445db8888352c0efe649a13dda1aa1cdcf925c573f29e53822e1344216a68f12b6d5e74553439f552d1cef5f90
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 30cbc4b366fab4fbbbd4c30705025a9f497a71695ccf7f175f9d0b8f3f84ae55
MD5 2c301f296a39e9898617cfb82dba6bb0
SHA1 ec5ba031be1c262c2525c64d7ee54aebf367faf3
SHA512 92b6a75f2eb0cb475a2a8c647d673f950a8a32af539e2cac1279eafd0e5df994d99b96e9c542b219e1f52e7aaadb14576518af6eb09cc04bbae2a18dc8ba85ea
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 33de15a33e721d46cf9ff07fdcf241c9e6c3b9f5d59396c4a0646212ac931458
MD5 aaea92c877e5ea91ec58e4a175c0ade2
SHA1 190ce592813a344921341fcc16ff4832c941ab46
SHA512 f16495095a7ad0f5539ad9738db90e083f82a46a28a80357d60a6c196db81ed533376eb90824a985f98f54e46e16eea06eb4d411d4dfcec91af123dad57b6375
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa074546ba08c1d6da8003e72474a3668aaa06542abe150803abb00728e51c86
MD5 8dc33d2f7fa5eb365b1dbc7272e2e244
SHA1 cf67ce58119bd1c0a81754dd318cf9269023dbaf
SHA512 a925981848c2a3510442bc103977668f397cb279b2250716f16edee0b162701f827e1d78003b7df4e1c312db624d23ae9226e9fe922f64ae8ec37da6c790a1e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 628a797a8a10e4998bab8ff938e11f8d250a12abe5b3c33820decbb707af3ad5
MD5 c0afdb2faf64b4fcaaad4af815491480
SHA1 da39b758ad54f70c3160dce64c333341b5c10955
SHA512 1d7f4ab3d06cd854160a3133816c4afae71ff49ee3d88ffa7b00e03d981e069c1f3cd99fc7e615f082ccfa444a222b883097299944dc372d546e59f40932fa76
MD5 SHA1 SHA512

Submit Download

svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAACCCBCCAABBABBACCAACBBCBAABABCBCABCAAACCCABABACBAACB.exe
Size 3.1MB
SHA256 fcbd151bcacc8707944854c707f7f1a3a88252c5dbcedac09696e83e6c2de677
MD5 912eede547cd8ea8a63e2aa503820af9
SHA1 088d70d2ea35b6d83a0e21f024944bcfc83281b9
SHA512 da4a64dc8424ac91b54210a9c6935442151b305f31f9d34060f358956b6dd85bed66a8321f55468c2ff67ef6ae81f89434fca20ddd864976c1898481b7aa3540
SSDEEP 49152:U+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES:R
TLSH
T1BBE53B09FA9710F1D9774170499BD27B8630BE3187218EFFE689D63A9D33B906838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 4975cc0e493457ae10bd799e6a3fec9b4cd4efc26d60fd57112a0762dcd934c8
MD5 e8b2520b07a9509c2a3ec3d0ad87731f
SHA1 d10aa988d48ef9d60248f7974393028710f058c0
SHA512 19bd97f1650032386670f87cd241956b451725f4a43ccffe2a4b57d648e271d896ea29d72ec7deb2010a11610451ac8d6829e7e873e6edd5cf6e11d3762323cc
TLSH
T1B8112B00F4AA9477F8722CCE5A2D9B5308A033AFEF54AE042308421C7B5EC319D564E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1816-81-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/2608-22-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/2608-35-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/2964-66-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/4480-6-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download