dce0103f7c8e6150e1d3688a9886be749e040797f2c5751dd7b91dbdeb1d3958

Analysis

max time kernel
149s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe
Size 11.2MB
Sample260818-c2h3lsvanf
SHA256 dce0103f7c8e6150e1d3688a9886be749e040797f2c5751dd7b91dbdeb1d3958
MD5 1035c6eae5579e992aaac8396df99ce1
SHA1 f9db1fe6858a547f4640db325722a9dced0a203b
SHA512 a98f0bab8a74fd40cee3b03b2b9cb6ff005277eac34b791eed603758c2e4b022772ae04a2ccc7b92ecb33e77b85217d2b667e7e56801e7a61077632aa703b9b2
SSDEEP 49152:U+EPiw21F+EPiw21F+EPiw21w+EPiw21F+EPiw21F+EPiw21w+EPiw21F+EPiw2C:D
TLSH
T1C2C63B0A77ED4854F5B7723489B28669DAB3BC915B31C7DF5280823D1E73AE0AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3460	svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
3768	svchost_CAABBBABACCAAABABCBCBACCBBCCACBAABCCBAABBCCAACCBAACCBBA.exe
5428	svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAAABCBBACBBCBCBACBABCBBABABAAACBAAAACACBCABCCBCAABAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABBBABACCAAABABCBCBACCBBCCACBAABCCBAABBCCAACCBAACCBBA.exe"	svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABCAAAAABACBCABAABCBBCACCCAABCCCBBCAACBCACACCBBCBBCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe"	2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5340	sc.exe
4376	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2140	cmd.exe
4744	cmd.exe
3424	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABBBABACCAAABABCBCBACCBBCCACBAABCCBAABBCCAACCBAACCBBA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
400	2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe
400	2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe
400	2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe
400	2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe
3460	svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
3460	svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
3460	svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
3460	svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	400	2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3460	svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 2140	400	2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe	92
PID 2140 wrote to memory of 988	2140	cmd.exe	94
PID 3460 wrote to memory of 3320	3460	svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe	95
PID 400 wrote to memory of 4744	400	2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe	96
PID 4744 wrote to memory of 4376	4744	cmd.exe	99
PID 400 wrote to memory of 3424	400	2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe	100
PID 3424 wrote to memory of 5340	3424	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_1035c6eae5579e992aaac8396df99ce1_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACBCAABCCCCBAACACCABABBCCBBABBCCBBCBBCBCCACABACCCCCCCBBCCCBCACCCABBBCCACBCABBBBCCCBACCABBCCCABBCABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2140
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBACBCAABCCCCBAACACCABABBCCBBABBCCBBCBBCBCCACABACCCCCCCBBCCCBCACCCABBBCCACBCABBBBCCCBACCABBCCCABBCABAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCAABCAACABABBACCBACCCBBBCBABABAAABCACBBACCCCCCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe" start= auto displayName= "UserDataSvc_CCAABCAACABABBACCBACCCBBBCBABABAAABCACBBACCCCCCCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4744
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCAABCAACABABBACCBACCCBBBCBABABAAABCACBBACCCCCCCCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe" start= auto displayName= "UserDataSvc_CCAABCAACABABBACCBACCCBBBCBABABAAABCACBBACCCCCCCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCAABCAACABABBACCBACCCBBBCBABABAAABCACBBACCCCCCCCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3424
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCAABCAACABABBACCBACCCBBBCBABABAAABCACBBACCCCCCCCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3460
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABACCAAABABCBCBACCBBCCACBAABCCBAABBCCAACCBAACCBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABBBABACCAAABABCBCBACCBBCCACBAABCCBAABBCCAACCBAACCBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
1⤵
- Executes dropped EXE
PID:5428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52c43ac201c84c25b6f259522cb3edfa072a937476d882949ce1c33e4fcf2e9c
MD5 c5cbc38fd04247088c70738ca10ae2b9
SHA1 40628158bd84cdb22cd6d904500c794b0d79be95
SHA512 6c7659b9596d6acdd854173aa7b8c862898b04a75e2a4c11d1b216fbcc1f0f2b64bc88fb1aa9b0167d52380cbc41b4f85b18e1c6ba440c11d1b468e81b7dc727
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ae99886b9db4ee7328e5fbf7778c3af89b63370df2dd12ac4d3d1e4509f55d4c
MD5 0bc99c0f4668a2552761338f485135ca
SHA1 7838a32e273573ebc09ebfe6d3870d0bac570fc4
SHA512 16711fa9e7b218fc1d90b9eb2f7c8de042b4d036faee96b81efe09fedb298780510e2f34c86dc7654f873efd250402939f23a5147727e9ab066b22888d9271a0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3fc8ae10417ebd4d094e6d6854b822678bfb9705a37370a1bdbf74a886fddc0c
MD5 a1aa7547130d520dca0780c955a4f768
SHA1 4061c4b5ce8ec2ef7bd08f79302875bce271d528
SHA512 db975fcb7ece7fcc2b33a3f67b098c2dceec89af7e453a1b9225144cb9bd2a49f5507939a8b19f18dd767a2a85d6242cdf5d5f3f41ec580f9d648205f7a4cf69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4ca9627edc9d37ed15ebad5104a3a291a912eb2d79f6e4b25dbc8ef7c03ca098
MD5 2c8dd020f2603caa65875c594eced906
SHA1 5a8e330fda4eac8bd1cb3e366f2fc742b711046f
SHA512 e9e081fa9c2b30a1219ea1194ebb798c7aef08f8dd6c10f98be107cf05479a4de73283d25a4bd84f809e6c6b1fffed74053afee4361e784cb4c1ff873d81a4fe
MD5 SHA1 SHA512

Submit Download

svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAACCACBCBCCBACAAAAAACCBAAABCBCCCCCCABBCACBCBABBBBCCBB.exe
Size 11.2MB
SHA256 dce0103f7c8e6150e1d3688a9886be749e040797f2c5751dd7b91dbdeb1d3958
MD5 1035c6eae5579e992aaac8396df99ce1
SHA1 f9db1fe6858a547f4640db325722a9dced0a203b
SHA512 a98f0bab8a74fd40cee3b03b2b9cb6ff005277eac34b791eed603758c2e4b022772ae04a2ccc7b92ecb33e77b85217d2b667e7e56801e7a61077632aa703b9b2
SSDEEP 49152:U+EPiw21F+EPiw21F+EPiw21w+EPiw21F+EPiw21F+EPiw21w+EPiw21F+EPiw2C:D
TLSH
T1C2C63B0A77ED4854F5B7723489B28669DAB3BC915B31C7DF5280823D1E73AE0AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/400-0-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/400-8-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/3460-24-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download

memory/3460-34-0x00000000009C0000-0x00000000009E1000-memory.dmp

Download