e367f62e992ded9f162a38807938ea78999a1b219356ba209915ff4a7d95c673

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe
Size 17.5MB
Sample260818-cf5pgstfra
SHA256 e367f62e992ded9f162a38807938ea78999a1b219356ba209915ff4a7d95c673
MD5 95c89749c48376eda670b7bf5f5ccf6f
SHA1 dbe6b647ce83c482ddc6916179dc018915948ada
SHA512 d91be39ab54ea1dde0e41a8609be48dd737ee3dd53c573001cd62705dce23811ab8f316ffda23c5ad5a2368c69246fe4a30516272f6fdf44392d56a04f7e09a8
SSDEEP 196608:6xsnxsLxsnxsLxsnxsLxsnxsLxsnxsLxsnxsLxsnxsLxsnxsLxsnxsb:S
TLSH
T1CB076D05FA8704B1E97721704DEBD2BE89707A118732CEEFE749862F6933B915838716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3384	svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
2540	svchost_CBBCBCCBBCCBAACBCBBAAACAAABBBAAABBCBCCCCCAACBCACCCACABA.exe
5020	svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACABCBBBACBCACCCABCABCBCACCBCACBABAAAAACABCAAACACABACCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe"	2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCACACCAAABBACBBBACCCCCBBCCBAABBCBAACBCACBACBBCCABABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCBCCBBCCBAACBCBBAAACAAABBBAAABBCBCCCCCAACBCACCCACABA.exe"	svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1988	sc.exe
1528	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1912	cmd.exe
2000	cmd.exe
1664	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCBCCBBCCBAACBCBBAAACAAABBBAAABBCBCCCCCAACBCACCCACABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1984	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3064	2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe
3064	2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe
3064	2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe
3064	2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe
3384	svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
3384	svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
3384	svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
3384	svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
2540	svchost_CBBCBCCBBCCBAACBCBBAAACAAABBBAAABBCBCCCCCAACBCACCCACABA.exe
2540	svchost_CBBCBCCBBCCBAACBCBBAAACAAABBBAAABBCBCCCCCAACBCACCCACABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3064	2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3384	svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
Token: SeDebugPrivilege	2540	svchost_CBBCBCCBBCCBAACBCBBAAACAAABBBAAABBCBCCCCCAACBCACCCACABA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 1664	3064	2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe	92
PID 1664 wrote to memory of 1984	1664	cmd.exe	94
PID 3384 wrote to memory of 1028	3384	svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe	95
PID 3064 wrote to memory of 1912	3064	2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe	98
PID 1912 wrote to memory of 1988	1912	cmd.exe	100
PID 3064 wrote to memory of 2000	3064	2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe	101
PID 2000 wrote to memory of 1528	2000	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_95c89749c48376eda670b7bf5f5ccf6f_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBAACCBACBCAABACBCCBBBBBAACAACAACABAAAABCBBABBBCABBCBCCCBCCABBACCBBBCCBABBBCAACBCACBBCCCBAACABABACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1664
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACBAACCBACBCAABACBCCBBBBBAACAACAACABAAAABCBBABBBCABBCBCCCBCCABBACCBBBCCBABBBCAACBCACBBCCCBAACABABACAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1984
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABBAAACABCCCCAABCAABBCCCBCACBABCABBAABAACAACABCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe" start= auto displayName= "UserDataSvc_CABBAAACABCCCCAABCAABBCCCBCACBABCABBAABAACAACABCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABBAAACABCCCCAABCAABBCCCBCACBABCABBAABAACAACABCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe" start= auto displayName= "UserDataSvc_CABBAAACABCCCCAABCAABBCCCBCACBABCABBAABAACAACABCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABBAAACABCCCCAABCAABBCCCBCACBABCABBAABAACAACABCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABBAAACABCCCCAABCAABBCCCBCACBABCABBAABAACAACABCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1028

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBBCCBAACBCBBAAACAAABBBAAABBCBCCCCCAACBCACCCACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCBCCBBCCBAACBCBBAAACAAABBBAAABBCBCCCCCAACBCACCCACABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
1⤵
- Executes dropped EXE
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4fb0326eb7ff717b8e6d5204a9ce015d250a463dad448b7853ff5c2e4aeef11d
MD5 32c55483172abe65246656bcee901891
SHA1 6248f43aae088cbd49b20d51c65f87371f26872d
SHA512 fdba20bc05144d1e91022b52bb911b2e240b2af489fe6e832b5861ea74b26b2104532d7b6ff153a84934e87f4c4ab57ad08fde4d0f926e92e152cea196b48f59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c82bee5f2d699a22b2f9067685dff5babb4154d7e38c36d6db52bcc085c8b57b
MD5 250a739d3b65e725510099f6c9e9906a
SHA1 55ce1937b8f4dff52c4cafa70c104a1259d270d5
SHA512 b1365b821b8cd18b1b9144dda16ba50779b593013c1ed6f85ed29636fe8a368ddc839f0d43c77a9e8f38f7f4d82c5842ff56b48cefc588819965bbf8348cfaf0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 022ea0224c98546cd62f78d93ed4b37fba137f96c8c4a9cce72abc86ca624efa
MD5 e24a620aeb560479742ff567de87a3f1
SHA1 142a2acdf8c75a3a772e79439b787ddcad406078
SHA512 f97eccdf513d7828a4f54a930cc82f04f08ab17e39cc2dda90d6306e5fb7029d727ad3312ee8b975e72c691fa1d6766426835b473643589d0688b641ea5145c8
MD5 SHA1 SHA512

Submit Download

svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCBCABBAAACCBBBBCBACCACCBCAAAAAAAAACBAABABBABBCBABBA.exe
Size 17.5MB
SHA256 e367f62e992ded9f162a38807938ea78999a1b219356ba209915ff4a7d95c673
MD5 95c89749c48376eda670b7bf5f5ccf6f
SHA1 dbe6b647ce83c482ddc6916179dc018915948ada
SHA512 d91be39ab54ea1dde0e41a8609be48dd737ee3dd53c573001cd62705dce23811ab8f316ffda23c5ad5a2368c69246fe4a30516272f6fdf44392d56a04f7e09a8
SSDEEP 196608:6xsnxsLxsnxsLxsnxsLxsnxsLxsnxsLxsnxsLxsnxsLxsnxsLxsnxsb:S
TLSH
T1CB076D05FA8704B1E97721704DEBD2BE89707A118732CEEFE749862F6933B915838716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0699b9c5b3eb486647f8de05151139ac367f3c82e625ab3f04d6ae6dffddfb6e
MD5 9745ee2f618dd2136c988423af0d2058
SHA1 a9dfadaaa2beb8aa56b2bd5ba3d0ad8e8bd5f6f6
SHA512 e5c7dfb307d258e112e06de8f8d98949787a25e1b53a4aaf4df44357fb59a3ce962bed234337af5217b7ee406b1d5d5e85928516d4b11be57dce4c75ebd6793a
TLSH
T17D110461E9E7C853F83368CF451DAA974CE437CF58587A2422085218B7C5C31EE1A4E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2540-79-0x0000000000530000-0x0000000000551000-memory.dmp

Download

memory/3064-0-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/3064-8-0x0000000000650000-0x0000000000671000-memory.dmp

Download

memory/3384-32-0x0000000000E00000-0x0000000000E21000-memory.dmp

Download