bceda016754d39df3617e22e83cdfc04f79c3891a144429d550a86946e69901d

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe
Size 12.2MB
Sample260818-cpsfhsvvcw
SHA256 bceda016754d39df3617e22e83cdfc04f79c3891a144429d550a86946e69901d
MD5 5a1beb72c5b592444cb9839abc8c1c69
SHA1 eac8a92e670db878b94e432892f4f77c71879e07
SHA512 14ba78e5347b063be733ad0cc29c98e9816412a75050663c93a089846919bca8a9c12a0ec9866ff8d35b3b87c10990e1cdfa22ef5f06603a7271305c7657f8a3
SSDEEP 49152:U+EPiw2k+EPiw2Iwqp+EPiw2k+EPiw2Iwqp+EPiw2k+EPiw2Iwqp+EPiw2k+EPiL:X
TLSH
T175D65A1437FC0C12F1F762359AB186148DB2B9A64734D2CF61D9826E5E73BC09D36BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6016	svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
6128	svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
3392	svchost_BBBABBABCCACACABAACACBBBBCBABBCACACACAABBAAACAAABBCBABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCABAABACCABAACBAABCCAABCCCBCABCBAACABCCCBCCBBCCABBBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe"	2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBBACBCBBBCCACCCCCCBABCCABBCAAACBABCABCACCACBCBBCCAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBABBABCCACACABAACACBBBBCBABBCACACACAABBAAACAAABBCBABA.exe"	svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4092	sc.exe
1112	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4596	cmd.exe
5580	cmd.exe
3608	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBABBABCCACACABAACACBBBBCBABBCACACACAABBAAACAAABBCBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2576	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4072	2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe
4072	2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe
4072	2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe
4072	2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe
6016	svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
6016	svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
6016	svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
6016	svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4072	2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	6016	svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4072 wrote to memory of 4596	4072	2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe	92
PID 4596 wrote to memory of 2576	4596	cmd.exe	94
PID 6016 wrote to memory of 3872	6016	svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe	95
PID 4072 wrote to memory of 5580	4072	2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe	96
PID 5580 wrote to memory of 4092	5580	cmd.exe	98
PID 4072 wrote to memory of 3608	4072	2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe	99
PID 3608 wrote to memory of 1112	3608	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_5a1beb72c5b592444cb9839abc8c1c69_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBBBACABCBABBCBBBBACAACCBCBBBCABACACABBCBABABBCCABCBCBCABBBCCAAAABCBABAACABABCCACBCBBCBBCBABACBCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4596
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CABBBBBACABCBABBCBBBBACAACCBCBBBCABACACABBCBABABBCCABCBCBCABBBCCAAAABCBABAACABABCCACBCBBCBBCBABACBCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACBCBCBABBBBAACCCCBCAAABCACCBACBACAAACBBABACBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe" start= auto displayName= "UserDataSvc_CBACBCBCBABBBBAACCCCBCAAABCACCBACBACAAACBBABACBBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5580
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACBCBCBABBBBAACCCCBCAAABCACCBACBACAAACBBABACBBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe" start= auto displayName= "UserDataSvc_CBACBCBCBABBBBAACCCCBCAAABCACCBACBACAAACBBABACBBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4092
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACBCBCBABBBBAACCCCBCAAABCACCBACBACAAACBBABACBBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3608
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACBCBCBABBBBAACCCCBCAAABCACCBACBACAAACBBABACBBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3872

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
1⤵
- Executes dropped EXE
PID:6128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBABCCACACABAACACBBBBCBABBCACACACAABBAAACAAABBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABBABCCACACABAACACBBBBCBABBCACACACAABBAAACAAABBCBABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 34c772368feefb51161640629b3caad3ee1893d17bd21c7a0810df56c7e9418a
MD5 37cb17b82b689416225b1710fb4007af
SHA1 6425755a2dc9c318a7756ccc8ff2c02a61e6473b
SHA512 32d4969aec9ba5f62b79067486152566bf3ce4bebc515eaca7c8c224f06fd9e2f85e8e4c3883910c88425a5ffc25ca6aad772858896b75a9813622202115863c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70a5b10e8027ef44c9692bfcd585b6995e7ad8e03608bd35746b1b9f333d75b0
MD5 1a5911d4f828318cf0391686bbe79a21
SHA1 da4bbe803754d12257176f59d45109e1a9a3c91c
SHA512 546e871c43becae932f21b62c25d21f90d5e7fe07cff4ff2c18741abeacc15b02e47a02299f88d42b6adef946ca396ec0d2125811a4c7d355ed732b232601bff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a3c3a481391b47d02ede925acaba25a33a3de78afa9a919cee827753f2f7c9e5
MD5 58dc549d6b9e9e07c438efd8c19a7eb3
SHA1 e78998209ed3653b37cf892ce24157d4cf9c11ee
SHA512 ff8dd3a5ae58ba3736eaded16719507bac75036993b6195463a1b9521c1c113e8c8e90797f6279d85621451cdf63eeea341cecfb0830749fb9c5356dfb07f061
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a97fde57d5455641ab789646471e767ecdc6970b2d6f98456184c82c3f04222
MD5 1658dd6c7dc1809041d9681494afbbe1
SHA1 8b3d6b0979224e04a4e2040d10061aa71f840696
SHA512 c8bb75a8531d1f005623794a4028e7c42b39be1bd25c88cc2cc2170d1776b83661d499f352a9f1235526009e1ce8a440acd31560d0601737430609d013e05965
MD5 SHA1 SHA512

Submit Download

svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBBABBACBCBCBCCABACAAABAABAACBCCACBABABACCCABBCBCCBCC.exe
Size 12.2MB
SHA256 bceda016754d39df3617e22e83cdfc04f79c3891a144429d550a86946e69901d
MD5 5a1beb72c5b592444cb9839abc8c1c69
SHA1 eac8a92e670db878b94e432892f4f77c71879e07
SHA512 14ba78e5347b063be733ad0cc29c98e9816412a75050663c93a089846919bca8a9c12a0ec9866ff8d35b3b87c10990e1cdfa22ef5f06603a7271305c7657f8a3
SSDEEP 49152:U+EPiw2k+EPiw2Iwqp+EPiw2k+EPiw2Iwqp+EPiw2k+EPiw2Iwqp+EPiw2k+EPiL:X
TLSH
T175D65A1437FC0C12F1F762359AB186148DB2B9A64734D2CF61D9826E5E73BC09D36BA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4072-0-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/4072-3-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/6016-24-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/6016-37-0x0000000000960000-0x0000000000981000-memory.dmp

Download