37be1fae2d45aaf04407d0c7b6d0c44a295770fb318f742d95aa7ea275b2a209

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe
Size 40.1MB
Sample260818-d3m9dsvgld
SHA256 37be1fae2d45aaf04407d0c7b6d0c44a295770fb318f742d95aa7ea275b2a209
MD5 3257d3ab2ced41c78b6010ec8c67ead8
SHA1 272fd6ac8b0a3f3d052305609d979027849b7004
SHA512 b8d7c8e7891fdd4639227274077e20b3adaf39ca9c845dc6bf5afd41209150272e249bec737732d4cc3c081369691524c15f9ddc9bac6613957d803a231a01ed
SSDEEP 196608:RxsbxsbxsbxsaxsbxsbxsbxsaxsbxsbxsbxsaxsbxsbxsbxsaxsbxsbxsbxsaxsD:j
TLSH
T154976C02FAD60470EA77257049BB927A4976BA104731CDEFE34C892F5B33E91983875B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
964	svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
5888	svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
3728	svchost_BCCCAAAAABCACAAACACAAAABAABBACBAAACCBAACAAAAABCBACCCCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABBCCACCABBAACBCCAACBBABCCBCCBBBCAAACCBABCCACBABCCCCBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe"	2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBABAACBAACBCAACCBCAABBCAAAAABBAACBCAACAABBCCABCBBCCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCAAAAABCACAAACACAAAABAABBACBAAACCBAACAAAAABCBACCCCBA.exe"	svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3880	sc.exe
5264	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5172	cmd.exe
4192	cmd.exe
4904	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCAAAAABCACAAACACAAAABAABBACBAAACCBAACAAAAABCBACCCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3764	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4268	2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe
4268	2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe
4268	2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe
4268	2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe
964	svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
964	svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
964	svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
964	svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4268	2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	964	svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 4192	4268	2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe	92
PID 4192 wrote to memory of 3764	4192	cmd.exe	94
PID 4268 wrote to memory of 4904	4268	2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe	95
PID 4904 wrote to memory of 3880	4904	cmd.exe	97
PID 4268 wrote to memory of 5172	4268	2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe	98
PID 5172 wrote to memory of 5264	5172	cmd.exe	100
PID 964 wrote to memory of 4968	964	svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_3257d3ab2ced41c78b6010ec8c67ead8_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACBACAACCCBCCAAAABCAABBBACCABCBBCCBCACAABACAACABBBCAAABBAAACCACAAACBBACACBABACCCACCBCAAACBCBABBCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAAACBACAACCCBCCAAAABCAABBBACCABCBBCCBCACAABACAACABBBCAAABBAAACCACAAACBBACACBABACCCACCBCAAACBCBABBCCCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABACCABAABBCCAABACACAACABBBBBBBACCCBBBCACBBCCACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe" start= auto displayName= "UserDataSvc_CABACCABAABBCCAABACACAACABBBBBBBACCCBBBCACBBCCACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABACCABAABBCCAABACACAACABBBBBBBACCCBBBCACBBCCACCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe" start= auto displayName= "UserDataSvc_CABACCABAABBCCAABACACAACABBBBBBBACCCBBBCACBBCCACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3880
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABACCABAABBCCAABACACAACABBBBBBBACCCBBBCACBBCCACCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5172
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABACCABAABBCCAABACACAACABBBBBBBACCCBBBCACBBCCACCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5264

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:964
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4968

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
1⤵
- Executes dropped EXE
PID:5888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAAAABCACAAACACAAAABAABBACBAAACCBAACAAAAABCBACCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAAAABCACAAACACAAAABAABBACBAAACCBAACAAAAABCBACCCCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff075424d3f3d1a38e9bf417d1222e10879b80916a777380c1fcdec43c06c80f
MD5 0e31f577b64d9fe93005b7bba441fb25
SHA1 4685f8bfb4040b423c6a9a550a961d07d3c89b41
SHA512 ae84da5a8ff0cd323f399d64c0d42b9e3a55a3f440a0370eed674dcc5900a9ef599dfdd5206b22817cf02ce46c81dd0bf4d9952b5ddb964cd5427e1847f4901c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 590f956df7b364a4714bcfa84c91ce4352ec9b8ac594ee92eec6c127472e8cbc
MD5 07a3f4b2f2f43fa0797e12329294f595
SHA1 90d12366253b0594ee7e6e9122fc416f0957ff08
SHA512 6f8d16526ec8e3c7931566e2d83ed34df8a060bb9e32fadb359e5c7d487351b4d6cbd13f197924d77b9f0799c7fae394d39413d79a0ac840873c604bc2639c1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3211c11b504c604a87443624acf4598b5aef449c91df7463534c1ed0c49a1f33
MD5 45f3abdc84bd23b034cb3def508e4764
SHA1 6a7acb47c2613f44881a69da9a52ab7a7818b52d
SHA512 fdff0fbbd0e5f4e679f11f617f488b2c1553373a0c1cc9b6161f494765c539143ca685ce88a935c0c2e6a169ac2fd549f1fb75ec821c451e1f8b5691e5f08339
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d57a3f80e037d014a4c89ed140e3086c2a249c34bef4785a08d7c0d1844eda7
MD5 d3e6429c90f51c566a446b812d209836
SHA1 b1f70abfed579e3b641fdea156579e91e35fa06b
SHA512 8bdf596ece2ea52da4b0b0f727d9e58aefee94fc68f801cf6d2651e068fd4f0f438b798fcb7458adcff70dca3c003ad17ffa6758a03860c2f6de3de18e51d860
MD5 SHA1 SHA512

Submit Download

svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBACCCBABBCCBABCACBABCAACABACBCCAAAACCACCCCCCABACCCA.exe
Size 40.1MB
SHA256 37be1fae2d45aaf04407d0c7b6d0c44a295770fb318f742d95aa7ea275b2a209
MD5 3257d3ab2ced41c78b6010ec8c67ead8
SHA1 272fd6ac8b0a3f3d052305609d979027849b7004
SHA512 b8d7c8e7891fdd4639227274077e20b3adaf39ca9c845dc6bf5afd41209150272e249bec737732d4cc3c081369691524c15f9ddc9bac6613957d803a231a01ed
SSDEEP 196608:RxsbxsbxsbxsaxsbxsbxsbxsaxsbxsbxsbxsaxsbxsbxsbxsaxsbxsbxsbxsaxsD:j
TLSH
T154976C02FAD60470EA77257049BB927A4976BA104731CDEFE34C892F5B33E91983875B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BCCCAAAAABCACAAACACAAAABAABBACBAAACCBAACAAAAABCBACCCCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCAAAAABCACAAACACAAAABAABBACBAAACCBAACAAAAABCBACCCCBA.exe
Size 36.1MB
SHA256 4c7e6ae8744535c8d5ba260d40a9c01a89414e88e43627aab5d120d3a1e474b5
MD5 dce372af8ddcde9ba36cc6cc82f51b19
SHA1 ade1c103c307d4df88a5ee5dbaf22e21a2c2b93e
SHA512 96f85b2a3398995c03534531c3b3126883a41cbcf4bd72779424bb0f458edbc69a5a1793d1a39ea35bd8ec54556875136ac189fbbe60d3905ded374bbc0d11a3
SSDEEP 196608:Rxsbxsbxsbxsaxsbxsbxsbxsaxsbxsbxsbxsaxsbxsbxsbxsaxsbxsbxsbxsaxse:+
TLSH
T14B877C02FAD60470EA77257049BB92BA4976BA104731CDEFE34C892F5B33E91583875B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/964-34-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/964-52-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/964-73-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/4268-35-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4268-32-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4268-0-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4268-61-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4268-22-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/4268-11-0x0000000000170000-0x0000000000191000-memory.dmp

Download