8990fbac9bac332f041102aa82939af171531e9244ac352147f0036a93889932

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
Size 9.8MB
Sample260818-dec4hsfa83
SHA256 8990fbac9bac332f041102aa82939af171531e9244ac352147f0036a93889932
MD5 bbf5013e8e88d4c7d74a34283d5b688c
SHA1 aeae69a629c8cd78c36c41fe3dc61f099f32358c
SHA512 28fedebb2687fd5c799ae1c24fa7d42d0449ef83a528c955497e7456ec87dc56de8ddab404304047bb890c0413f8077aa12901bfefe9bf838f250c29a130d7fc
SSDEEP 49152:U+EzrhOL+EzrhOL+EzrhOh+EzrhOL+EzrhOL+EzrhOh+EzrhOL+EzrhOL+EzrhOd:QUUgUUgUUgUUgUUgUUgUUgUUZ
TLSH
T107A64A0C72EA00E8E5B39634C9668266C972B8315731DADF62D4C17E9E33BD5B934F12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
936	svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
4724	svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
2588	svchost_ACABCAABCAACBBBACCCCBACAACABBACBBABABBCAAAAACCAAABAAAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BCAACAABCCACCBBAABBBACBABBAACBCBACCAAACBABACCCAAACBCABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe"	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BACABCBAABBBABCAACCBCABAACBABBBBCACABABCABCABBCBBABBBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABCAABCAACBBBACCCCBACAACABBACBBABABBCAAAAACCAAABAAAAA.exe"	svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1172	sc.exe
2220	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2796	cmd.exe
2348	cmd.exe
4872	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABCAABCAACBBBACCCCBACAACABBACBBABABBCAAAAACCAAABAAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
856	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
856	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
856	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
856	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
936	svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
936	svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
936	svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
936	svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
2588	svchost_ACABCAABCAACBBBACCCCBACAACABBACBBABABBCAAAAACCAAABAAAAA.exe
2588	svchost_ACABCAABCAACBBBACCCCBACAACABBACBBABABBCAAAAACCAAABAAAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	856	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	936	svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
Token: SeDebugPrivilege	2588	svchost_ACABCAABCAACBBBACCCCBACAACABBACBBABABBCAAAAACCAAABAAAAA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3160	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2796	856	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe	95
PID 2796 wrote to memory of 728	2796	cmd.exe	97
PID 936 wrote to memory of 4976	936	svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe	98
PID 4976 wrote to memory of 4224	4976	notepad.exe	99
PID 856 wrote to memory of 2348	856	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe	101
PID 2348 wrote to memory of 1172	2348	cmd.exe	103
PID 856 wrote to memory of 4872	856	2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe	104
PID 4872 wrote to memory of 2220	4872	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_bbf5013e8e88d4c7d74a34283d5b688c_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:856
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACBBBCACBAACBBCBCBAAAABCCBACBCBAACCCCCACBCCACABCACBCCBCAAACABACAACABCCCABCCBBBCCCABBCBABBACBBABBAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBACBBBCACBAACBBCBCBAAAABCCBACBCBAACCCCCACBCCACABCACBCCBCAAACABACAACABCCCABCCBBBCCCABBCBABBACBBABBAAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCCCCCBCBBABACAACBBBBCCCCCCBCBABAACCCCCAACBCCBBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe" start= auto displayName= "UserDataSvc_ABCCCCCBCBBABACAACBBBBCCCCCCBCBABAACCCCCAACBCCBBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCCCCCBCBBABACAACBBBBCCCCCCBCBABAACCCCCAACBCCBBCAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe" start= auto displayName= "UserDataSvc_ABCCCCCBCBBABACAACBBBBCCCCCCBCBABAACCCCCAACBCCBBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCCCCCBCBBABACAACBBBBCCCCCCBCBABAACCCCCAACBCCBBCAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCCCCCBCBBABACAACBBBBCCCCCCBCBABAACCCCCAACBCCBBCAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2220

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4976
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3160

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
1⤵
- Executes dropped EXE
PID:4724

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCAABCAACBBBACCCCBACAACABBACBBABABBCAAAAACCAAABAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABCAABCAACBBBACCCCBACAACABBACBBABABBCAAAAACCAAABAAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99286455ea29c8840a1ff3b415a0d6a53e4a2f5303be48d8005e4f56bd87700e
MD5 437cf81ec471e525e2ed3431c25c18f4
SHA1 f752e0c166ae8ef8e238be3447428ab6666d3ae0
SHA512 ab3066cfe6fb6f0c5a032014e127b21f03d31ec10696715fcf0a25f102661e94a2f53f184e57aed2d6ed3c0514f7466b8a9ba9b685c4765007305e9ab99ccfcd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 12faef5d6b9d9641088bba967a4e57c46bb79d1aab83d39e9ced0f31f08d4f06
MD5 c8206b205c30fe56dbfd24a34976f426
SHA1 daf45026ae6f0f4f39405bfc9c3fd7988900ba1f
SHA512 79aa91080cfe072d92ef3b764ff1ddf5a2fe80303098792d11f7278fc19c1e17a8dba64a44b1e1588548142515b4d01f7eb3a8e25535232fa9a6614bce746ace
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e1e7f6a1e8dc139ccb8209a4f8056d425de2624b75a1259acfc18104a13f64a5
MD5 65501d9c82dd054b75d6ce91bdeed87c
SHA1 0e9dc806c9f744cacff5478ed6f188fecf64486f
SHA512 c3843952968e37a337df73c5d6452e850979c6d1cdab18b09850b1dcf1c02b43313b69725a6da74484faf831ed1ffd06b5d40ce94a7c378bf586f72db315149a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5480c069594864bf5b29548ed7241771292b18b0852a433ead13146e6a1b7b52
MD5 22bff920056326ba6fdda5c97cf0e788
SHA1 24706bd40320d3811a1f10a118706a53700a8f83
SHA512 2e8c535f6126a406f2859861a2d5492292731a6cfb96675a84edc1edc6a7cfc9e769aebc662e9e88fb9d1bf90f963d67ec17364fed6ad4707b90e83f9f8a3743
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1809612cff72c029528a50370a99822e90562b5023dd0cd77bcf3e879b3984f3
MD5 683f51092a2238a3c010133b519abdb4
SHA1 ec1590f3bc1e64eea4ca7c45288d1edc6dc1f828
SHA512 3d4f435080d883efb7f818a0dd4462d8e087d77d250d4a79b1bbafebb8fe8302b4bf3b05671a9fe01828716bd8834d759a9acfb65d52ca65f5c74ca3b8df2bdd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 9f785d4d6cd86ab4bc8cdedfa9ec2b4f02d54efdee3eb37a4626d8d6d5a48de2
MD5 9c6cfd57648a1f90d1b2bb0c41b66939
SHA1 9978e70b2cf83de673840e67727869574d072121
SHA512 125c6b723e1eff5e069fd9df453e7a09842b188187ab975d1aaea2265073e2a2262ee4bbd797d259f21a04d53cf527146da04a46b338a9c6a15d4c5464e20258
MD5 SHA1 SHA512

Submit Download

svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCACBBABBBACBBBABCAAACBCBBAABBBBCBBCCBACAAACBBBBBCABB.exe
Size 9.8MB
SHA256 8990fbac9bac332f041102aa82939af171531e9244ac352147f0036a93889932
MD5 bbf5013e8e88d4c7d74a34283d5b688c
SHA1 aeae69a629c8cd78c36c41fe3dc61f099f32358c
SHA512 28fedebb2687fd5c799ae1c24fa7d42d0449ef83a528c955497e7456ec87dc56de8ddab404304047bb890c0413f8077aa12901bfefe9bf838f250c29a130d7fc
SSDEEP 49152:U+EzrhOL+EzrhOL+EzrhOh+EzrhOL+EzrhOL+EzrhOh+EzrhOL+EzrhOL+EzrhOd:QUUgUUgUUgUUgUUgUUgUUgUUZ
TLSH
T107A64A0C72EA00E8E5B39634C9668266C972B8315731DADF62D4C17E9E33BD5B934F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 adc0545401bfc3006db511f471936b75bb57f8741bd8976d6277f60d3bc0f2c5
MD5 c7ab1281d036ddb23b4c6ecb11676253
SHA1 89b1731b1faec8e96fdaac808d2165fe861a134c
SHA512 009de289a92d00aefb6ce3ea6984dc7cffbd39d40883580d3ea995268dea88046fa36fdff271412b1d42da20b9105b8b293282d41aba8c428a9041ed6ae2d3a3
TLSH
T17411C470E4E7DC53A9326A87931ABBC28CE4268FAD5C7A1463054218AFC4C32CE19496
MD5 SHA1 SHA512 TLSH

Submit Download

memory/856-7-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/856-0-0x0000000000C00000-0x0000000000C21000-memory.dmp

Download

memory/936-39-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/936-26-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/2588-89-0x0000000000BC0000-0x0000000000BE1000-memory.dmp

Download

memory/4724-84-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/4976-60-0x00000000058C0000-0x00000000058C1000-memory.dmp

Download