4451b0a6306ecfe570d1e4f59236bac139a632530b88b6cf54801bbf79f8f95d

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 03:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
Size 12.8MB
Sample260818-dh2laavcrc
SHA256 4451b0a6306ecfe570d1e4f59236bac139a632530b88b6cf54801bbf79f8f95d
MD5 a8f7f03e32c7f01d844c7c5e02f69a8b
SHA1 afcb72f6598945fb80e7284130057be4e90d48cc
SHA512 7c36775629ff39a105aa2fabb6ab195159f98164870e5ea874a55d3702c66d3ab019f44296f1a55c8ab1b7286b9406d08441ff808fecfdfb22a00ea4b24cefd7
SSDEEP 98304:1LZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1oX:1LZvLZvLZvLZvLZvLZvLZvLZvLZvLZO
TLSH
T139D65C09F94340B2E96751B14DCFD27F8634BB2583128EFBFB8DCA1BB932A915839115
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2792	svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
4320	svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
2388	svchost_CCABCCABACABBBABCABCBABACCCBAABBCABBBCACACBBAABACACBCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABCACACBACCBAABABBABACCACBAACABAABACBBCCBABABBBCCCACBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe"	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCAAAAABCABACCBBCBAACBACBACCCBCCBBABABBABCABCCCBAABBACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCCABACABBBABCABCBABACCCBAABBCABBBCACACBBAABACACBCBA.exe"	svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
592	sc.exe
3248	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4484	cmd.exe
1856	cmd.exe
4236	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCCABACABBBABCABCBABACCCBAABBCABBBCACACBBAABACACBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1900	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
1900	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
1900	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
1900	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
2792	svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
2792	svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
2792	svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
2792	svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1900	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
Token: SeDebugPrivilege	2792	svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2272	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1900 wrote to memory of 1856	1900	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe	110
PID 1856 wrote to memory of 1704	1856	cmd.exe	112
PID 2792 wrote to memory of 4840	2792	svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe	113
PID 4840 wrote to memory of 4768	4840	notepad.exe	114
PID 1900 wrote to memory of 4236	1900	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe	116
PID 4236 wrote to memory of 592	4236	cmd.exe	118
PID 1900 wrote to memory of 4484	1900	2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe	119
PID 4484 wrote to memory of 3248	4484	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_a8f7f03e32c7f01d844c7c5e02f69a8b_amadey_elex_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1900
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBAAABCACCBCCBCBCABBBABCBACBABABBCBACABBABBCCBACABBBCABAAABABCACCAACBBBCBACBCBCBBACABACABBBBBBAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1856
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBAAABCACCBCCBCBCABBBABCBACBABABBCBACABBABBCCBACABBBCABAAABABCACCAACBBBCBACBCBCBBACABACABBBBBBAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBACAABCCACABCACAABAAAACCCAABBBCAACCBABCAAABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe" start= auto displayName= "UserDataSvc_BBCCBACAABCCACABCACAABAAAACCCAABBBCAACCBABCAAABBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4236
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBACAABCCACABCACAABAAAACCCAABBBCAACCBABCAAABBBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe" start= auto displayName= "UserDataSvc_BBCCBACAABCCACABCACAABAAAACCCAABBBCAACCBABCAAABBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:592
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBACAABCCACABCACAABAAAACCCAABBBCAACCBABCAAABBBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCBACAABCCACABCACAABAAAACCCAABBBCAACCBABCAAABBBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3248

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4768

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
1⤵
- Executes dropped EXE
PID:4320

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCABACABBBABCABCBABACCCBAABBCABBBCACACBBAABACACBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCABACABBBABCABCBABACCCBAABBCABBBCACACBBAABACACBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 50556df88728c019fca357f90594b13742321677565f0e988cdb7679dabf6b2a
MD5 6935c43b733267cd39c168e13e0cf994
SHA1 73ca6c216622f16d1754bb101d48f8ece2cc7814
SHA512 b892c72b28f1884f717f953aa5d8f792beff20372e9dce314ff0263bd4077354d9d7ee9cb53be4cbdfb83032355da963f0b97a0fd1992aa31e5e911c4333c4c9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ee8d97d9b716d5bb2bea23675970b8ea13c4d4fa0d4ffffa0ffdc101a0d46be9
MD5 17da800edbb1d7b7fd58c4773eeab0c7
SHA1 53b8f6906a197552f13eaa80af0208dc5ae7850f
SHA512 84803c14f7d22c4314d2fef08c4405add44688390923d5629f591688323a7394353e736b5d18bbe81868201eb5b806ba44e8cba0cbd9d7872dfe2df23f62a392
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f69357ae78fab8621ef11e9918bafeb6b80cce0834fca73fb4f1e3d40936e1e5
MD5 4318b30d5b271957aa85c7f6ef03ab01
SHA1 a06df03daa07d14be6b0697dc144c80ec2db80c0
SHA512 4afca3aa887a7d527853ec35f7c415223a1eb9c22c8b1af9497fc362969830e29a48a5d396b13c5679399bba3afe0ec96bbdfe8ca45d6c4eef31bd6ec9d3d325
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4a5b8f80e72e553e7febd00e2ab103990cea2daee4d55c3584677c11404f1d08
MD5 5c70dc6e1d828f7720aaee85840f7784
SHA1 129cde851f0a38088a62afea51e0661f6141cae8
SHA512 84c24b9ec0785e5f9c35891d8698a4d19196a8541d1f3368f20379dfaabf8a49d44a9204f5a6d2d125f32ba91dec7a1463175a8221cf25716508c155ff2b76f2
MD5 SHA1 SHA512

Submit Download

svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABAAAABBBCAABBABBABCCBCBAABACAACBABCCCABACBBABBCCACA.exe
Size 12.8MB
SHA256 4451b0a6306ecfe570d1e4f59236bac139a632530b88b6cf54801bbf79f8f95d
MD5 a8f7f03e32c7f01d844c7c5e02f69a8b
SHA1 afcb72f6598945fb80e7284130057be4e90d48cc
SHA512 7c36775629ff39a105aa2fabb6ab195159f98164870e5ea874a55d3702c66d3ab019f44296f1a55c8ab1b7286b9406d08441ff808fecfdfb22a00ea4b24cefd7
SSDEEP 98304:1LZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1ouLZ1oX:1LZvLZvLZvLZvLZvLZvLZvLZvLZvLZO
TLSH
T139D65C09F94340B2E96751B14DCFD27F8634BB2583128EFBFB8DCA1BB932A915839115
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1900-0-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/1900-7-0x0000000000CE0000-0x0000000000D01000-memory.dmp

Download

memory/2792-27-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/2792-40-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/4840-60-0x0000000002B20000-0x0000000002B21000-memory.dmp

Download