8c4e99a8d8193e8c77cf2f3292c9bfda4ba74885d468ad1b193dd2444e9ec00d

Analysis

max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/08/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe
Size 44.4MB
Sample260818-ea8kasfc25
SHA256 8c4e99a8d8193e8c77cf2f3292c9bfda4ba74885d468ad1b193dd2444e9ec00d
MD5 084e889f6218628419b634f995d99d9c
SHA1 5cae330d93bd019164e74479ac588414e1084e55
SHA512 3b1a8e4766a687ebb7420e65c19516c4e11c4c46ebb48e0dc5f99f3417b877eb205809811edbb379bb1031fc85944bbc3e2ade2f32aa7b7f210f1d1cfdf6fd95
SSDEEP 786432:w5S5I525B525S5k5S5I525B525S5k5S5I525B525S5k5S5I525B525S5k5S5I529:3
TLSH
T174A74B18F7D71161FA7756B08CEBD2FA5D317E2087318AAFE608D60A2D32AD0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5112	svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
4112	svchost_CCCCCCABCBCABABBCBCAACACCABBCBBBBBAABCBBCAAACCACCCBCCBB.exe
216	svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBBACAABBBCAACCBCACBAACBBCCBCBCAAACBACBBCCCCACBAABBAACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe"	2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABBAAAACCBCAABCBBCABBBAAAACACBCBCCBCBCBBAABCCCAAACCCCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCCCABCBCABABBCBCAACACCABBCBBBBBAABCBBCAAACCACCCBCCBB.exe"	svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5432	sc.exe
4256	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5772	cmd.exe
2468	cmd.exe
884	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCCCABCBCABABBCBCAACACCABBCBBBBBAABCBBCAAACCACCCBCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4812	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2240	2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe
2240	2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe
2240	2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe
2240	2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe
5112	svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
5112	svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
5112	svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
5112	svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
4112	svchost_CCCCCCABCBCABABBCBCAACACCABBCBBBBBAABCBBCAAACCACCCBCCBB.exe
4112	svchost_CCCCCCABCBCABABBCBCAACACCABBCBBBBBAABCBBCAAACCACCCBCCBB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2240	2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5112	svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
Token: SeDebugPrivilege	4112	svchost_CCCCCCABCBCABABBCBCAACACCABBCBBBBBAABCBBCAAACCACCCBCCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4276	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 5772	2240	2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe	97
PID 5772 wrote to memory of 4812	5772	cmd.exe	99
PID 5112 wrote to memory of 4828	5112	svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe	100
PID 4828 wrote to memory of 4200	4828	notepad.exe	101
PID 2240 wrote to memory of 2468	2240	2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe	105
PID 2468 wrote to memory of 5432	2468	cmd.exe	107
PID 2240 wrote to memory of 884	2240	2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe	108
PID 884 wrote to memory of 4256	884	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_084e889f6218628419b634f995d99d9c_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABABABCCBCBCBBCCACBBCBBABABCABBACBACCBBBBCACAABACAABCCABBBABBCBCBCACCCBACCBACCBCAACABCBBACBBCAABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCBABABABCCBCBCBBCCACBBCBBABABCABBACBACCBBBBCACAABACAABCCABBBABBCBCBCACCCBACCBACCBCAACABCBBACBBCAABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCBBCCABAAABAAACABCABACBCBBACCCABCACCACBAACACCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe" start= auto displayName= "UserDataSvc_BCCBBCCABAAABAAACABCABACBCBBACCCABCACCACBAACACCCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCBBCCABAAABAAACABCABACBCBBACCCABCACCACBAACACCCCCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe" start= auto displayName= "UserDataSvc_BCCBBCCABAAABAAACABCABACBCBBACCCABCACCACBAACACCCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCBBCCABAAABAAACABCABACBCBBACCCABCACCACBAACACCCCCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:884
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCBBCCABAAABAAACABCABACBCBBACCCABCACCACBAACACCCCCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4200

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4276

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABCBCABABBCBCAACACCABBCBBBBBAABCBBCAAACCACCCBCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCCCABCBCABABBCBCAACACCABBCBBBBBAABCBBCAAACCACCCBCCBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
1⤵
- Executes dropped EXE
PID:216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 878f170e76cb4c5fe670ee264e85513a0c8a59a981f5cca29e52c9c475e87d58
MD5 1a482e56c2309e3b7dd2c0f6b9c87095
SHA1 429f340f2ed8f402e200395acf2ad5be2ea3fc6d
SHA512 3c52a261fb3c7306c6eb8b8882debf6dd3d2cb9c3d4f869a5c8448da5bb2607c28e9a7eef207958188c2f754e31315af33badf276a5f45373395bdfc53dc5b97
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 352c87d44c18a59dee7257e9a2f1ecbc57566e930ca9ed2c874ba8e76c7a63ce
MD5 6e4b4b40af251e3781d07b316e1d21f2
SHA1 632219be72c78ad061ecad308925531ad52d4818
SHA512 f2a65c0e653b8205d23ed0e21a442602aecae9fa637fa89ef65da90b3fb9aba5accb95b31e5c240e277b49deae62d4e79ab0a4ea84ec6a7db4d3e4e171b956dd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1c45f5c6f9d4d0b875d41aa31e8564bccc55276c61b708d91e2ae35d394490e2
MD5 b11a7f19054305e4fe930a5d66e2b207
SHA1 2990e6d3a1d04ab321ac1986b50d50b0f8ef4725
SHA512 43fa1c80166ca6328646eb444bee8acc6f0bca1c1579a2f669167ff31e1b81d0de4b04aa0fb4710e1251ed7893fff5f48904e8ceaecacc5d20c442b8034b8aae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f2df1428e8f989daf76ea5b77805bd21a8eaf78b4e978ed4426737b29dc59e48
MD5 9c40a5a5c55f40db89f2d8debd5ac68d
SHA1 47887660f5abe1529d8af253f1ac930f354924da
SHA512 7321d88d9356b26e8ffd214c7877b299ef21cd98b59a45bbb1d91b1708dfed46afd85645bf0a5dc8374e8f8bc0629bea3a8919808d55f628cde7989c0aec4273
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 32fd487645f20dcebdf8f396b45d29a146a20e710d6aa546f8045faffaa4bdb2
MD5 13f5bfeed651134092fb8a30a9abf841
SHA1 a2247d987ddf48d142de63455183050da48f862a
SHA512 566a2da6f9c470ceb09b08a93831389d39ea96e0870d142af83e65e10d0c7980fab048b40205e1b928c2f2d853120530d92d73cbd9f66855b2cb5ce3af9ab2ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dd250fc36ce2d3938a2e51f5803fbda62137b7a3d370744c508cbe241b440836
MD5 246e8ce24eb7e0d9b5f9ee38a70e5308
SHA1 da3c72eb3db87f072031e905f9a4ead5e85bc90f
SHA512 26b558d9336eee292045656edebdfadd320cc69a5a114fcde25086a75a8839fd08c45b33fcbfe5a0fe46017c1db68feaf8a16e91c8c2f3287541dac504795548
MD5 SHA1 SHA512

Submit Download

svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABBBABBCBCCCCABCBAAABCABCCCCACBCABBCABBBCCAACBCCCCBB.exe
Size 44.4MB
SHA256 8c4e99a8d8193e8c77cf2f3292c9bfda4ba74885d468ad1b193dd2444e9ec00d
MD5 084e889f6218628419b634f995d99d9c
SHA1 5cae330d93bd019164e74479ac588414e1084e55
SHA512 3b1a8e4766a687ebb7420e65c19516c4e11c4c46ebb48e0dc5f99f3417b877eb205809811edbb379bb1031fc85944bbc3e2ade2f32aa7b7f210f1d1cfdf6fd95
SSDEEP 786432:w5S5I525B525S5k5S5I525B525S5k5S5I525B525S5k5S5I525B525S5k5S5I529:3
TLSH
T174A74B18F7D71161FA7756B08CEBD2FA5D317E2087318AAFE608D60A2D32AD0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 440a77c982d1841fc4ac5beaa847e80c2c07cee5d5f070c47da22ecbfa7436f2
MD5 e30bed25f1973235d69bd6e4f254bcb2
SHA1 2a175c63f4e70a2b905ddb533adb36dd2a75d89d
SHA512 a2cf8c7c5b8671fd36eafce36fb59ee1267147a9dad49a83a4eb8edfac1e896572f761d2370709505dddc62bfa46385cfc120825f8976857612a546fd3d97a6c
TLSH
T132110410F4F6DC63F9326CCF532DCED20DE837EBAC986A4823064108AB85C359E190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2240-0-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/2240-8-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/4112-87-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/4828-59-0x00000000029B0000-0x00000000029B1000-memory.dmp

Download

memory/5112-37-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download

memory/5112-27-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download