5d57b12a2b8ec5ac4b1fd5b79359f6b94854a55fd21d18e8b9785e6576a589bc

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 13:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe
Size 8.1MB
Sample260818-qdpgdahe27
SHA256 5d57b12a2b8ec5ac4b1fd5b79359f6b94854a55fd21d18e8b9785e6576a589bc
MD5 1835e4dcd3a46860f2819fc89f97d39f
SHA1 4e2b7b08d14331e2fa65b506a1016eb6c77c9a5f
SHA512 6836aa9c36e17e8c62b5d12a07b96f81d61848dbc85582b22e94d5ba1f48e9cf7c74e5ce962cdb1fbf5f56a98555f8de44e55329af64225158a1f519ca44d904
SSDEEP 49152:U+EPiw2j+EPiw2gU+EPiw2j+EPiw2gU+EPiw2j+EPiw2gU+EPiw2j+EPiw2gU+Ez:+
TLSH
T109862A0977ED4854F4B7B23489B68669D6B2BC915B31C6DF6280833D0E73BD0AD34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1856	svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
4984	svchost_CACCABABABCCCCACABCACAABAACCBACCBCBBBBBAABCABAAABCBABCB.exe
4976	svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCCABBABABABBBCCCAABACBBBAAACCCCBBBBABACBACCACCBCACBABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe"	2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBBAACBAACCACCCCBABBCCBBAAAABBCCCBBCCABCCCBCACBCBAAACBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCABABABCCCCACABCACAABAACCBACCBCBBBBBAABCABAAABCBABCB.exe"	svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5756	sc.exe
4780	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
400	cmd.exe
3416	cmd.exe
3180	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCABABABCCCCACABCACAABAACCBACCBCBBBBBAABCABAAABCBABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2728	2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe
2728	2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe
2728	2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe
2728	2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe
1856	svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
1856	svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
1856	svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
1856	svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
4984	svchost_CACCABABABCCCCACABCACAABAACCBACCBCBBBBBAABCABAAABCBABCB.exe
4984	svchost_CACCABABABCCCCACABCACAABAACCBACCBCBBBBBAABCABAAABCBABCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2728	2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1856	svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
Token: SeDebugPrivilege	4984	svchost_CACCABABABCCCCACABCACAABAACCBACCBCBBBBBAABCABAAABCBABCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 400	2728	2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe	91
PID 400 wrote to memory of 4828	400	cmd.exe	93
PID 1856 wrote to memory of 2832	1856	svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe	94
PID 2728 wrote to memory of 3416	2728	2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe	97
PID 3416 wrote to memory of 5756	3416	cmd.exe	99
PID 2728 wrote to memory of 3180	2728	2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe	100
PID 3180 wrote to memory of 4780	3180	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_1835e4dcd3a46860f2819fc89f97d39f_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBACCBBACAACBAACAAACBCABACCBAAABAACBCBCBBCBCBCBAACCACACCBBAACABCBCCCCABCACCACACCBABCAAACAAAACBCCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:400
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBBCBACCBBACAACBAACAAACBCABACCBAAABAACBCBCBBCBCBCBAACCACACCBBAACABCBCCCCABCACCACACCBABCAAACAAAACBCCAACB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCBACACCABABABAABBABCCCCACCACBCACBBAAACBCCBBCACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe" start= auto displayName= "UserDataSvc_CCCBACACCABABABAABBABCCCCACCACBCACBBAAACBCCBBCACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCBACACCABABABAABBABCCCCACCACBCACBBAAACBCCBBCACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe" start= auto displayName= "UserDataSvc_CCCBACACCABABABAABBABCCCCACCACBCACBBAAACBCCBBCACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5756
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCBACACCABABABAABBABCCCCACCACBCACBBAAACBCCBBCACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCBACACCABABABAABBABCCCCACCACBCACBBAAACBCCBBCACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4780

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABABABCCCCACABCACAABAACCBACCBCBBBBBAABCABAAABCBABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCABABABCCCCACABCACAABAACCBACCBCBBBBBAABCABAAABCBABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
1⤵
- Executes dropped EXE
PID:4976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 436f04a198ef1a713506afee528a9422a96e31ae0dc2ca1602deef68cd997537
MD5 f6e9f67fac3e571161b809292c3070e2
SHA1 4898c1453ee71550b5043f5fdd4f1f0249953bc1
SHA512 17e868c6f5c0b703593c48ead52299342f3ba3afc4202f3cba0bc82e8e0ad43562205b74a39309934cac973c19a0ac426febe3323782ab0d63211b25907fd8f9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1fd36c37a91a8b5a287fdb562e36adaa22298262ecbee18c33f38e055e2b3b6a
MD5 7184c2bddbd67a1fecb08410ad480200
SHA1 104927eb8fb9d6471b118b0f11c858730bf59f90
SHA512 2f35c32dd039982d0f0d2c3f6a1f15541b186e4e4ce5faccbbbb1ab68c0622b44819ae714576224c01aa98cc9a406b367d62f9f3550aa1592bfbe2154a7f5522
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 15692b37586b79663e2ed6ee2066f43a1db5c8c4f26bc17f82ba2b56a044d5e1
MD5 3b4016ceed32d234641531c9aa3ae0ac
SHA1 d19a2f588cc5a3a5de83162343ed633b49391b44
SHA512 34569d063302a19ce352dc78c24de36a8c79402f0dcb727b742c4333bf9215d38b6133ab2ecffb84672e7d1fe8346fb326d23f5af0d3f18cc480cc486f8f3ea4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3d644d3c488d8fc98f99697ac9f261c13e741815ab69bff3462f30309aeeb848
MD5 e0a3492a13d5d6fa33c4f4ee258f33d8
SHA1 cd123b17f812cb19fc6afdc20d8d0ef52c19a788
SHA512 51e08fb87a881e85f25d16953b39f1de14a28ff36a9f5dfd4941bdf4c70d3c3cfce33bfcb47d669ab8659fce108af34156924f4f5964f757deaa7c38e9793eff
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5576b8974372b59b619800c19443235be7197eb96c0d204f8726547fcf4b23ee
MD5 59aa8a99c7ad73c8d96e3d39deaf2f88
SHA1 9f6c4ec918d711657838d776921695f7c1cf5e98
SHA512 3424438d8df3e9815383bb9f496263c7b89607207cba623082d7f3e99a0a987b129ef3dafb8c7320626aee38372e668c47fc416e9efa4911131ddf0a79ce9b67
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e93a7954d31a1bd5666c7607021059dd6eea2523b18a3676aed64a09300e4db8
MD5 62d1bf6efa135d0f635ba70b9e466ce3
SHA1 a7a1cbf54278782258189416bffc3c0948cebacf
SHA512 d668f1a7d13843fc5c56e27ca2a29ac7066e6846dc7ab383936a046a956c87a9ce1282baed8ac755df3859628b92f1b371b8b882ed7fecd3452be6006749d212
MD5 SHA1 SHA512

Submit Download

svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACAAACBCBBACCCABBBBACBCCBCCABBAAACCAACCABBACCBACCACBBA.exe
Size 8.1MB
SHA256 5d57b12a2b8ec5ac4b1fd5b79359f6b94854a55fd21d18e8b9785e6576a589bc
MD5 1835e4dcd3a46860f2819fc89f97d39f
SHA1 4e2b7b08d14331e2fa65b506a1016eb6c77c9a5f
SHA512 6836aa9c36e17e8c62b5d12a07b96f81d61848dbc85582b22e94d5ba1f48e9cf7c74e5ce962cdb1fbf5f56a98555f8de44e55329af64225158a1f519ca44d904
SSDEEP 49152:U+EPiw2j+EPiw2gU+EPiw2j+EPiw2gU+EPiw2j+EPiw2gU+EPiw2j+EPiw2gU+Ez:+
TLSH
T109862A0977ED4854F4B7B23489B68669D6B2BC915B31C6DF6280833D0E73BD0AD34B26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1efe1b038775846c35249ac02bdf302ec1e76f96f0187276858cb136881262af
MD5 34ab88041056fbc9fd2cc767abbb82b1
SHA1 f411f72f1be11aad27e0da850a2dea14282df9da
SHA512 933bc221adcbe3cdf29f6bcde7b1dc04e2cbd41e6bc696c5312a17a3e9eadd66ecc121483f754891f45d7ef5d557744b5ce945c72a4130f6eb5d3d6f8118fbd9
TLSH
T13611A750E8E5DC63E9322C8B523DDBC38CA9768F9C686A19B3150219A3E9C35CE150F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1856-33-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/1856-23-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/2728-7-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2728-0-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/4984-79-0x0000000000060000-0x0000000000081000-memory.dmp

Download