51d9681fdc509f32d33d4e43d4b820d12763b6f9b097648a8b7d95343a22c5b2

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 02:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe
Size 21.5MB
Sample260819-ch8txswzay
SHA256 51d9681fdc509f32d33d4e43d4b820d12763b6f9b097648a8b7d95343a22c5b2
MD5 248868653f857fbc2d439eca375ec2bf
SHA1 70cf717e74af4f9d4c92e2dcd2cd8dd75f005ad8
SHA512 3fb3905b861328823198563cce74362263b54073ee5598e44d69834b5c7f13fb581e319abecc0be5352dd4093885bab8beec3c9d287bad31a53261766e92a342
SSDEEP 393216:+O4q78Uhas2O4q78Uhas2O4q78Uhas2O4q78Uhas2O4q78Uhas2O4q78Uhas2O4W:1hasthasthasthasthasthasthasthaU
TLSH
T139372B2C7DEC45A5E4B39635C9A195D9EA7278526B208FCF11D1431E0E3BBD2AC30F29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2432	svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACCCAABAACBAABCBCBACCBCACBBCBCACBCBACCAABAAAABBABCBCBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe"	2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5464	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2572	cmd.exe
828	cmd.exe
3852	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4536	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3616	2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe
3616	2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe
3616	2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe
3616	2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe
2432	svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe
2432	svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3616	2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2432	svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3616 wrote to memory of 2572	3616	2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe	96
PID 2572 wrote to memory of 4536	2572	cmd.exe	98
PID 3616 wrote to memory of 828	3616	2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe	101
PID 828 wrote to memory of 5464	828	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_248868653f857fbc2d439eca375ec2bf_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3616
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCCBBAAACBAACBCBACABABCACCABBCBBBAABCACCAABAAAAACBABAACBCBCCAAABCBAACBABACAABABAABCCACBACCBACABBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCCCCBBAAACBAACBCBACABABCACCABBCBBBAABCACCAABAAAAACBABAACBCBCCAAABCBAACBABACAABABAABCCACBACCBACABBCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4536
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACCACACBBBCBBCBABBACCBCABAABBBACABBBCCCAAAACACBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe" start= auto displayName= "UserDataSvc_BACCACACBBBCBBCBABBACCBCABAABBBACABBBCCCAAAACACBABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACCACACBBBCBBCBABBACCBCABAABBBACABBBCCCAAAACACBABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe" start= auto displayName= "UserDataSvc_BACCACACBBBCBBCBABBACCBCABAABBBACABBBCCCAAAACACBABB"
    3⤵
    - Launches sc.exe
    PID:5464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACCACACBBBCBBCBABBACCBCABAABBBACABBBCCCAAAACACBABB"
  2⤵
  - Executes a command shell one-liner
  PID:3852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 43.4MB
SHA256 30f534f65a15f86cd8b626a70506c1e8df2311777f7dc0c4dc0bba0c775328d6
MD5 a5bc017b6c749b666e266f36ebcfc12b
SHA1 8e17b6a384677b9fc1515651ba7ac8d6c0425dff
SHA512 09cc3957915c42baa0c81489f8256eb97e5759079a54578b1cf0e1ee775c12cae339d08f2aa9d16d2ce3b6d0bb874c343a96fa6c1b5dc512aba9e6d5c664fd62
SSDEEP 786432:1hasthasthasthasthasthasthasthasjhasthasthasthasthasthasthastha0:T
TLSH
T1EFA72B2C7DEC45A5E4B39635C9A195D9EA7278526B208FCF11D1431E0E3BBD2AC30F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 53a2dc5a52bc4fb5de2a0a7882bd140d30a700551d4314b3b2d6c853447383c0
MD5 b981bb4af3f17408cd1fc02c4275d201
SHA1 6152100ba7a03d91222573379d466fd40051beb5
SHA512 a14ff1c52654ca63a1b761c336efa9c911b13cc72ad07000334c6554433304dfc9f35df326a49c71aa999b5506c95136469c6d862ba2e0147cde235d0cbc6a21
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 900571bd0323aa196218425d927f83220d88c2d938e2b8093862775b41419b0b
MD5 5277f9dbd1477e61eb8b91c9630858cf
SHA1 593a3290336537d6e5d96c0a82fa2d6d3af757f5
SHA512 0d84e453f9a0bc5fd5421134679645b7155a12f745734b8fa65453af32457df1029161c9f3c346670f599572345065419e478a74953a1b1d8c0a2f4ea9a5a469
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1adb3b08d1f125e2a5e8d06ab0bcf24c20ff25baf76d33d8a8b28aad7814ec25
MD5 2ad74808824f99ad4abbac7832dfff0f
SHA1 3dbf9479b3c4e1fd0de484882f1be87e1bd298c8
SHA512 5c79bd2a7897fbc5d1c94984c38a26b0ab820c5b9dc88aec89aa45e2c60cbedf13f248b8fcec9073a453d89ed43c55eae7e8145ec51f3b9c186caf38d2864d1c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 85c92b62107dfb3e488df5351fc697f59071cd703ba9ba7dc5464d88ff05fe81
MD5 e1de28a4325dcde2d2d8eb1cbdaf2e52
SHA1 4ee6a380cba999f52d9977af9d2a530fc5601d3e
SHA512 7c3e55bb83a85505ca46fc86c93d109154a40b6f65046c78e25141ebdc635923abef96cb3e0c57d6b2e7acdae69fc1cc584d240cc746e64e1ddf8ed6a65a2299
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 05ae591764103803ee17651218b10a5f7d9b20dfe7e284403a050823c4b2732d
MD5 0bc9f23c33d070f07816da0930e6efda
SHA1 5359dbe1b2d0ff0288b3177e399c336d5ef99cde
SHA512 130ab6b3b63824eee72712b49e7bacc8db4de9ab8a6418a48ee9c20f1158e3b7294526c8a80c182cbf634455a27699d5e562d2424acc4dcc7d36ec9199606346
MD5 SHA1 SHA512

Submit Download

svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAAAABCAACBCAACBAACAABBACBBBCACBBBBABBACCABACAABBCABBCA.exe
Size 21.5MB
SHA256 51d9681fdc509f32d33d4e43d4b820d12763b6f9b097648a8b7d95343a22c5b2
MD5 248868653f857fbc2d439eca375ec2bf
SHA1 70cf717e74af4f9d4c92e2dcd2cd8dd75f005ad8
SHA512 3fb3905b861328823198563cce74362263b54073ee5598e44d69834b5c7f13fb581e319abecc0be5352dd4093885bab8beec3c9d287bad31a53261766e92a342
SSDEEP 393216:+O4q78Uhas2O4q78Uhas2O4q78Uhas2O4q78Uhas2O4q78Uhas2O4q78Uhas2O4W:1hasthasthasthasthasthasthasthaU
TLSH
T139372B2C7DEC45A5E4B39635C9A195D9EA7278526B208FCF11D1431E0E3BBD2AC30F29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2432-45-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/2432-68-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/2432-93-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/3616-44-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/3616-0-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/3616-72-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/3616-79-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/3616-30-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/3616-16-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download