972f68be43bb6ab229b3a0d4f685ff4de994419ca8d2f646c33bd7545ba597d6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe
Size 32.9MB
Sample260819-e34f2sythw
SHA256 972f68be43bb6ab229b3a0d4f685ff4de994419ca8d2f646c33bd7545ba597d6
MD5 c1c0613bc2f685baccd3c0fdeeb32e3f
SHA1 d7016f8c7e3ba687bae58cde1efb8f3c54b9f3f4
SHA512 d7b6a0f9a824beaf844a173702e657f55852d56d6ca212c4d5cf65e83660a01910278839a0490afcc7a6bfe3fae312f6d07f6b6393b37e7302108a92e5e0d730
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+EOM+ES+ES+3:M
TLSH
T1FC772B09F94740B1D92B51B04CCBD3BF8A70BB2587128EFBF64DCB1B6923BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2664	svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe
2540	svchost_ACCCBCABCCCAAACBCCCCACABABCABBAACBCACCBAAACBABBABABBAAB.exe
4488	svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BABBAABBAACBBBCCCCBCCCABBBCAAABACBBABCBBBBBCCABCBBACBCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe"	2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AAAACCCBCCCBCBCCACACBCCBBBBAABBABBCCABBAAABCCBCCBABBABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCBCABCCCAAACBCCCCACABABCABBAACBCACCBAAACBABBABABBAAB.exe"	svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
440	sc.exe
4196	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1860	cmd.exe
2172	cmd.exe
4380	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCBCABCCCAAACBCCCCACABABCABBAACBCACCBAAACBABBABABBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2280	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3056	2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe
3056	2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe
3056	2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe
3056	2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe
2664	svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe
2664	svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe
2664	svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe
2664	svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2664	svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2180	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 1860	3056	2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe	108
PID 1860 wrote to memory of 2280	1860	cmd.exe	110
PID 2664 wrote to memory of 4492	2664	svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe	111
PID 4492 wrote to memory of 2112	4492	notepad.exe	112
PID 3056 wrote to memory of 2172	3056	2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe	116
PID 2172 wrote to memory of 440	2172	cmd.exe	118
PID 3056 wrote to memory of 4380	3056	2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe	119
PID 4380 wrote to memory of 4196	4380	cmd.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_c1c0613bc2f685baccd3c0fdeeb32e3f_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBCACCABCCBCBABCAABACBABBCAACABABBACBBACAACBBBBACBAABAAACAABBCCABABAABABBACACAACABBBCBAAAABBCCBBCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BAABBCACCABCCBCBABCAABACBABBCAACABABBACBBACAACBBBBACBAABAAACAABBCCABABAABABBACACAACABBBCBAAAABBCCBBCCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2280
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBACACCBACCBCCCCCCABAAABCCBABBCAACAAACBBCBBBCCCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe" start= auto displayName= "UserDataSvc_BCBACACCBACCBCCCCCCABAAABCCBABBCAACAAACBBCBBBCCCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBACACCBACCBCCCCCCABAAABCCBABBCAACAAACBBCBBBCCCACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe" start= auto displayName= "UserDataSvc_BCBACACCBACCBCCCCCCABAAABCCBABBCAACAAACBBCBBBCCCACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBACACCBACCBCCCCCCABAAABCCBABBCAACAAACBBCBBBCCCACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4380
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBACACCBACCBCCCCCCABAAABCCBABBCAACAAACBBCBBBCCCACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4196

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4492
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2112

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2180

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCABCCCAAACBCCCCACABABCABBAACBCACCBAAACBABBABABBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBCABCCCAAACBCCCCACABABCABBAACBCACCBAAACBABBABABBAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe
1⤵
- Executes dropped EXE
PID:4488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 10e46dcab7767791b502edad941675edb2954ec108699216432c452eca38602c
MD5 9a78e3db2ebb0552b0c2b41bcb6617d9
SHA1 f5795aee3d489140103b0a8a086fad9297bc5bff
SHA512 2c3f359fd69e005a74984988a49519c1c39334702877c3c5ee92fe7ac34964377286301f0b70c12128452038f288b25f861ee4b8d01a2022886f7fae99f3cb23
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cfb36f47f3e737b1afebabf031666d3e83f44b27d7df967da9798f59aeb27294
MD5 67dee603ab29e766079b72baf1c8c1e6
SHA1 ebc933880b9916fa7a9375f3b24fab45f7a5674f
SHA512 07593a39cb02e98c3572e3ed1213acbecb3de5c75cde6b206a802b5a1a40a3faa60c2d391ae9f9f0fef8e7a315ded4a349f042674bf2c38117dd58ab87542232
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a253df4c3aec2b0e4a03abd4ed2f09ba5f48e9a2f3a22caaec94b2f23dd71f49
MD5 36d11080ea5213f3c7dbb175ba2270d0
SHA1 0ba5eb6507e73b480ce0097806f99163b3babd7b
SHA512 ba1d21e20bebfd18815b37a770271ee9fa0d170dd3e61a96ad14ab8ffb738599e936e9e20144fcfae666bfefe2a103f85cc397c7a81d5955e5bac1c00283def4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 17768ce6068d02548d14f0f6bfcd9f4343827fc84d58545c480a26338db1b21e
MD5 6a4c216c7832e0aec0c81d99c2ce190f
SHA1 6bd6a422490ef299e06d3cb56249ced0b3277db5
SHA512 479dd4c925b22807a366aa30719fa5aeb74c71c373419917414723d61aebca47e808b5f0822e2a1ee589cc088ff88dd85de85ed26748c954695360af64af6201
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 000c5b2e008bb0a4e90cb019e0a6330d896bb0482b66e279f07592ba50b421cf
MD5 8937f2dbf947df16589b37dabcd86dfe
SHA1 f1a8f44e1cfa75d1ad27356a2a54273c40bc24b1
SHA512 c8b0abb757d81d889a6ad1241eeb8ccaecf439443a7d48bedd076a52adf1a419517b1bc9bfae73f630da8fde17df9c837a9ab7745db889d824c414b793bd69a2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8540416593edacbd29283b73aebf315c0f26fbc69910f776e5b010b8493eaa0e
MD5 92028da85fea80fdb61729241cbf2906
SHA1 c7fb42fa66992d2a23058478700aabce9a1e2fa1
SHA512 0d4836e0192680e17b1e0d3cf1d4d39554b45fb44295d5ed4e4c1efb24490edeb87816a547c19d6bb048b8ea282ad0eecb220a38268ffbadb7dfc1cd381228d3
MD5 SHA1 SHA512

Submit Download

svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCBBBCBBBACCBBCBACBBACCAACCACCBBBBBBBBABBBABCACCBAC.exe
Size 32.9MB
SHA256 972f68be43bb6ab229b3a0d4f685ff4de994419ca8d2f646c33bd7545ba597d6
MD5 c1c0613bc2f685baccd3c0fdeeb32e3f
SHA1 d7016f8c7e3ba687bae58cde1efb8f3c54b9f3f4
SHA512 d7b6a0f9a824beaf844a173702e657f55852d56d6ca212c4d5cf65e83660a01910278839a0490afcc7a6bfe3fae312f6d07f6b6393b37e7302108a92e5e0d730
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+EOM+ES+ES+3:M
TLSH
T1FC772B09F94740B1D92B51B04CCBD3BF8A70BB2587128EFBF64DCB1B6923BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2540-73-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/2664-37-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/3056-0-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/3056-8-0x0000000000FB0000-0x0000000000FD1000-memory.dmp

Download

memory/4492-60-0x0000000002C70000-0x0000000002C71000-memory.dmp

Download