605e6c69588fd1790b61bfab4b817dde39b20e35e7ffb3c043444ff120b98b11

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
Size 54.7MB
Sample260819-e9papswhlc
SHA256 605e6c69588fd1790b61bfab4b817dde39b20e35e7ffb3c043444ff120b98b11
MD5 b3c0163629915ef60eb3b53176da1ebe
SHA1 8f91805486c040c736c99d67a3740959b5778720
SHA512 b18ad6cb0bc06e16da58b49facd74152c9a62980ab253c272fa379b2f4812d18d3b297eca4a3f258d9f1569e72d90f1b6e28ed25646b205cddb3b278e2cee823
SSDEEP 786432:Y525B525S5I525B525S5I50525B525S5I525B525S5I50525B525S5I525B525SA:S
TLSH
T1EAC72A18FBD71161F97756B08CEBD2FB5D307E2087318AEFE605D60A2922AE0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4824	svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe
2732	svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe
3348	svchost_CABAACAABCBABACBACAACBCBCACAABACCCBACCBABBABACAABCBACCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBABCCACAABCCCCBCAAAAACCCBCCCBAACCCCCCBBBCACAABACCBCBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe"	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCBBBCCABCBBCBABACACCCABBBBCAABBBBCBCABCACACBAABBBABABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAACAABCBABACBACAACBCBCACAABACCCBACCBABBABACAABCBACCA.exe"	svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4192	sc.exe
540	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3412	cmd.exe
3288	cmd.exe
3028	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAACAABCBABACBACAACBCBCACAABACCCBACCBABBABACAABCBACCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4308	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
4308	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
4308	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
4308	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
4824	svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe
4824	svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe
4824	svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe
4824	svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4308	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4824	svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4760	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 3412	4308	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe	103
PID 3412 wrote to memory of 4556	3412	cmd.exe	105
PID 4824 wrote to memory of 3524	4824	svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe	108
PID 3524 wrote to memory of 4292	3524	notepad.exe	109
PID 4308 wrote to memory of 3288	4308	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe	111
PID 3288 wrote to memory of 4192	3288	cmd.exe	113
PID 4308 wrote to memory of 3028	4308	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe	114
PID 3028 wrote to memory of 540	3028	cmd.exe	116

C:\Users\Admin\AppData\Local\Temp\2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBBACCBAAACACCACACBACCABBCCBBBBBBCBBBABBAABACABBAAABCBCBABCCABBBBACBABBBACCBABBCCABBAACABBBABCBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3412
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAACCBBACCBAAACACCACACBACCABBCCBBBBBBCBBBABBAABACABBAAABCBCBABCCABBBBACBABBBACCBABBCCABBAACABBBABCBCABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBBCCAACCCAABBACBBCCCBCCCBCCBBBBBABBBABBABCCACABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe" start= auto displayName= "UserDataSvc_CCBBCCAACCCAABBACBBCCCBCCCBCCBBBBBABBBABBABCCACABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3288
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBBCCAACCCAABBACBBCCCBCCCBCCBBBBBABBBABBABCCACABBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe" start= auto displayName= "UserDataSvc_CCBBCCAACCCAABBACBBCCCBCCCBCCBBBBBABBBABBABCCACABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBBCCAACCCAABBACBBCCCBCCCBCCBBBBBABBBABBABCCACABBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3028
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBBCCAACCCAABBACBBCCCBCCCBCCBBBBBABBBABBABCCACABBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:540

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4824
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3524
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4292

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4760

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCAABACAABBAACBBCBCCAACCBCACABAAABACBBABABABCCCABCCABBC.exe
1⤵
- Executes dropped EXE
PID:2732

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACAABCBABACBACAACBCBCACAABACCCBACCBABBABACAABCBACCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACAABCBABACBACAACBCBCACAABACCCBACCBABBABACAABCBACCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7f3ddddfb35ab6235028f25f2fde56ceff4063320d930cd5d55bd9f07480f79a
MD5 2208dc7b83f4dd3acb70d87d40f5afbe
SHA1 5be00e6fbdd22aa2f499a1351d32ea7682792bb3
SHA512 dd89a8901ff636a8018bfc2be8a1ddd208d0c8856ba1413c5cad6acdbe4b7ea24ebdc31bf215a1c3d2de06f9c968ddfcd24a95485c1364bcbea7a347442a6ca8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9abda757310c8adcafc13b10ab4e38b682491927b91610f8e562276266169d4c
MD5 c1d04d6f37569654328c6cac1e9b6386
SHA1 07c1ccfffeddf864b294230a9e14931f45007d8a
SHA512 1eb591dfc6342955da4c14882413b6f5e9b9f1fc1ec62b5e956f64e191aa590c73fde0ae9b650557c5c5d1a618e84b948ebd98aa7dbec1a59b7b29c759aa7095
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c962caee8828620baf3c54fc794bec4074ff5e0fdf3266bed7296b47f3964536
MD5 b0708c9524ccdda0138a726f0a388ca6
SHA1 acbc1c572e9572f65887ac0da4e202c6d3be4242
SHA512 110f3982bfed8d8419b272b02e5210c9f2d4c6dca28250ab5e900675ca93041e6e684085e90d304e8cb93d23e63736cd112f99106c08e6360949c66d0720fc4a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4339721bd57b6eda445ca289af57c780687895f24dc3e7a5a289e229d0650d2f
MD5 4f1bee2afb906e6440d338236011a205
SHA1 8ef691cf89a7c9322cf6aabc8705ff7e532f9524
SHA512 9307867009acbbac81f37f04dfbfa206a64da2f8b9e86ad4346cc81b10dc84b90caa5589f7ae644b51b40eb7e6c3d8c635280e6b0bc4ce6bf49ac45384b750de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7d3188b077c40d538d66314c2d19cd401b6e9802ca9895046510dbe69b3be7c7
MD5 dcd8b36dff64eced4c14f3ad6921251b
SHA1 d8a756ab4adc79da51b7ecdfc8eb31d4b72708a5
SHA512 4e99928800a00b5ab415eebfdc6e6132f062b5e35738361570e197e7672069440d0391d762c5094cb898e8237d7afcec22d14a0e61a8f2250aa0703c4c9e10cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1e5c3a029d48a0fc91c05e12bfc4c98ed23bf08596476fae29ed454554af069b
MD5 d50681b6a2b429b51e9afe0fb07b4f7a
SHA1 eeace4f435145900d9e4d8ab8b95e4431cd7059a
SHA512 a9dfc49087bd3a125f993e048f7a10880bdfbb35d6d6c05f642f9aae6e772e22f0b8238cfd2ad1818a02379bcf4640ffd88e7ed10dc59fae4b5a43c06e81dea9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 901cc9ddade1c9cabb26c6fa6b197d9f3b381c73a4611954c81a7a45dd6f6f74
MD5 f9eb5239c27bd2dfc4bbde14469c3f9e
SHA1 fc0157299862ae9dc76d301884b0de920a9c921e
SHA512 633f0d99e69fd413287691256d75ff23c280f4c1a3aa4ae81171c6e0bf2e1cb4b4b092821022c556c9c6f27ab52253c4e7830beeb431a2ae6114bfa6ab069e04
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 364d8c0a421bdc07280cb24fea371e4866e0dfa1731c0201336cf6a71cdc2324
MD5 5c9eb217b8e98bd31f767670db474966
SHA1 e252562f542572db9f05528b7eb6664cdb0953ad
SHA512 840232fc48abbd7e4997fb73085e3cf6bdda63fea05fc03b0f37b4b0d50a44cfd388121499b07bb619c79d66f07a4ea2c2e8920d4ac0dc83d6d6e5e8c85a7920
MD5 SHA1 SHA512

Submit Download

memory/2732-96-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/3348-97-0x00000000003C0000-0x00000000003E1000-memory.dmp

Download

memory/3524-79-0x0000000005140000-0x0000000005141000-memory.dmp

Download

memory/4308-0-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4308-94-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4308-37-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4308-63-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4308-24-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4308-11-0x0000000000CC0000-0x0000000000CE1000-memory.dmp

Download

memory/4824-77-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/4824-31-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/4824-54-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download