605e6c69588fd1790b61bfab4b817dde39b20e35e7ffb3c043444ff120b98b11

Analysis

max time kernel
151s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
Size 54.7MB
Sample260819-e9papswhlc
SHA256 605e6c69588fd1790b61bfab4b817dde39b20e35e7ffb3c043444ff120b98b11
MD5 b3c0163629915ef60eb3b53176da1ebe
SHA1 8f91805486c040c736c99d67a3740959b5778720
SHA512 b18ad6cb0bc06e16da58b49facd74152c9a62980ab253c272fa379b2f4812d18d3b297eca4a3f258d9f1569e72d90f1b6e28ed25646b205cddb3b278e2cee823
SSDEEP 786432:Y525B525S5I525B525S5I50525B525S5I525B525S5I50525B525S5I525B525SA:S
TLSH
T1EAC72A18FBD71161F97756B08CEBD2FB5D307E2087318AEFE605D60A2922AE0D439716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3192	svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
4384	svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
6960	svchost_BACACBCAABCCCCBACACAAABBBCCBCCCAAACCACCCAACACBCBCABACBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAABABCCCBBCBCBCAACBABBACAAAABABBCACBAAACCAAAABCBACACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe"	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCBBABBBCAAABACBCCBABABCBCBACCABACABAACBAAAACAAABBCBABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACACBCAABCCCCBACACAAABBBCCBCCCAAACCACCCAACACBCBCABACBA.exe"	svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2508	sc.exe
1280	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4132	cmd.exe
6448	cmd.exe
5052	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACACBCAABCCCCBACACAAABBBCCBCCCAAACCACCCAACACBCBCABACBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3936	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
3936	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
3936	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
3936	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
3192	svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
3192	svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
3192	svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
3192	svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
6960	svchost_BACACBCAABCCCCBACACAAABBBCCBCCCAAACCACCCAACACBCBCABACBA.exe
6960	svchost_BACACBCAABCCCCBACACAAABBBCCBCCCAAACCACCCAACACBCBCABACBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3936	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3192	svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
Token: SeDebugPrivilege	6960	svchost_BACACBCAABCCCCBACACAAABBBCCBCCCAAACCACCCAACACBCBCABACBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 4132	3936	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe	94
PID 4132 wrote to memory of 5872	4132	cmd.exe	96
PID 3936 wrote to memory of 6448	3936	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe	97
PID 3192 wrote to memory of 6704	3192	svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe	99
PID 6448 wrote to memory of 2508	6448	cmd.exe	100
PID 3936 wrote to memory of 5052	3936	2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe	101
PID 5052 wrote to memory of 1280	5052	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_b3c0163629915ef60eb3b53176da1ebe_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBAABBCCBBCACBACABCBCCCCAACABABACACAAABCBAACABCBCBBAACAAACCACBBCAAACBAABCBCCCBABAABACCAAAAABCCACBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBAABBCCBBCACBACABCBCCCCAACABABACACAAABCBAACABCBCBBAACAAACCACBBCAAACBAABCBCCCBABAABACCAAAAABCCACBACBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5872
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCABACACACCACBACAAABABCCACBCAABABCBBABCBCCBCCABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe" start= auto displayName= "UserDataSvc_ACCABACACACCACBACAAABABCCACBCAABABCBBABCBCCBCCABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6448
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCABACACACCACBACAAABABCCACBCAABABCBBABCBCCBCCABBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe" start= auto displayName= "UserDataSvc_ACCABACACACCACBACAAABABCCACBCAABABCBBABCBCCBCCABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2508
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCABACACACCACBACAAABABCCACBCAABABCBBABCBCCBCCABBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5052
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCABACACACCACBACAAABABCCACBCAABABCBBABCBCCBCCABBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1280

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6704

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABBBACCBAAAAACABACACBBCBABABACACABAABABCCBCBCACCBCBABA.exe
1⤵
- Executes dropped EXE
PID:4384

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBCAABCCCCBACACAAABBBCCBCCCAAACCACCCAACACBCBCABACBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACACBCAABCCCCBACACAAABBBCCBCCCAAACCACCCAACACBCBCABACBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 308bc15cdb05cef1f0cfe6010ebe6768a9e3dd5e27f5327ea19a7502223207f3
MD5 d40bad55431e7474b8d9e3552fe762c4
SHA1 d051dbb603ae510863c1961f70d75e9ca77e505c
SHA512 0ae16410b482637ff953611ce50e44a0bfb16413bba28be90e92a8cae2f9e421cf7ba6444e0b2b455c68d77352194d9e3b489570552b668b14ab63e50490f841
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 be64d4ed4699719f782eef6e1237381234b7bd9aa306314c8ed02158d68f6e6d
MD5 5b488d1d6a5e0a13d0651b400e0b6465
SHA1 c4d18436fee30c156d0fb28dded470e540009f75
SHA512 7b5287ea4c02ea53731c6ef08412a6c15ebc942f557c99446bcb952cd66f8f6d647923416dc04a45b6367ff10aeedd04f065916663a173febba5947f6140a5ca
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 305019667ba9e33cbf9add51c68aa756c0f6889b40af042e0a68d21cc0129ebc
MD5 a199c1f273ced1137338f2b76041093c
SHA1 12522190baae12c25afd259d69a42dad959e7aaa
SHA512 ca1a40b00711d4d2ada25c302ca413d165a329867e6fb40ee53222f64dcfa4a60b5ecc10af9ec4dde0ca33500656fdf8272b6351730b2835f1a480255b88d283
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38ba40ad6f8b2a87ebe8cec329a22cb008a07cac1759d89405a8c31a0c370974
MD5 c8f0acc6a9876b5cf8c06f7e0896bb5b
SHA1 81cb9a726d745f2575be943c57b1b17e677b0c9b
SHA512 5b55959f9d97573e24a082af1817ca6fbb1b92bf015ea0621c16a5b6a7b3969e6a3e45c71befbc67082c4b2cce9d0f3f3de8b03f55b95bf7217fe1f4ea937328
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17ffb6e4356c378fa150daf24ccf66b6ebb57c5d680f86b4737dc13d789c06f9
MD5 976c6f4f5143af0158940fad12c06905
SHA1 9cea6de5f6bb6adeecdd7d841fc72b426b79fe76
SHA512 30312cda5296d13b67e8ddd6d790fe8b69028fc0b4d0a18421bbd095b153979280c61d2aa9933a41efcd960518f8a87e8cdf950df8d4a59de4624a6ff031dd04
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7d3188b077c40d538d66314c2d19cd401b6e9802ca9895046510dbe69b3be7c7
MD5 dcd8b36dff64eced4c14f3ad6921251b
SHA1 d8a756ab4adc79da51b7ecdfc8eb31d4b72708a5
SHA512 4e99928800a00b5ab415eebfdc6e6132f062b5e35738361570e197e7672069440d0391d762c5094cb898e8237d7afcec22d14a0e61a8f2250aa0703c4c9e10cb
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 030df8acb8189e7d6c2ebe4d0c63a33c9e7af4ae0aef454d926f2ee89f26cbbc
MD5 5c1032685cb3ca4be8793502485f1ebf
SHA1 0ed2f5706f66411a7715ab5c5373374aa20a9d0b
SHA512 9d8425fa699e5c50a0396e8f54410df4e4d8328a80609caa86858eb4949ea542787bea9c12066dbad3632e00599aec9a23cc772bc9d1580073732f35ee3007bf
TLSH
T1EC113A11A8F5C867FC3328CFA22D9F939CE0339F6C5CAA14220863197784C71CD198D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3192-72-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/3192-33-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/3192-51-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/3936-60-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3936-0-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3936-86-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3936-34-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3936-22-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/3936-11-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/4384-87-0x0000000000770000-0x0000000000791000-memory.dmp

Download

memory/6960-103-0x00000000008C0000-0x00000000008E1000-memory.dmp

Download