ab2c0546cfc6af3f05be80e9b81ccda52f3ff722af5af4d099aa2a3fe932d469

Analysis

max time kernel
148s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe
Size 21.4MB
Sample260826-dn8xjsgk21
SHA256 ab2c0546cfc6af3f05be80e9b81ccda52f3ff722af5af4d099aa2a3fe932d469
MD5 ef1d246c6bfa1150def9f9e3453f369c
SHA1 fe7f941adb7654666d2fe0b42297598de9a48c65
SHA512 633ad3a59c96af32e61f7e4f520e626f93002e45a711a9c332c6cd382013ade5e26efcab2d316354385b49698d00cce7ca1aec0c35a2df9b30556b97547bf747
SSDEEP 98304:WK7K7K7K7K7K7K7K777K7K7K7K7K7K7K7K7J7pt:u
TLSH
T12B371909F98344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75F6933B916428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1800	svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
1140	svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
3564	svchost_CBCBACCCCCAAABCACCCBABBABBBAACAABABCCBAABABACBBCCACACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CAABCBBCABABBBCACCCAAAABAACCCCACBBACBBACCBAABABCABAABCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe"	2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBBACBBAABCBBCCCAABBABAACAAACABCCCBAACABACACCCCBABAACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBACCCCCAAABCACCCBABBABBBAACAABABCCBAABABACBBCCACACAB.exe"	svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1824	sc.exe
3756	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
692	cmd.exe
544	cmd.exe
1756	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBACCCCCAAABCACCCBABBABBBAACAABABCCBAABABACBBCCACACAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2320	2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe
2320	2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe
2320	2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe
2320	2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe
1800	svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
1800	svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
1800	svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
1800	svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2320	2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe
Token: SeDebugPrivilege	1800	svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2360	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 692	2320	2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe	97
PID 692 wrote to memory of 892	692	cmd.exe	99
PID 1800 wrote to memory of 2516	1800	svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe	100
PID 2516 wrote to memory of 3028	2516	notepad.exe	101
PID 2320 wrote to memory of 544	2320	2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe	103
PID 544 wrote to memory of 1824	544	cmd.exe	105
PID 2320 wrote to memory of 1756	2320	2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe	106
PID 1756 wrote to memory of 3756	1756	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_ef1d246c6bfa1150def9f9e3453f369c_elex_hawkeye_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCACBCABABACBCAAACAABCCCABCABBBABAACBCCCBCBCBBBCABABBBBBBCBABCBCBAAACCBCACABCCBBABCCACACAAABAABBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCCCACBCABABACBCAAACAABCCCABCABBBABAACBCCCBCBCBBBCABABBBBBBCBABCBCBAAACCBCACABCCBBABCCACACAAABAABBBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACABACCABAACAAAABCAACAACABCACCBBCCCACACCBCBBBCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe" start= auto displayName= "UserDataSvc_CACABACCABAACAAAABCAACAACABCACCBBCCCACACCBCBBBCBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACABACCABAACAAAABCAACAACABCACCBBCCCACACCBCBBBCBCBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe" start= auto displayName= "UserDataSvc_CACABACCABAACAAAABCAACAACABCACCBBCCCACACCBCBBBCBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACABACCABAACAAAABCAACAACABCACCBBCCCACACCBCBBBCBCBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1756
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACABACCABAACAAAABCAACAACABCACCBBCCCACACCBCBBBCBCBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1800
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3028

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2360

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
1⤵
- Executes dropped EXE
PID:1140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACCCCCAAABCACCCBABBABBBAACAABABCCBAABABACBBCCACACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBACCCCCAAABCACCCBABBABBBAACAABABCCBAABABACBBCCACACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1b12072c8bf722c3ec21e442a90f3810db47669413b4ff39accc08ef8d1f0611
MD5 f349be0c2325320bcfcf0049924047d6
SHA1 3ca23e3f3c40df07e37d8474978c73f2a9396556
SHA512 c2b5a5fe4d8092455ee31cbc44a813eca4b3134c204b5f18a62788960d5b2644a941a1b9b7ffa8ddfeec0fc487aea1351da4174352a7284112f5aa116c31e0f0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 19ef9de8ddbbf5bd2e8ba0d0d87aab07511fc48f3ec47aa1b8be3b1f92156e7d
MD5 e3386dc6c9b72d2186bf65ad586d425e
SHA1 dbcecafcc6012e541a16f8800c2c5bcde2563728
SHA512 1ef1295c59a6cbd01f5f1b9ad2b7b9b27cd2eddeef696b449c301a039cadf5d4dfb138f620f23c2e31ad657ce586005c49691fd66f1a2cc5ae9a1f8f6065c118
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99f6f9c83ca7ce0d4840cd2a5c28e4414b9f0e9e243c8c9c755909a0b456fac2
MD5 a6c083dfab615f279ee880ca1b88dc8b
SHA1 772e594a34852cd5297eb837f6a5d8d77c7a4a3b
SHA512 b5c94eb880ebc00a03423a22ab5aba3b7b17bc74a8837b2a976501f22a0e85af6befc54b064c638b1c132679d744082d57d6a9249e187ae31d32433b33489898
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 075ff510b7f138c7b130585554725192eac272140a953d4824c3cf8e0f285606
MD5 adfd03afb5a93c9874c495b97ff94b29
SHA1 897a8f8f800ca90ab76460b72efa53dbc93875c0
SHA512 51069e9a99064ce1cee203f7b817419374f9733df09990835275d1be2183b9ecbf6d9a8d2b429ac4e782282e531e45d152c5fc8c13189b1c69c40ffe984c4d9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b1796490921467558484b165fc8aa4835f3fbc0c1fcc62c95b9f1c70080951cb
MD5 784613c17bae93f880b7a974abdbc0a3
SHA1 6298c6199ef8b6fd90b90342fd27e8d28437a61b
SHA512 56d77c9bcbf031ad66d36edba9302e68971cf20913cc90fbadd62200642104ef9230494bccd193a126dce407dc3770f03fdebd42cfb50fe7017856f7990625e9
MD5 SHA1 SHA512

Submit Download

svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBCAABBBAAABACACCCCABAAACBBCBABCAACAACAACCCACBACCBCACC.exe
Size 21.4MB
SHA256 ab2c0546cfc6af3f05be80e9b81ccda52f3ff722af5af4d099aa2a3fe932d469
MD5 ef1d246c6bfa1150def9f9e3453f369c
SHA1 fe7f941adb7654666d2fe0b42297598de9a48c65
SHA512 633ad3a59c96af32e61f7e4f520e626f93002e45a711a9c332c6cd382013ade5e26efcab2d316354385b49698d00cce7ca1aec0c35a2df9b30556b97547bf747
SSDEEP 98304:WK7K7K7K7K7K7K7K777K7K7K7K7K7K7K7K7J7pt:u
TLSH
T12B371909F98344B1D92B11B04CCBD3BF8A70BE218B128EEBF64DD75F6933B916428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1140-75-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/1800-26-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/1800-39-0x00000000008E0000-0x0000000000901000-memory.dmp

Download

memory/2320-7-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/2320-0-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/2516-60-0x00000000056C0000-0x00000000056C1000-memory.dmp

Download

memory/3564-80-0x0000000000970000-0x0000000000991000-memory.dmp

Download