8efda633f41a43581c296fd71e55cc5f404b50a80fa18b6a429c0c1aca72e0be

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe
Size 10.7MB
Sample260826-vla16ssgrf
SHA256 8efda633f41a43581c296fd71e55cc5f404b50a80fa18b6a429c0c1aca72e0be
MD5 9410e99da74f03f1c2ea9f8226fff887
SHA1 15f967a35a922104aca8183fdbe8ddab780ac6c7
SHA512 14842f2de7fea4318e83f510673f9a19622318303027a804a00f7fc29724038601181c006640e5506719ab68775c1dfd816bbb4913aee8ff27470c80dacd9351
SSDEEP 49152:U+ES+ES+Ex+ES+ES+ED+ES+E7+ES+ES+E7+ES+EXiw21+ES+ES+Ex+ES+ES+ED+T:a
TLSH
T127B63B09F98704B1D97B51B04CDBD3BF8A70BA1187228EEBE649C71F6933BA16834715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2532	svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
4368	svchost_BABBCBAABCCBACACACBBBBCCCAACBBCCBBCBACBBBBBCCACCCBBABBA.exe
2740	svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCACAACCBACBBCACCCABBCABCCACCBCAACCBBACAACABBCBACAABAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe"	2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBBCCBACAABCBABAACAABBCCABCABBACCAABBAACAACBBCCABBBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCBAABCCBACACACBBBBCCCAACBBCCBBCBACBBBBBCCACCCBBABBA.exe"	svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1920	sc.exe
908	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2636	cmd.exe
5156	cmd.exe
5832	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCBAABCCBACACACBBBBCCCAACBBCCBBCBACBBBBBCCACCCBBABBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3016	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5104	2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe
5104	2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe
5104	2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe
5104	2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe
2532	svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
2532	svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
2532	svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
2532	svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
4368	svchost_BABBCBAABCCBACACACBBBBCCCAACBBCCBBCBACBBBBBCCACCCBBABBA.exe
4368	svchost_BABBCBAABCCBACACACBBBBCCCAACBBCCBBCBACBBBBBCCACCCBBABBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5104	2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2532	svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
Token: SeDebugPrivilege	4368	svchost_BABBCBAABCCBACACACBBBBCCCAACBBCCBBCBACBBBBBCCACCCBBABBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 2636	5104	2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe	91
PID 2636 wrote to memory of 3016	2636	cmd.exe	93
PID 2532 wrote to memory of 1924	2532	svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe	94
PID 5104 wrote to memory of 5156	5104	2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe	97
PID 5156 wrote to memory of 1920	5156	cmd.exe	99
PID 5104 wrote to memory of 5832	5104	2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe	100
PID 5832 wrote to memory of 908	5832	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_9410e99da74f03f1c2ea9f8226fff887_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCCCBBACCAACBCBCCBCCBCBCACABCBACBBCABBACABBBACBABCCBABBACCCCCACACABAAABBABCCBCBCBBBBBBABACABCBCBAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBCCCBBACCAACBCBCCBCCBCBCACABCBACBBCABBACABBBACBABCCBABBACCCCCACACABAAABBABCCBCBCBBBBBBABACABCBCBAABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3016
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCACCCCCBBCBACBAABBCBAACCACACBABBAAAABCAAABACBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe" start= auto displayName= "UserDataSvc_BCCACCCCCBBCBACBAABBCBAACCACACBABBAAAABCAAABACBCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5156
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCACCCCCBBCBACBAABBCBAACCACACBABBAAAABCAAABACBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe" start= auto displayName= "UserDataSvc_BCCACCCCCBBCBACBAABBCBAACCACACBABBAAAABCAAABACBCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCACCCCCBBCBACBAABBCBAACCACACBABBAAAABCAAABACBCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCACCCCCBBCBACBAABBCBAACCACACBABBAAAABCAAABACBCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:908

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBAABCCBACACACBBBBCCCAACBBCCBBCBACBBBBBCCACCCBBABBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCBAABCCBACACACBBBBCCCAACBBCCBBCBACBBBBBCCACCCBBABBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4368

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
1⤵
- Executes dropped EXE
PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a2546c1a1cec2b1388b30a709892dfb354fbf740a6f8a0bf95a1efaf9466091
MD5 8dadb8241c5f6058c20ab20268348c14
SHA1 abff57f7820ea0cc6465b4521cf09aa296088f2c
SHA512 821592c5cd5c0ed58bd3216c826ff50d38a4cbefafe6303191c8fab81b24a16d4910d94ffa289678c05a6b9f500babec8cd0c64267072bea9b09b2c09984210f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d543b30b0be4590ff920879bb80dbb1b9757dfd6e8df3ce4745ae3ed00320d44
MD5 6d05285145626aa054bcb934e7a8619c
SHA1 0eb8400a1e49461f7dd6cc58818d094de738d368
SHA512 b46d31d3f7991d2bc05f87e4337cb4b3903b40b9e8a8ef4d7589b505752f7955ea0fe54501d42ad27256ebd99cab7bef681e7c05dba08a98dd3ea09cf4bf1cf9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 657cc0c45e76fb255fcac332fd24744a9508ca8a9e95afc3c2f819f3ccf15b16
MD5 261adf4745d76ddbda5966c78c6aca80
SHA1 536653020e801171ad6d1a670d87d9fa8f3575c4
SHA512 c3c8cbb79e5c3265bce69d573e28fd4b5478b5d3305af150628a9bca22065b5b4d3bd6e11549b0a922f4a7f517e993cfec725045d4b3947c448329f5ce7b2b30
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8bc1c91a922326d3b1c14a27f8f06a352b54ae85a945e1c439948dec162d4887
MD5 bfa2363e709872b63d3e4436fbebd633
SHA1 191c9324faf50a5387624236fecaf0575cb5b499
SHA512 e5f6c8888a26069e6768e83ba7190ef98dfa9f1dfc922d2a249d46614892cfa07a69a990a756b72bd2c42261522b31d4378c994ed869ed8294cb7d43d2fe513b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f589473cd5bd9eafde07fc42fc54ac5501d628112b8dbd0a2a234a9750d0cafb
MD5 2d4852d10372cae627afae7e93e9b3cb
SHA1 37ac6a8d9d842e4bdd397988ef33304f71d44da4
SHA512 324dc1aa50e7b17e3cab9ffcc04ae93a0172d371cd68237ed665153e3641f487c8fb79a4788d202b6ff6ac28c5f9780429457be9405b5b16d6bff30c111f78f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bdb69719e7f5f5e81bc0fe2a159c9ce62cf74bd25c35d301bb19e9cfb85e51c2
MD5 a3c5029c386708fe22e7306f3441d879
SHA1 8a1aead44a64864f1d31f1129bc1a0e7db575448
SHA512 2c1889a6c33257466174c9863df2692168109f6c97bad7ab2ba55482ff1d6bf6247a415e43ae73747edc0cd70b1c79717ded64d9844a0b4ec8b22e324065a9c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e2235680d0a5acb611c34e629235abaf33e95037af544a0e3aa5bae22596d227
MD5 498ab9da68b40377b333915cb5ec71f0
SHA1 0935b9d4264806e77b85961e924acd3bffbfbce3
SHA512 568b6b8d942d516f5c348400b04e54e77c9af630ca1135ab015c7b285ed75745b7a4d8bb61d404337d7b677a61bc19a0e8ef98a67df5fb86076e0236084d4df7
MD5 SHA1 SHA512

Submit Download

svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACABABCAABAAAAAAACBBCBBACABBABCBACBBABABBBCABABABAA.exe
Size 10.7MB
SHA256 8efda633f41a43581c296fd71e55cc5f404b50a80fa18b6a429c0c1aca72e0be
MD5 9410e99da74f03f1c2ea9f8226fff887
SHA1 15f967a35a922104aca8183fdbe8ddab780ac6c7
SHA512 14842f2de7fea4318e83f510673f9a19622318303027a804a00f7fc29724038601181c006640e5506719ab68775c1dfd816bbb4913aee8ff27470c80dacd9351
SSDEEP 49152:U+ES+ES+Ex+ES+ES+ED+ES+E7+ES+ES+E7+ES+EXiw21+ES+ES+Ex+ES+ES+ED+T:a
TLSH
T127B63B09F98704B1D97B51B04CDBD3BF8A70BA1187228EEBE649C71F6933BA16834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b3bf3878350754ecb567817f2ba0cfd97c1e75b60da776690d36215229897990
MD5 fbf03df2f91cd5072d51ce90879b72a2
SHA1 f493b7336304881e3d2631f155721628dc005cfc
SHA512 dee174b1aca2d2033184c173c17874a5936e8d8787d5265b2f186521c96d8841d0defde3016bad5c41f81fc4c2563709a7e69991b41ac81c333a14be2c5430ba
TLSH
T12C11C460E1F6D857EC32A4CF9329CEC35CE9778B589C6A18234D82187B49C378D595E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2532-34-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/4368-74-0x0000000000F40000-0x0000000000F61000-memory.dmp

Download

memory/5104-8-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download

memory/5104-0-0x00000000009E0000-0x0000000000A01000-memory.dmp

Download