8211b39fb79735a9f6423f2df2a92bd3980fb8abdbfe5f5e5c2cf6f916700bc6

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 22:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe
Size 19.9MB
Sample260827-1yrsca1dkd
SHA256 8211b39fb79735a9f6423f2df2a92bd3980fb8abdbfe5f5e5c2cf6f916700bc6
MD5 195c5f3fc94b368d028466a2bf25d0fa
SHA1 67e83b353ae10c9a61c7bc74706ceadb91384152
SHA512 2bcb8c39111709968343e341851cdc49c4c7da02193c137ba2d82db5a3db2103e63f3e42d0b79b3a786d7507c47422f6b8b51843cf7a7daa8eec40fab8838ca9
SSDEEP 49152:U+E9iw2A+E9iw2A+E9iw2A+E9iw2kwq/+E9iw2A+E9iw2A+E9iw2A+E9iw2kwq/c:b
TLSH
T14327491877FC0C51F5F7623589B286198AB2BC618B35C2CF6194923E5E73BD0AC35B62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4800	svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
1048	svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
4212	svchost_CBAACBCACCAABCBCABACABCBACCCACABBCCAAABCCBBABAACACBCBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACACBACAACBBCBBAACBBBABAAACBBACCCCABCCBABABBACBABCABBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe"	2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAACABAAAACCCCBCBAABBBBACAABAABBAACACBCABBBCABCAABAABACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAACBCACCAABCBCABACABCBACCCACABBCCAAABCCBBABAACACBCBBC.exe"	svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1796	sc.exe
888	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2968	cmd.exe
2656	cmd.exe
716	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACBCACCAABCBCABACABCBACCCACABBCCAAABCCBBABAACACBCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4868	2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe
4868	2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe
4868	2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe
4868	2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe
4800	svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
4800	svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
4800	svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
4800	svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
4212	svchost_CBAACBCACCAABCBCABACABCBACCCACABBCCAAABCCBBABAACACBCBBC.exe
4212	svchost_CBAACBCACCAABCBCABACABCBACCCACABBCCAAABCCBBABAACACBCBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4800	svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
Token: SeDebugPrivilege	4212	svchost_CBAACBCACCAABCBCABACABCBACCCACABBCCAAABCCBBABAACACBCBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 2968	4868	2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe	92
PID 2968 wrote to memory of 3404	2968	cmd.exe	94
PID 4868 wrote to memory of 2656	4868	2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe	95
PID 2656 wrote to memory of 1796	2656	cmd.exe	97
PID 4868 wrote to memory of 716	4868	2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe	98
PID 716 wrote to memory of 888	716	cmd.exe	100
PID 4800 wrote to memory of 3764	4800	svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_195c5f3fc94b368d028466a2bf25d0fa_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBABABCABABABACBACBCABABBCBCBBCABABAACBCBCBBACCBBABABACCBCACCCBBCCABBBBCACACAACAACCACAABCCCCCABCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCAACBABABCABABABACBACBCABABBCBCBBCABABAACBCBCBBACCBBABABACCBCACCCBBCCABBBBCACACAACAACCACAABCCCCCABCCCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABACCACCCACCBCCBBBCAAAABCCCABACBBACBAACACBCCACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe" start= auto displayName= "UserDataSvc_AAABACCACCCACCBCCBBBCAAAABCCCABACBBACBAACACBCCACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABACCACCCACCBCCBBBCAAAABCCCABACBBACBAACACBCCACACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe" start= auto displayName= "UserDataSvc_AAABACCACCCACCBCCBBBCAAAABCCCABACBBACBAACACBCCACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1796
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABACCACCCACCBCCBBBCAAAABCCCABACBBACBAACACBCCACACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:716
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABACCACCCACCBCCBBBCAAAABCCCABACBBACBAACACBCCACACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:888

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3764

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
1⤵
- Executes dropped EXE
PID:1048

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBCACCAABCBCABACABCBACCCACABBCCAAABCCBBABAACACBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBCACCAABCBCABACABCBACCCACABBCCAAABCCBBABAACACBCBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3232e515270aa6d525a249decc0e185b7e7ba15441499b4776627273c29cfb2f
MD5 c690e1dc6519ae67984cf59c99478080
SHA1 9822e0a9024ab386bf111c6bedde7b890a6fc278
SHA512 52773922368a53cb4b5986450c3a03f5b56820ee776278fda45e423ac94c2e3601e95f56dfb536c489ebd5493980f3ad340e820144468233bfa8fb5b0b07319e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6ac0c7efd4887e02d79c1452af6ec2fa43f08d950c5a547419f4231578f802df
MD5 3d4c463b9d5d61674085e286b872a35d
SHA1 629423a06af3a1b62e1bb1dd09f99b94480cef63
SHA512 17f82331329e4f9f5dc770941a0062d635437f00ce4d3bd584ea85a8104831ee15d018240ff82cc1dfd8ebc064fc733262d8577a48cec79eefe60899270f39aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 53536ee861beeead7723935a51c711bd9dd20cb639534f1d2877270694888b3c
MD5 96f525a6fbe30bc99512c2cd38dd3a59
SHA1 f330efcb07d9ad34f347ee23d57dae6c6575bc49
SHA512 b315cfa8ee595291fd5d72349215834b1b0ace8cfa6bffadcbab51c27a356d73a338f31604b0afc8f25397443f17d8f74329b82995834c2d68eda15aa480815a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8762cbe1cf3819b10674006ec856200d44cb5d158702eacff7aa67322c7e987b
MD5 48c623755e6b6c9e3d7a39ccafa84cf2
SHA1 3c16b0b66db4f3a3fa82102f58562df84ac878bd
SHA512 1d2a6009e51b19bdbd4d106471276f6a5f1fa30fcf9f6bc40b46c28d3cd2fed1d17e6331a0f4894b6b6da33052dc9d11f6a1b356871025f36aa31e3f56631969
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 37087245b5aafefefdf4a9a9bc5323e61fa96114521cc3ea9460336f8583ff59
MD5 995ae9be94debd3cf18a063664c28b5d
SHA1 4fe52f502a496199c004e56321e6e7ebb7b0eaec
SHA512 2c36befb6d77fe0fe4295b6cd6c4b6de513025da7b279e17b9cf8430e8ecc5cfccb15ba504e1e716df633cfe0cc7285f9191c1e168bf6a447eca356fbec67f57
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c8a8e0d329a8eefc467544f9a54dc5e62ac29d689498ba509093e522ee7cd7d7
MD5 cc148707a720f341f7d8cc64a3b4a163
SHA1 53f0772456e0fd6cb22935948dbbf125f356dc05
SHA512 d3b60033f8c89e5eacca3d6c818b80c29303ac23e1abb1d39dc851cb4feeab343872c6e3b14c6c90fa53c4131b3b078cecac68bdb7c4c8d79fe5822129478234
MD5 SHA1 SHA512

Submit Download

svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABABAACABCABCBCCABBBBAACCACBBABAABAAABCACBBCACCCBCBCBC.exe
Size 19.9MB
SHA256 8211b39fb79735a9f6423f2df2a92bd3980fb8abdbfe5f5e5c2cf6f916700bc6
MD5 195c5f3fc94b368d028466a2bf25d0fa
SHA1 67e83b353ae10c9a61c7bc74706ceadb91384152
SHA512 2bcb8c39111709968343e341851cdc49c4c7da02193c137ba2d82db5a3db2103e63f3e42d0b79b3a786d7507c47422f6b8b51843cf7a7daa8eec40fab8838ca9
SSDEEP 49152:U+E9iw2A+E9iw2A+E9iw2A+E9iw2kwq/+E9iw2A+E9iw2A+E9iw2A+E9iw2kwq/c:b
TLSH
T14327491877FC0C51F5F7623589B286198AB2BC618B35C2CF6194923E5E73BD0AC35B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 5bc69a54f5143a47c07fd30735733c41b3bcf2b7f74b16b16c0f61a61b580a6c
MD5 09eedb9537d663981253bdf60e6432cf
SHA1 7b2dbeaa4044a40b40d262e892762d24b857a321
SHA512 94329694a9a66e1a41cf31dde55e6ddc666ce64b7a4fe899499c962e8cce64f7a4fc155539c2c5ac92cd904af86f1ff12383082a3096d3a7efd68f69198d369f
TLSH
T14C113A40A0F7D463F53378DB961DEAD318E433EE9CA46A0D230842186788C35CD598E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1048-66-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/4212-81-0x0000000000EB0000-0x0000000000ED1000-memory.dmp

Download

memory/4800-36-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/4800-23-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/4868-0-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/4868-7-0x0000000000450000-0x0000000000471000-memory.dmp

Download