2ba5f0d774abbfc2620775a0c1114e32a6dc053d9e58d9a405294a35ca8c118e

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 09:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe
Size 3.0MB
Sample260827-k73cfaha32
SHA256 2ba5f0d774abbfc2620775a0c1114e32a6dc053d9e58d9a405294a35ca8c118e
MD5 c09e5683ffaca8078c7fe4df04287d50
SHA1 a101ff2e1dee7d37ed119a1f2d9c30923993ea5f
SHA512 9508419a1aa5b9ff573f04f44ad857645f9f0c31ca6859ceb7466b38efcfff52958aa4cb544bff315d4de63870ec9ad8aadb860903ac6e5ced44c3d82527861e
SSDEEP 49152:U+El/ev6T+El/ev6T+El/ev6T+El/ev6T+El/ev6T+El/ev6T+El/ev6T+El/ev6:Mpppppppppv
TLSH
T1C2E55B0DF99620B5D82A5070498BC27EE771B92147124BEFE298C67E6F33BD46D38B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5536	svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe
796	svchost_CCCCBBAAACCBABBAAACABBCBBCCAAACBAAAAACBBCCBAACCABACABCC.exe
3408	svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAABBBBABCCBBAAABAABBACABCABCCCAABABCBBBAABABBBCABABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe"	2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBABCABBBCABAACBBCABAABBCBBBABACBCBACAAACAABBABAABCABCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCBBAAACCBABBAAACABBCBBCCAAACBAAAAACBBCCBAACCABACABCC.exe"	svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5736	sc.exe
2852	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4120	cmd.exe
6000	cmd.exe
5696	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCBBAAACCBABBAAACABBCBBCCAAACBAAAAACBBCCBAACCABACABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4708	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3056	2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe
3056	2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe
3056	2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe
3056	2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe
5536	svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe
5536	svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe
5536	svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe
5536	svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5536	svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 6000	3056	2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe	91
PID 6000 wrote to memory of 4708	6000	cmd.exe	93
PID 5536 wrote to memory of 4460	5536	svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe	94
PID 3056 wrote to memory of 5696	3056	2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe	97
PID 5696 wrote to memory of 5736	5696	cmd.exe	99
PID 3056 wrote to memory of 4120	3056	2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe	100
PID 4120 wrote to memory of 2852	4120	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_c09e5683ffaca8078c7fe4df04287d50_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAABAABCAACBACCCBCACACCCCBABCBBBACCCCCCAABCBACCACBBCCBCCCBCAAAABAABBCCBCBBBABBCCBBACCBBBCBCBBBBBCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6000
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAABAABCAACBACCCBCACACCCCBABCBBBACCCCCCAABCBACCACBBCCBCCCBCAAAABAABBCCBCBBBABBCCBBACCBBBCBCBBBBBCBBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBCBACAAAAAABBACCABBCBAABCACAACBBBAAAACBAABAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe" start= auto displayName= "UserDataSvc_BBCCBCBACAAAAAABBACCABBCBAABCACAACBBBAAAACBAABAACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBCBACAAAAAABBACCABBCBAABCACAACBBBAAAACBAABAACAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe" start= auto displayName= "UserDataSvc_BBCCBCBACAAAAAABBACCABBCBAABCACAACBBBAAAACBAABAACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBCBACAAAAAABBACCABBCBAABCACAACBBBAAAACBAABAACAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCBCBACAAAAAABBACCABBCBAABCACAACBBBAAAACBAABAACAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAAACCBABBAAACABBCBBCCAAACBAAAAACBBCCBAACCABACABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCBBAAACCBABBAAACABBCBBCCAAACBAAAAACBBCCBAACCABACABCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:796

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe
1⤵
- Executes dropped EXE
PID:3408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f745480905d527a88fabebad6ba1c0854b0b8012c7a114215196d3f26b7f6d5
MD5 f72296696b2e0d6e5f69b63a031b1634
SHA1 d15ceb25dd0e28d75041af506b94d90c82554ecc
SHA512 54faf3d597bf4c1ba9777b833fead1360e9d7a8e6eb10757f18638d7eeffa5c3eef41a04da4b2525e20a1e61fc020d6489c34650a7a3dd33d83c84bb9a54e071
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fa91944a241905e6faa76cdb6f240a5ae693d6350477ff5ca6ee6d32cea20946
MD5 e8b1d769237987eafdfc2a5e28762f66
SHA1 c765286c27905c941a6dd85f4efb3e2f11c37d23
SHA512 373631ab2905e6b2baf6573e85e8322acb18e677de0ceec4a5bcf81cbe62208d5b7b59ffe267b84ccd009bc72557007d82df9659f660fb84a9d80beb3593577b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4862c4e5049adc07ddbb07d9624db6d1ce1a4a8d810fe8d3d8789adca5b975b9
MD5 c0ec66f996d8ecf85d27989a4e88f8ef
SHA1 f92aa1c042987febc43985aaf232d9bd733c2381
SHA512 f28172381828539573a73bf7c2ecd06d88f48c9700b51321f2079adb2c81c4d012f86e93db99f5df8ba70fe01d77a5d0db6a3930431232e89cdd8c75214ed594
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 52fe31f2e30534a556cda131920f1adbc36ec12829e8bbec25839a0d11694e63
MD5 423ba3f49b7679623740bccdcc42740f
SHA1 1c10877d690610fe10856b0303caa6bd064a4ad2
SHA512 4b4296baf4459d6e0c9944b361be0077baeaa066821f90bc2385ec8fac0ea4dbf43edd21258af695ed36d2ff8a3d338ed0596d0d2b50e449d21fbfce85117af3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 260df5d38581ea5df1dea35284e74f50d9c0851aab932321a4d70a326a203715
MD5 22a39a1a2adb2ce0445cfb52311c5fdd
SHA1 8478b96ac752ec2a78a837adcec894f80fb90249
SHA512 22d9d6cab278adfe9d47a137666bcd74cd6a14e450e8ebdd1d6cb9c9067b1e2ca9f41b668843357ac7ee1bb4573baeee5b60375e19f3bec2190b59e53964bbab
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 64f6d3c7d051d337d2dceeb3c7b1e1345ce8676e192427d1899eeed26dfe5105
MD5 19d3b118721d767d9d6223f78cf0f5c9
SHA1 9d6aa5e2c21f1d201e505d786ac23953c2544f1d
SHA512 4f52ddcc545d139b8f1f83a7ccaa997616ef3638301908d8eac23db9191d2e6283ce5efab46371e95c979f1832b878bf636b547d1c3a81a72c2bc545793d2693
MD5 SHA1 SHA512

Submit Download

svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABBCBABABCBBAACCBBACCBAAABBACCBCBBCBCBBACCBBCAABBACAB.exe
Size 3.0MB
SHA256 2ba5f0d774abbfc2620775a0c1114e32a6dc053d9e58d9a405294a35ca8c118e
MD5 c09e5683ffaca8078c7fe4df04287d50
SHA1 a101ff2e1dee7d37ed119a1f2d9c30923993ea5f
SHA512 9508419a1aa5b9ff573f04f44ad857645f9f0c31ca6859ceb7466b38efcfff52958aa4cb544bff315d4de63870ec9ad8aadb860903ac6e5ced44c3d82527861e
SSDEEP 49152:U+El/ev6T+El/ev6T+El/ev6T+El/ev6T+El/ev6T+El/ev6T+El/ev6T+El/ev6:Mpppppppppv
TLSH
T1C2E55B0DF99620B5D82A5070498BC27EE771B92147124BEFE298C67E6F33BD46D38B50
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/796-65-0x00000000002F0000-0x0000000000311000-memory.dmp

Download

memory/3056-0-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/3056-8-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/5536-34-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download