53a48feb3028a60647a0c63c31e64c76b5ec7cc024bbf1b818f7cc562a89417e

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 10:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe
Size 12.0MB
Sample260827-msbmaatard
SHA256 53a48feb3028a60647a0c63c31e64c76b5ec7cc024bbf1b818f7cc562a89417e
MD5 acbfb4af202ecc39fdd978603bef2323
SHA1 d62bfa4e611f06f09ca21ac29b2cde433071349c
SHA512 087ef01bdd802c04aadb389ac70a79e20b0b9a06841610f202e135efebbf7ff38f8d271931ad1de7d917751c4c221f21d0eed3c38bd219812b859e6ce8a8ef00
SSDEEP 196608:b5i5w5c5i5w5c5i5w5c5i5w5c5i5w5c5i5w5c5i5w5c5i5w5c5i5w5O:b5i5w5c5i5w5c5i5w5c5i5w5c5i5w5cV
TLSH
T15AC65B7C3BE61D02E77795B998A0D2E12C317624033892DF7855FA496E17AC0E83F792
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3184	svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
4528	svchost_CCBBCBCAABAACBACBAABBACACABCCCABBCABBAABACCBBBCABABABAB.exe
4112	svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCBCBCCABCACAAAAAACAAAACCBCCBBBBABBCBCAABCCAACBABBABBACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe"	2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCBABBBCBBCBAAACABACABCCACBBBACAACCBAACBACCCBBABCBCBCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBBCBCAABAACBACBAABBACACABCCCABBCABBAABACCBBBCABABABAB.exe"	svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2960	sc.exe
4932	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4856	cmd.exe
3476	cmd.exe
2384	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBBCBCAABAACBACBAABBACACABCCCABBCABBAABACCBBBCABABABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
708	2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe
708	2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe
708	2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe
708	2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe
3184	svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
3184	svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
3184	svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
3184	svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
4528	svchost_CCBBCBCAABAACBACBAABBACACABCCCABBCABBAABACCBBBCABABABAB.exe
4528	svchost_CCBBCBCAABAACBACBAABBACACABCCCABBCABBAABACCBBBCABABABAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	708	2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3184	svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
Token: SeDebugPrivilege	4528	svchost_CCBBCBCAABAACBACBAABBACACABCCCABBCABBAABACCBBBCABABABAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 708 wrote to memory of 2384	708	2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe	92
PID 2384 wrote to memory of 3248	2384	cmd.exe	94
PID 3184 wrote to memory of 4492	3184	svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe	95
PID 708 wrote to memory of 4856	708	2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe	98
PID 4856 wrote to memory of 2960	4856	cmd.exe	100
PID 708 wrote to memory of 3476	708	2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe	101
PID 3476 wrote to memory of 4932	3476	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_acbfb4af202ecc39fdd978603bef2323_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBBCACACACBBAABBBBCCBCCCBBACCCCCACBBACBABCCACCABABACBCABACCCBACBABBAACABBBAAACCAABACBABCCBBCBBBCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBBBCACACACBBAABBBBCCBCCCBBACCCCCACBBACBABCCACCABABACBCABACCCBACBABBAACABBBAAACCAABACBABCCBBCBBBCCBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3248
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACACCACCBABAABBCABCAABBCBCBBCBABACBCBACBBAACBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe" start= auto displayName= "UserDataSvc_BAACACCACCBABAABBCABCAABBCBCBBCBABACBCBACBBAACBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4856
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACACCACCBABAABBCABCAABBCBCBBCBABACBCBACBBAACBAACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe" start= auto displayName= "UserDataSvc_BAACACCACCBABAABBCABCAABBCBCBBCBABACBCBACBBAACBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACACCACCBABAABBCABCAABBCBCBBCBABACBCBACBBAACBAACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3476
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACACCACCBABAABBCABCAABBCBCBBCBABACBCBACBBAACBAACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4932

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4492

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBCAABAACBACBAABBACACABCCCABBCABBAABACCBBBCABABABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBBCBCAABAACBACBAABBACACABCCCABBCABBAABACCBBBCABABABAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
1⤵
- Executes dropped EXE
PID:4112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d29ff4382aa90928b4606767a394d8bd1c6e0fd38f96b6b6dbfb59c574f8c81d
MD5 73089064ee0aaf8e0548b97ef7bd6f7a
SHA1 a881410dba9d56da29f0c51a7cc77dfc5485d9da
SHA512 4b9919cb119da33d53432ac25039a12db4237a44e7d90f67004a01851d59fa925d9be5e5035b6470a2aaf66f1f5920cf9addac9c5f64c82272fa996803f377ef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 494b1b78549782c9535fa031f55ca9bd96b7504ca8c933a55e229c34ac6c547f
MD5 971bd77fca053b8bdffd3376e4b40df6
SHA1 330407147326061d6b3e12a6bd10c91e14480725
SHA512 f0cc6149c22fecb40ecf0e2f4b83f9307756808a3ac42e1d57ddd9787f5d59068832f29cf7b7637bae5b6d1aaac0400b364c630027341b5154a99ce1c7a84003
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 56bec95ad810baa7bdbc6048acb53bf76f6485020797791fcbbdf1712f645b02
MD5 eeee4efa83505ee92966c0975e032030
SHA1 fd78d1c4efe7ae56437d11a8e647484befbae826
SHA512 f37accf1c83ac2560ed98c90d3b03147fb1fa96d22f143ea40f17091ea7e379cce788339069a71cabeccbf6f9f809052044782a257a3e4dc2bf35effd0dab980
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f286e268dbdd8568af48e1f52f0640732d3a65882a7ac47832e09b0ca847a85d
MD5 1f7819fcafe9c702c9407845da67e9ec
SHA1 a2aebb825e77f7e9ea2500ddcd868ba175165b00
SHA512 76894a4ca7ac44df696611598ff2999d97dd784bbd77f2f51718eb66468caec51ed36c1a5ce67b199a49ce81eb7c6f43d9deb87784d5d11a7c67886f090b4281
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f76110316393d05464f576e6ad8e178f58cb51bd151b58ef7b7ad7f32e5e84f3
MD5 c95c208dbbd17a2bd7167fad823f629e
SHA1 d3e48e4f5d9763998976eecc8d769995dac7b98a
SHA512 97c63fe7cddeef82d056a45d85004b58820b2d657073f05ba0707d3fde1b5a46344c914725fae9a0501c6f576523a944cd1e52d571d2e05e4df0a1615bf8b479
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a012b1416252d2def26d1ddd800a82ad767ab24d8221f0bf0240ddd120fb5ad9
MD5 41f68f3f243ae4408ac52a2990523354
SHA1 d45b585ec34aa681dde748346fc2149cb81888da
SHA512 b6a8dc8b0ff466237253d3ac8a7b4ffbf99952cc02e0e3f383a09798fb50b38a4f6bcb9727b5b9ba8d94f0ae12511605b80eedc7ca02ea3701f8bf3f240ff85e
MD5 SHA1 SHA512

Submit Download

svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCACACBCABBACCABCBCBBBBCBACACBCCABBBCCABBABCABBCCBBAC.exe
Size 12.0MB
SHA256 53a48feb3028a60647a0c63c31e64c76b5ec7cc024bbf1b818f7cc562a89417e
MD5 acbfb4af202ecc39fdd978603bef2323
SHA1 d62bfa4e611f06f09ca21ac29b2cde433071349c
SHA512 087ef01bdd802c04aadb389ac70a79e20b0b9a06841610f202e135efebbf7ff38f8d271931ad1de7d917751c4c221f21d0eed3c38bd219812b859e6ce8a8ef00
SSDEEP 196608:b5i5w5c5i5w5c5i5w5c5i5w5c5i5w5c5i5w5c5i5w5c5i5w5c5i5w5O:b5i5w5c5i5w5c5i5w5c5i5w5c5i5w5cV
TLSH
T15AC65B7C3BE61D02E77795B998A0D2E12C317624033892DF7855FA496E17AC0E83F792
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 2c66d245e6e7bce69271b5d08b12f612eb4791547d8745a71004bab035439c7b
MD5 46f57b0ff2f2adfdd406134d997c8688
SHA1 be8ec9737910b6754ff5e967ccc664552363aa6c
SHA512 63deb57164dec0490e94dfb384c02c511731cbd7c5dc0fd7ea0b21c8695c85e60e4adddd087f2be38f633722fe96678da3101eb00f47b4613d3b99122e7fcfa3
TLSH
T12E110660A0F5D807E53364DABA35CEC728E8379F59D86A247305421CEBDAC32CE590F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/708-8-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/708-0-0x0000000000D80000-0x0000000000DA1000-memory.dmp

Download

memory/3184-24-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/3184-34-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/4528-79-0x0000000000ED0000-0x0000000000EF1000-memory.dmp

Download