b56d6872986d97ad86e0565dec7bb93cf38cef77ec5535c7abff30d9d011d299

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe
Size 15.1MB
Sample260827-trx78abl4v
SHA256 b56d6872986d97ad86e0565dec7bb93cf38cef77ec5535c7abff30d9d011d299
MD5 63225370d763a5d78f1e13dd855175bc
SHA1 7e3103ee45db9eebd92e9d2043272ab6704f062e
SHA512 cda1bd7ed859cf814937ae1fb78fdd80dff75ff608085d8c961a7d3fa4322738c266c7305feca6327dbdf06f8b6e5107b67b4ba2240f3ec4c2af784edf6575ae
SSDEEP 98304:UKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5ax:Uq3q3q3q3q3q3q3q3q6
TLSH
T159F69D02B7D90075E6B33530497B93759ABA7A214B31CADF5384563E4E33AC0AD3876B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2420	svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
952	svchost_CBAABACBCCBBBCAABBABAACCAABBCABCABACCAABAAABAAAAACBBBAB.exe
5844	svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABAABAAABCCCBCABCCBBCCCAAAAABACBACBCCCCCAAACABCABBBCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe"	2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCAAACABACCCCBABBBCCCCBCCCABACBBACABBCACBCCCAACBABABBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAABACBCCBBBCAABBABAACCAABBCABCABACCAABAAABAAAAACBBBAB.exe"	svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2060	sc.exe
5660	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5864	cmd.exe
1916	cmd.exe
4768	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAABACBCCBBBCAABBABAACCAABBCABCABACCAABAAABAAAAACBBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5740	2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe
5740	2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe
5740	2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe
5740	2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe
2420	svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
2420	svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
2420	svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
2420	svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
952	svchost_CBAABACBCCBBBCAABBABAACCAABBCABCABACCAABAAABAAAAACBBBAB.exe
952	svchost_CBAABACBCCBBBCAABBABAACCAABBCABCABACCAABAAABAAAAACBBBAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5740	2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2420	svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
Token: SeDebugPrivilege	952	svchost_CBAABACBCCBBBCAABBABAACCAABBCABCABACCAABAAABAAAAACBBBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5740 wrote to memory of 5864	5740	2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe	93
PID 5864 wrote to memory of 4892	5864	cmd.exe	95
PID 2420 wrote to memory of 3408	2420	svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe	96
PID 5740 wrote to memory of 1916	5740	2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe	99
PID 1916 wrote to memory of 2060	1916	cmd.exe	101
PID 5740 wrote to memory of 4768	5740	2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe	102
PID 4768 wrote to memory of 5660	4768	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_63225370d763a5d78f1e13dd855175bc_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACAAAACBCAACCAACBCBBBBCCBCBBCCBABCBCBABAABACBAACCCCBAABBBBACCBAAAACACABCACCCCCAABCABBBBCACBBBBCABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCACAAAACBCAACCAACBCBBBBCCBCBBCCBABCBCBABAABACBAACCCCBAABBBBACCBAAAACACABCACCCCCAABCABBBBCACBBBBCABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCCBBBABBBBCABABAACACCBCACCBAAAAACABCBCAABCCAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe" start= auto displayName= "UserDataSvc_CBBCCBBBABBBBCABABAACACCBCACCBAAAAACABCBCAABCCAAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1916
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCCBBBABBBBCABABAACACCBCACCBAAAAACABCBCAABCCAAABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe" start= auto displayName= "UserDataSvc_CBBCCBBBABBBBCABABAACACCBCACCBAAAAACABCBCAABCCAAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCCBBBABBBBCABABAACACCBCACCBAAAAACABCBCAABCCAAABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCCBBBABBBBCABABAACACCBCACCBAAAAACABCBCAABCCAAABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3408

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBCCBBBCAABBABAACCAABBCABCABACCAABAAABAAAAACBBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAABACBCCBBBCAABBABAACCAABBCABCABACCAABAAABAAAAACBBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:952

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
1⤵
- Executes dropped EXE
PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6834d89ecb338529b41aa18a9cbbc0d2f585592508580d33377db7744de5cff4
MD5 8a959eadeccf5c8bfc926daf4951b241
SHA1 86a5f50db03ca5973f10ef2c329b5035fcf8acc3
SHA512 771475277de7530cc20e121181bd0f42d6f1c5801f6c16a46cf38298384f7624d58d9e1d3734584abe767c83355f065ca57aee4879c23a36c517375c11c32230
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cd3d3103aa80b6d5912d3531a6d45069f8661358b2a3f540444d7bf0393e9433
MD5 b6cc831c64dcf482796dd748a7ac36b9
SHA1 c220ae30528fd2e769cb292870765f671f154523
SHA512 dd4374ba39b223ca1b5fc133bd7ef0a6ffebdd2e8dc5cf7d6454472e23ab60cc781aef15322c4e1dc2d7f04e102ebde8f9efef0c41884c37f77ae9ba6e3ee380
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99ca5c372e622e6f80deba5e662f4e49f95ad4bf1a3bef9372040f90ce111080
MD5 72b046f074a9c9892eec668ef5191121
SHA1 f5a72805c5a474c3dc9b1b7aed4e180849663b27
SHA512 605ee97796dd61a42fc1d0df45b415fa464b4f60c1d9deafcbfcc310e70cd30b0a8e320c26b75a005bec4b75df1f30e350ee201570b3ae2d85bcde956798b971
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a7505b0f3af176daf7a812b437609bbdd4f4a70e72254b80f4f9be85af909220
MD5 37267447e426c7a21f168122f48fbf75
SHA1 c9b6909f1883b90fdbe319a81c3cb0c0b49e5869
SHA512 bd6eadbd2ad42676d45c321374c94205d74d91736292d16df9a17835af3454f288b27e2a5a91756e036df5a0c2cdb1271b0e8c6867bad91cb6c3423e27eddc79
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6e02ac3ccb992cd8879c8f4246e986cd37f00c95958499c2d20e4702562e872b
MD5 c07e448e6173c22aeeefd6ab2fe183b2
SHA1 6cad8d99c553ab5e49012f3f196a0d971724327d
SHA512 29c22de772d8a821ef7231b65a4f4c90e7b1d0507abf21bc9b4cbfe8001e68711ab8a2dc6a51537c10e975ae0f23a1291c49b5e8031eab4f7d696fb0cbdf7ff7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 73fe89852c7594002270e5888a70fba080a04dc8aa2a0f865264a529a71b20d5
MD5 0a818365e7b18e211b197131b588149d
SHA1 c4a905075755d3c8e0c38ac7c52a5a2e4e1ca962
SHA512 91bb4d71cde943f0fe31b7ddda94002460cf321619ed6734a431e29ded5cd0962622ec2914a521028173e772abbb3a2620920748756ad99f55067fb84d9aeace
MD5 SHA1 SHA512

Submit Download

svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACBBBCABBBBBBABBACBAABBABBCBCCCABBBBBACAACCBBABABBCCB.exe
Size 15.1MB
SHA256 b56d6872986d97ad86e0565dec7bb93cf38cef77ec5535c7abff30d9d011d299
MD5 63225370d763a5d78f1e13dd855175bc
SHA1 7e3103ee45db9eebd92e9d2043272ab6704f062e
SHA512 cda1bd7ed859cf814937ae1fb78fdd80dff75ff608085d8c961a7d3fa4322738c266c7305feca6327dbdf06f8b6e5107b67b4ba2240f3ec4c2af784edf6575ae
SSDEEP 98304:UKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5aEKRuy5ax:Uq3q3q3q3q3q3q3q3q6
TLSH
T159F69D02B7D90075E6B33530497B93759ABA7A214B31CADF5384563E4E33AC0AD3876B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e2e195938e88688e6f4a7378ca635d78caff46f217026a3ae835c917c2b9651c
MD5 dc5916648f26213ed78cf82010c8e03a
SHA1 1780f7e2eef87d37f87281b81a998611742027d6
SHA512 e8075c1cd42e8ed684b20c252999b414dc4bdf1469241bfa2ad7957f62e2d09652db922af439da419748425b99eaac6252ce2bd92ad740f6ffa3ac5d002abfee
TLSH
T18A110AB290F6DD57F93368C79215C8821CF426DF5CDC6AA46205821CE7CBC354D5A5F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/952-79-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/2420-33-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/2420-23-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/5740-0-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/5740-7-0x0000000000980000-0x00000000009A1000-memory.dmp

Download

memory/5844-81-0x0000000000420000-0x0000000000441000-memory.dmp

Download