58b503597736d7d284f63f89f654fd16cb6ac85f6c91bb116ccfddbeebd61904

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe
Size 13.5MB
Sample260827-vb469sbp4t
SHA256 58b503597736d7d284f63f89f654fd16cb6ac85f6c91bb116ccfddbeebd61904
MD5 5e1c935f47c4907a8eda615c88971da1
SHA1 8cccff8f3d81489307637a470b3e5edf5045d222
SHA512 024b25e2bd139996dad31b86c62a3dd53cfa4f600f5de87e812ff57d692e672ca546ce23c8a5ab8d1cdd187bd86b5bc5a24a10a3e9f295099906cf8ff49bbbb0
SSDEEP 49152:U+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+EK:1
TLSH
T1F7E63C09FA8610F1D977517049DBD27B8630BE3187218EFFE689D63A9D33B906838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
236	svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe
1860	svchost_CAABCABBBBBACCCCCAAABBCABACBBAAABBCCCBBBCCCCCCCACCACACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACAAAABBBCABAABABCCACACAAABCCCCCACBCCBCBAACCCACBBABBCAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe"	2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACBAACBCAACABCBCBAAABBBCCAABBABBCAAAACBBABACBBAABBCCAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCABBBBBACCCCCAAABBCABACBBAAABBCCCBBBCCCCCCCACCACACC.exe"	svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4752	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCABBBBBACCCCCAAABBCABACBBAAABBCCCBBBCCCCCCCACCACACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2768	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
892	2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe
892	2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe
892	2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe
892	2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe
236	svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe
236	svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe
236	svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe
236	svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	892	2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	236	svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 892 wrote to memory of 4752	892	2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe	93
PID 4752 wrote to memory of 2768	4752	cmd.exe	95
PID 236 wrote to memory of 4340	236	svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe	96

C:\Users\Admin\AppData\Local\Temp\2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_5e1c935f47c4907a8eda615c88971da1_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBCCBBBBCCBBBAACACBCBBCCCBCAACBBABABACBCBACACACBBCACAAABABBBBBCBBCCCCAACACACCACBCBACCCAAABACAACABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCACBCCBBBBCCBBBAACACBCBBCCCBCAACBBABABACBCBACACACBBCACAAABABBBBBCBBCCCCAACACACCACBCBACCCAAABACAACABCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:236
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4340

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBBBBACCCCCAAABBCABACBBAAABBCCCBBBCCCCCCCACCACACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCABBBBBACCCCCAAABBCABACBBAAABBCCCBBBCCCCCCCACCACACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c874bb27ff4c34df20d5c0b38d02b04b8ca89fbeb8962476c3b1af2a0ce8ce36
MD5 09213b50500d4c0c3d3c13b02553eb5b
SHA1 21682071cc0d87069a53d79d09ce0ca24cc3446a
SHA512 fe6161ada24d1baf4d507f2e229d9bd53c3c3932492dcf86c48ed5ca1c196d2a635616616a97163730a582858fe2ec4d400a384a0f5ca015e59aed80b3dcc4c5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 23a0f7a59d9194c0950888e9156960e261bc22bd27bc8f5f8f8717473515b732
MD5 c0b3f2b5502ad64e540f757678543944
SHA1 0e11c76ec5918a2a5ced2daa88c1250038982b44
SHA512 a1368bb2f79284f4186ee802cf6ad2cb40baa525ca1efa751fc4c9d755abccbbbb3645f25b092c29e498e0716f4513a66a7bd7ae130ed668587ddd2996c1f72e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a02dc10e796361faf63cbb84e7645c7553d09101c643383c0fd062789913da35
MD5 502f896e0190fc2250f5b7649a5d9fed
SHA1 27a2cbb06e30f71a7a08880e4e7ab2224dbde277
SHA512 3d62624f6b401b1ceff001fe33da9907c206c4a19d711e37c77da99ac8dc4fa1a6f371493587e76f76289da290e7047ac3bc4d1e8ace6114c549369adbac2156
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8dd1e5f3f3d87f270001e38a98ec732df10ca0db22db96e9e15a94a1b2a32066
MD5 024733996124b208792f01529b8ada7b
SHA1 a4de651356e566aa1bc8c7dcee93eaec353e2bc5
SHA512 6c19f06014f16a8c94dbedb90932195fb9223432ffbd6fd0dec438b334b9b290c10ed231c5bee22336fd4f5630582b0f87c3a548392d772d2b7667b0c4950b52
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d1be3c62ae98eab055a19e5a4f9fb3904fd2698967c4743de89c74f499ea8339
MD5 1773581d882fa89f658aba24badde5df
SHA1 29cce66da2cd09c1229c6fe0b0d7ef0f3237fa87
SHA512 2c10bfb6ffc8ae7d297417582018da56aabe0fc6e4268fcbbc4d7f175932bff887b66d3d68184c07bd987631431dd6d5bddb5b27c0806e9c4d9bef014707f26d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e2881cc83dd474381a76ebba4ea2966d85b6bb5d02c63d01901fd7f8364d301f
MD5 ad18a966b7b0d48346cdcbbd1927d06c
SHA1 e93d4665c4f3b55e34ba6c9f8983c40bf825eeb8
SHA512 1935687e352c2bf8672d972b8288e5b87617ffd2e13c83bc4ee089537c626ea6ba7da5599579378b0c93011fc2ac21a18cac12048bb855caca091000d8cfa87a
MD5 SHA1 SHA512

Submit Download

svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACBBABCBACBBBCBABACCBCCABACAABCBABBBACBBBCACBBBBABBCAB.exe
Size 13.5MB
SHA256 58b503597736d7d284f63f89f654fd16cb6ac85f6c91bb116ccfddbeebd61904
MD5 5e1c935f47c4907a8eda615c88971da1
SHA1 8cccff8f3d81489307637a470b3e5edf5045d222
SHA512 024b25e2bd139996dad31b86c62a3dd53cfa4f600f5de87e812ff57d692e672ca546ce23c8a5ab8d1cdd187bd86b5bc5a24a10a3e9f295099906cf8ff49bbbb0
SSDEEP 49152:U+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+EK:1
TLSH
T1F7E63C09FA8610F1D977517049DBD27B8630BE3187218EFFE689D63A9D33B906838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/236-35-0x0000000000D90000-0x0000000000DB1000-memory.dmp

Download

memory/892-0-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/892-8-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download