f4c83111998d23cbe1a1dbbed64d0713cdd684cae0d5105cd574c85feb288176

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 02:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe
Size 3.3MB
Sample260828-c7qdwasfpb
SHA256 f4c83111998d23cbe1a1dbbed64d0713cdd684cae0d5105cd574c85feb288176
MD5 ed37b8351061195dd57ea1b12021b0c3
SHA1 52b1ab9fc6b177f1326f8780b8bce74ead9a81f1
SHA512 703623355712c4bc53aec3e0eb11493436e0537d93b79faae5b3baaa746a047493d5e709330948ee303d56a7a6465836edee619a7e63dbb7add591e0119f13e3
SSDEEP 49152:U+E7miw23+E7miw23+E7miw23+E7miw23+E7miw23+E7miw23+E7miw23+E7miwo:+
TLSH
T1F0F51B09B7ED0864F4B7717049B6C669DAB2B8514B32C7DF9244833E5E73AE0AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4340	svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe
4380	svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCACBBCAABCBBBAAACBBABBABAACCBBCBBBBAABBCBCBBBBABACABACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe"	2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5976	sc.exe
5268	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5940	cmd.exe
5920	cmd.exe
1312	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5924	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4564	2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe
4564	2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe
4564	2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe
4564	2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe
4340	svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe
4340	svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe
4340	svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe
4340	svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4340	svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 1312	4564	2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe	91
PID 1312 wrote to memory of 5924	1312	cmd.exe	93
PID 4340 wrote to memory of 2556	4340	svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe	94
PID 4564 wrote to memory of 5940	4564	2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe	95
PID 5940 wrote to memory of 5976	5940	cmd.exe	97
PID 4564 wrote to memory of 5920	4564	2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe	98
PID 5920 wrote to memory of 5268	5920	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_ed37b8351061195dd57ea1b12021b0c3_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACAABCAABCBCCCCCACAACCABAABBBABABCABCCABCCCCBBBBACABABBCCAACCACBBCCCCBCBBCCCBBBCACCAAAACBAABAACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CAACACAABCAABCBCCCCCACAACCABAABBBABABCABCCABCCCCBBBBACABABBCCAACCACBBCCCCBCBBCCCBBBCACCAAAACBAABAACACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5924
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCCACAACCBBCBBCABBAAACAAACBBAACCACBBABBCCCACBACBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe" start= auto displayName= "UserDataSvc_BCCACAACCBBCBBCABBAAACAAACBBAACCACBBABBCCCACBACBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5940
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCCACAACCBBCBBCABBAAACAAACBBAACCACBBABBCCCACBACBACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe" start= auto displayName= "UserDataSvc_BCCACAACCBBCBBCABBAAACAAACBBAACCACBBABBCCCACBACBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5976
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCCACAACCBBCBBCABBAAACAAACBBAACCACBBABBCCCACBACBACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5920
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCCACAACCBBCBBCABBAAACAAACBBAACCACBBABBCCCACBACBACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2556

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe
1⤵
- Executes dropped EXE
PID:4380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 77267c317fbd3d8690b5a376c31243cef979390014b96a186cddbe32fbb5ad57
MD5 803f60c431ccc14854fe3c469cbe0d00
SHA1 7d2abaf96f0109b2931f803b56b4ea9886b60ccb
SHA512 a25e105c7592942261a2a87052176b54b80c3b378829190f4aaeb7fbffdcd5f33fe5a60da9703e980df0045ef18fafb59c034cd0d996820a54e89d99c882d529
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c9a79ced30ffabfd43befd8701f4a13aedfac6e822e32121c3e7770c0607d7e8
MD5 f1ef0392d32f4a4b0247b0e24755b567
SHA1 7bc0cf3f672ca0f0b0454c4eb02a8f301118ab03
SHA512 5578091911e0a9286cb258c5ee1f7dd52cc49b3d514a85ddae5b8186c758b6bb0bae6d43018b3dabda13b6abf8950f37c251a3c06cfe4720f20b88a8da92f97f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 01f6eae5d835f747c3d620775c30fc359132d9f3783167abe31bc6c6b4b08791
MD5 51dbfd50b51a949185b67f941312d120
SHA1 4d4439d33b9198bbe6cbd07421e41db30f1559df
SHA512 c60b767bca135903372175ccb2d22c21f91b7b5ca0cc7f9fe8e37ed573a80cbfe579522745f4fed840c1da5ea2afa97d3e2f08d10e1679b13f02bfdadc4a4501
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b44ad4c4d0c7198ab6573aef64c6623c665c47a906c805420102eb6f59150052
MD5 b48325e97386842502fb03565e5df0be
SHA1 d226624d015c3584b98ffae24a90452ef86b0a61
SHA512 47856c19064e5d88707a5cb57b2b351086b7a91fdc20af3eaccd1919c3e4bce7e72a88b4d8da959c21810a046efb94959ba938d2142886d7e3602b3f1a23b8df
MD5 SHA1 SHA512

Submit Download

svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCACCCBCABAACCCACCCCCBABBBABCABBCBCBCBBAABACACCBCBCCB.exe
Size 3.3MB
SHA256 f4c83111998d23cbe1a1dbbed64d0713cdd684cae0d5105cd574c85feb288176
MD5 ed37b8351061195dd57ea1b12021b0c3
SHA1 52b1ab9fc6b177f1326f8780b8bce74ead9a81f1
SHA512 703623355712c4bc53aec3e0eb11493436e0537d93b79faae5b3baaa746a047493d5e709330948ee303d56a7a6465836edee619a7e63dbb7add591e0119f13e3
SSDEEP 49152:U+E7miw23+E7miw23+E7miw23+E7miw23+E7miw23+E7miw23+E7miw23+E7miwo:+
TLSH
T1F0F51B09B7ED0864F4B7717049B6C669DAB2B8514B32C7DF9244833E5E73AE0AC34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4340-24-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/4340-38-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/4564-0-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download

memory/4564-8-0x0000000000D30000-0x0000000000D51000-memory.dmp

Download