b63401a70bd9280b3c511a2a9ff1c89591ad82608d850a025e8040a1550d17a6

Analysis

max time kernel
149s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe
Size 7.1MB
Sample260828-txxtmszybs
SHA256 b63401a70bd9280b3c511a2a9ff1c89591ad82608d850a025e8040a1550d17a6
MD5 568b0e355d7429ab8630bc530673c249
SHA1 934fa66fdf77080d7bc84e68ee134a5b39dd974e
SHA512 4c1e548faf34c07d6fa2cbdb5c8d794f0451ef5f9f79f19eb09ff3a4717f3f5c822869c29fca756d2b6144fa6ea0008b2f430f6f53f1b375c093a7945e3d6ae8
SSDEEP 49152:U+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E+:xXXXXXXXh
TLSH
T11D76F605BA8584B1D9660570499682BDA230BD11CF038EEBB684BFEFFFF36D05925634
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5440	svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
756	svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
5020	svchost_CCABCABAACCCACABBBBBABAAACBACCACCCCCCCCBACCBAACCCCAACAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABABBABAAAABCBBCBABBABBAABABBBBBCAABCABBCBABABCBBBCACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe"	2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCBBBCCAAAABABCACCCBBCBACBABCBBBBCACBCBCCBCCABACAACACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCABAACCCACABBBBBABAAACBACCACCCCCCCCBACCBAACCCCAACAC.exe"	svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
672	sc.exe
1396	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1936	cmd.exe
2808	cmd.exe
2844	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCABAACCCACABBBBBABAAACBACCACCCCCCCCBACCBAACCCCAACAC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1200	2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe
1200	2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe
1200	2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe
1200	2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe
5440	svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
5440	svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
5440	svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
5440	svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1200	2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe
Token: SeDebugPrivilege	5440	svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 1936	1200	2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe	95
PID 1936 wrote to memory of 2268	1936	cmd.exe	97
PID 5440 wrote to memory of 1272	5440	svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe	100
PID 1200 wrote to memory of 2808	1200	2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe	101
PID 2808 wrote to memory of 672	2808	cmd.exe	103
PID 1200 wrote to memory of 2844	1200	2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe	104
PID 2844 wrote to memory of 1396	2844	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_568b0e355d7429ab8630bc530673c249_elex_icedid_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBBBACCABCCAABCAABCCBBCBACCCBABABCBBBBCABCBBBABCBCBBAABACAACCCABBCACBCABABCBCBBCACBBCBBCBBBCBAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBBBACCABCCAABCAABCCBBCBACCCBABABCBBBBCABCBBBABCBCBBAABACAACCCABBCACBCABABCBCBBCACBBCBBCBBBCBAACCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCCBCCBABCCBBBBCABABAABBCAABAAACABCCACBAAAACCCBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe" start= auto displayName= "UserDataSvc_BBCCBCCBABCCBBBBCABABAABBCAABAAACABCCACBAAAACCCBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCCBCCBABCCBBBBCABABAABBCAABAAACABCCACBAAAACCCBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe" start= auto displayName= "UserDataSvc_BBCCBCCBABCCBBBBCABABAABBCAABAAACABCCACBAAAACCCBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCCBCCBABCCBBBBCABABAABBCAABAAACABCCACBAAAACCCBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCCBCCBABCCBBBBCABABAABBCAABAAACABCCACBAAAACCCBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5440
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
1⤵
- Executes dropped EXE
PID:756

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCABAACCCACABBBBBABAAACBACCACCCCCCCCBACCBAACCCCAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCABAACCCACABBBBBABAAACBACCACCCCCCCCBACCBAACCCCAACAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PingSubmit.exe

Path C:\Users\Admin\Desktop\PingSubmit.exe
Size 14.7MB
SHA256 25c7bf9d6758e32e7c0ee04984f0f1097100e9b9842a5e0155b260343bab73cd
MD5 a5edc9c009e4e9351719b5f4e73f2036
SHA1 97039f387278fa9ed183eb93ff6317ec1e5fa013
SHA512 de2a016067ecec4f2741254fc94bb83ecd27fec337a479ec2255239a92a8c1e460255ef86d9cca98bda5f0b2d64ff5693c6825a81784d7994c92729ce10c5c7a
SSDEEP 49152:U+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+EE:xXXXXXXXzXXXXXXXi2hNT
TLSH
T1DCF60605BA8584B1D9660570499682BDA230BD11CF038EEBB684BFEFFFF36D05925634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSubmit.exe

Path C:\Users\Admin\Desktop\PingSubmit.exe
Size 43.0MB
SHA256 0cd2429b92f0495b8418734487d09c91c81e9b33b600a8566622f44a434b4dd1
MD5 c0ea8df62c26c30c6b83e34e1b2334db
SHA1 4f7d8f07a974f38153979bd7450ea65a4a6592f1
SHA512 97bc75b0b20a186fe4c22615b3c38661b037be6734a7acaba38e6069eab3144e6820be8bd06c208f2ea77fb8b3e47556c6d86db41d41d8530e6738126b0e6c19
SSDEEP 196608:xXXXXXXXzXXXXXXXzXXXXXXXzXXXXXXXzXXXXXXXzXXXXXXXiqm:g
TLSH
T1C6A7F605BA8584B1D9660570499682BDA230BD11CF038EEBB684BFEFFFF36D05925634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PingSubmit.exe

Path C:\Users\Admin\Desktop\PingSubmit.exe
Size 8.1MB
SHA256 e69780fa0b7584ef2be40264a86ed4ed6af28652a9fc018b3ebadbdbdd38c624
MD5 31901cbd681a14c22e40f5565394dac2
SHA1 39fc994310d0e24a9b5915a6fab468fc38d9785f
SHA512 3a1e4b694cfec0786c80f9a1c51419abf282665ee70e9a5df3fad01622eba9e0c1ecfe691e3428c37b7a3ac98bd416b9ef698672b5f414938975ce856bda5fe0
SSDEEP 49152:U+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E6:xXXXXXXXzd
TLSH
T12686E605BA8584B1D9660570499682BDA230BD11CF038EEBB684BFEFFFF36D05925634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9f2c86fe8d82eb1ba35f3f9e389037adb78fa315176ebeb9761378e9f556f359
MD5 be1224a459843f7737f81ef0552aea19
SHA1 ee35a4826ff139068188d80aaee863afbcf95756
SHA512 8f77b18ef7c19dc46615e9bf635223aaba1546cc0a1a74222cf6fcf47eb99253a3ba3d0fa1da491bfc012001e48cacdde35797c985773c7277213f034a65ef4f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c382e05b08d028164adb23ebe61f09f8f2da247cd1987c25fc48e8bafcdb499
MD5 3e762cdd8c8deb170e193d5200eef74d
SHA1 e2faa0c22d4680185fce56c101ec0caaa46c84d3
SHA512 74e325cf23de81638e884f654fb9edb6969b7c74c2c1d78d71008e012bcf2de64e6b4b34c9a13cf3f710cf1d172c0f286be0429ed2b3ada989bd8c29c4992050
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 88b321697267fd1967c6eac496844af6ecab695c6af33fb9b5ad816f33a9efe4
MD5 738473a90e9dcf4ef41fb553bed13e13
SHA1 22b7d228531e29ee8012c6e551ec1e569d18dd6e
SHA512 7b91620edb40c44e696c954af809d41ca27720132261e6ce5c6a4449ad2e89ae5f7556b9dc234b88a0640972a3b203bb2100e83108f0f0897601b72aaa5d930f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c2c999939956562b5fc2a497d1150506827eb59a7dda6b688b5c35ef0a1370cd
MD5 f6a7107c9ef309a6703db928c8cc5401
SHA1 5d5a2c48d4ff0a0326c30c058003dc9b4e79561a
SHA512 d6c4203fe574d95d9bd62d8eaca7b6ec62707ac29c7824493c94a920f1321d7cd24e88f80b714f89bb2da12963aed5d46498d60011684437bb372c0ecba6d845
MD5 SHA1 SHA512

Submit Download

UsePing.exe

Path C:\Users\Admin\Downloads\UsePing.exe
Size 43.1MB
SHA256 3a3ae87863435f849d4d7ee73f76e829915ceec775b063b4bf5ca9b015b2b284
MD5 b64582dbef8368fa72a0f464c74d9bbc
SHA1 c5537cad4ab1fbf10b6c459aa904925a532282a5
SHA512 55f0bbbf55e0e85799a7d0fcd60733f239cc3ba37d5c288c1b0d3e00b6429ca0ecedf7cf63a7113be129e9b7debc8f2f67a8edb1c45ac9017a8f39ee3b4c610b
SSDEEP 196608:xXXXXXXXzXXXXXXXzXXXXXXXzXXXXXXXzXXXXXXXzXXXXXXX05nJ:i5J
TLSH
T118A7F605BA8584B1D9660570499682BDA230BD11CF038EEBB684BFEFFFF36D05925634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UsePing.exe

Path C:\Users\Admin\Downloads\UsePing.exe
Size 50.1MB
SHA256 a43f8563ca4fe6d2c150c1e9c3a6b998e485dfc8aa9d48995f7e71883781992c
MD5 2742d2f622d9a8b9a9c190cd0c8d8293
SHA1 e1a136db6dd56ef00938e48b6f1b367a05255d0f
SHA512 72ca2f66e7675f547703330003c5126309ccc2e763ffc6290ec28e3cfd96d082d0a90de2906048ed876a96fd4375a8df6a44ce266b458b529d6b0f90df2c6907
SSDEEP 196608:xXXXXXXXzXXXXXXXzXXXXXXXzXXXXXXXzXXXXXXXzXXXXXXXzXXXXXXX05nM:G5M
TLSH
T1FFB7F605BA8584B1D9660570499682BDA230BD11CF038EEBB684BFEFFFF36D05925634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBAACABBBCCABACCBBABCCABBABCCACACBAACBACBCBCABACACBB.exe
Size 7.1MB
SHA256 b63401a70bd9280b3c511a2a9ff1c89591ad82608d850a025e8040a1550d17a6
MD5 568b0e355d7429ab8630bc530673c249
SHA1 934fa66fdf77080d7bc84e68ee134a5b39dd974e
SHA512 4c1e548faf34c07d6fa2cbdb5c8d794f0451ef5f9f79f19eb09ff3a4717f3f5c822869c29fca756d2b6144fa6ea0008b2f430f6f53f1b375c093a7945e3d6ae8
SSDEEP 49152:U+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E3+E3+EAC+E+:xXXXXXXXh
TLSH
T11D76F605BA8584B1D9660570499682BDA230BD11CF038EEBB684BFEFFFF36D05925634
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1200-0-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/1200-29-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/1200-15-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/1200-78-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/1200-43-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/5440-67-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/5440-44-0x0000000000760000-0x0000000000781000-memory.dmp

Download

memory/5440-92-0x0000000000760000-0x0000000000781000-memory.dmp

Download