be12027855b64db49b90ec510f21c058ebbf7c6de0014947cc9fe27b7708e8ff

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
Size 2.4MB
Sample260831-e46ykavcme
SHA256 be12027855b64db49b90ec510f21c058ebbf7c6de0014947cc9fe27b7708e8ff
MD5 ca0386fac54c08f06e0e1e984ddf41ef
SHA1 352e7ef8a5c1867a228c932633c5cff2764be482
SHA512 908ee91c27d0caac5f7b158ccc47464d07ef5b6f294531281666ed33f0ca0af02460f3226f0f3a40ac673be077be7ceb3f9673db1e07d2abea579ba389785a7c
SSDEEP 49152:U+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EbpO4q7rHbBSUldP0v7f8IUhabas4f7f:KO4q75Av7fbUhabgf
TLSH
T1E9C53B2CFD9541B2D436867088D7F6FEEA317912A6004F9FA5D6434F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2644	svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBACBBCCCCABABCABBCCBCCCCACBAABACCBAACBCBCAACABACBBCBAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe"	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
544	sc.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1800	cmd.exe
4420	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3288	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4540	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
4540	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
4540	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
4540	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
2644	svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe
2644	svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4540	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2644	svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4420	4540	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe	99
PID 4420 wrote to memory of 3288	4420	cmd.exe	101
PID 4540 wrote to memory of 1800	4540	2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_ca0386fac54c08f06e0e1e984ddf41ef_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBBBCCCBCACBCAABBCAABBACBCBCCBBBAABAAACACCBBABBCACBAAAACAACABCBAACBABCBAABCCCCBABABACBBBBCCCAACCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4420
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBBBCCCBCACBCAABBCAABBACBCBCCBBBAABAAACACCBBABBCACBAAAACAACABCBAACBABCBAABCCCCBABABACBBBBCCCAACCACCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3288
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCBCBBCACABCCBBBBABBCBCCACBCBABAAACAAAAACABBAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe" start= auto displayName= "UserDataSvc_CBCCBCBBCACABCCBBBBABBCBCCACBCBABAAACAAAAACABBAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  PID:1800
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCBCBBCACABCCBBBBABBCBCCACBCBABAAACAAAAACABBAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe" start= auto displayName= "UserDataSvc_CBCCBCBBCACABCCBBBBABBCBCCACBCBABAAACAAAAACABBAABBC"
    3⤵
    - Launches sc.exe
    PID:544

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ef9b99b0e2ca8e7ea1a1050bc31220a196743795a0a93a6fea789934796280d
MD5 b9f03d9057d3d97d6e82529a3450b8b7
SHA1 40452ca7a8291f37e3621866b06fbdf191e15cdf
SHA512 8a68947ca782525ded825aaf13f92c5635c5d8c88a60540c524669a3b8399329f4984efe1de937d3454ec2e466f49cbe9f9a21577bfb5aa5964594f9b4b065d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 309f1fee7e07e18a2b9ff3b56157fb149b46b18975bb308f18b0034f118a8550
MD5 9e18d3484b61b0bd08e934eefe923965
SHA1 4c3477f561e2e1535d8fa20b6f99fff4fe89426f
SHA512 8151ea6d4b303cb732f27ae6559b2f36dd0585746f1428fe530b85fd5f880cb2a965250054118d3cb329e1f5735b77437607d6a2616c42140caa8bc8d2ad1f07
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3450a61bbcb826a7c8e5c8710dc3775ccc23dd2cc206de170a47c49765200b21
MD5 d18f671aa5a48f5056283d858b7d028e
SHA1 b93bb2faecc755483a4116c4e7ee5bfe3a0cc1c6
SHA512 b26b52c754073db5e98375a53f0c7e3321c2d9b196cd4eaa660a6e7f2263df571c017174863f9b9ce28b4cfa3fe4b7037bfa0bc92020d2ae4176308b543397d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b4ae6a47e2360a1307aaa981b6140b99991274749582b038116f91c3dfbb6547
MD5 0db93fc33fd4de4624f58494c09cbca6
SHA1 3478bf1a0611eb920e023886f9ca0c914081da42
SHA512 9688819f15d1c29f38d8a7a77a4d525ed95d3e3acef57cc8c5935e4cc3fdc373d49729774cfe310791ede3053fa6c6e3a59ee54333eff9661c327e2b2dc8b004
MD5 SHA1 SHA512

Submit Download

svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABCCBBABCBCCACBBAACBBAABBBAABCAABBAACACBBAAACCCCCCBCBA.exe
Size 2.4MB
SHA256 be12027855b64db49b90ec510f21c058ebbf7c6de0014947cc9fe27b7708e8ff
MD5 ca0386fac54c08f06e0e1e984ddf41ef
SHA1 352e7ef8a5c1867a228c932633c5cff2764be482
SHA512 908ee91c27d0caac5f7b158ccc47464d07ef5b6f294531281666ed33f0ca0af02460f3226f0f3a40ac673be077be7ceb3f9673db1e07d2abea579ba389785a7c
SSDEEP 49152:U+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+Ex+Ex+EbpO4q7rHbBSUldP0v7f8IUhabas4f7f:KO4q75Av7fbUhabgf
TLSH
T1E9C53B2CFD9541B2D436867088D7F6FEEA317912A6004F9FA5D6434F4D3BB926C20E29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2644-28-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/2644-41-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/4540-0-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/4540-8-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download