29453435d8f180f084c22981b86f85082aa5ebaa5dbef03b2e516c5ca579c372

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 08:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe
Size 3.8MB
Sample260831-kpy73aycph
SHA256 29453435d8f180f084c22981b86f85082aa5ebaa5dbef03b2e516c5ca579c372
MD5 86354c630d8e03608f3a735631359527
SHA1 abf338118617e7bbfb7da8e25723c0ae913ca759
SHA512 fee8e787b849e4d33eb772099e674bd697329a308e1cf088aac515d0e7b8ff749d81429722a82a152217d7061b573fd70d31bac47177c6024e95049a46a1c179
SSDEEP 49152:U+ES+ErhOM+EC+Em+Es+E7+ES+ErhOM+EC+Em+Es+E7+ES+ErhOM+EC+Em+Es+ED:V555
TLSH
T121065B08F58750B5D86B41B04D9BD2BF8931BA3187218DEFE788C67FA923BD06538B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1208	svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
1356	svchost_CCBAACCAAACBBBBCBACACACACCCCBBBABBACCAAAAAACBCCCAACCABC.exe
5664	svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBBCABBAAABBBCCAABBBCCACABCBCBCBBCCBACCBBAACBACCBBBBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe"	2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCAABAAABCBCABAAACBBCABAACABCCBBCBCACCACABABCBACBABBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBAACCAAACBBBBCBACACACACCCCBBBABBACCAAAAAACBCCCAACCABC.exe"	svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1776	sc.exe
1956	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
672	cmd.exe
6032	cmd.exe
1624	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBAACCAAACBBBBCBACACACACCCCBBBABBACCAAAAAACBCCCAACCABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3556	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3852	2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe
3852	2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe
3852	2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe
3852	2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe
1208	svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
1208	svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
1208	svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
1208	svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
1356	svchost_CCBAACCAAACBBBBCBACACACACCCCBBBABBACCAAAAAACBCCCAACCABC.exe
1356	svchost_CCBAACCAAACBBBBCBACACACACCCCBBBABBACCAAAAAACBCCCAACCABC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3852	2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1208	svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
Token: SeDebugPrivilege	1356	svchost_CCBAACCAAACBBBBCBACACACACCCCBBBABBACCAAAAAACBCCCAACCABC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3852 wrote to memory of 6032	3852	2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe	92
PID 6032 wrote to memory of 3556	6032	cmd.exe	94
PID 1208 wrote to memory of 5416	1208	svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe	95
PID 3852 wrote to memory of 1624	3852	2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe	98
PID 1624 wrote to memory of 1776	1624	cmd.exe	100
PID 3852 wrote to memory of 672	3852	2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe	101
PID 672 wrote to memory of 1956	672	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_86354c630d8e03608f3a735631359527_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAAACACBBBCBCAABAACBABBCABBACBABABBBABBCBACBBCCBAACCBBBBABCBABACACBBBAACCACAABABCABCABCCCCCCBBABBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCAAACACBBBCBCAABAACBABBCABBACBABABBBABBCBACBBCCBAACCBBBBABCBABACACBBBAACCACAABABCABCABCCCCCCBBABBCABC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABCABABCCBBCBCBCCBBCAACACBACACBAACCACBAAAABABAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe" start= auto displayName= "UserDataSvc_AAABCABABCCBBCBCBCCBBCAACACBACACBAACCACBAAAABABAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AAABCABABCCBBCBCBCCBBCAACACBACACBAACCACBAAAABABAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe" start= auto displayName= "UserDataSvc_AAABCABABCCBBCBCBCCBBCAACACBACACBAACCACBAAAABABAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1776
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AAABCABABCCBBCBCBCCBBCAACACBACACBAACCACBAAAABABAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AAABCABABCCBBCBCBCCBBCAACACBACACBAACCACBAAAABABAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5416

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCAAACBBBBCBACACACACCCCBBBABBACCAAAAAACBCCCAACCABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBAACCAAACBBBBCBACACACACCCCBBBABBACCAAAAAACBCCCAACCABC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1356

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
1⤵
- Executes dropped EXE
PID:5664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 02084b9e24b9b06130f13ee6abf4b59c4c3cb03eea21134895a3953dae0427eb
MD5 9a12a18537fdc3433487b3abbd18ceb5
SHA1 de561ef1808878a86d48626e259b8af55413efd1
SHA512 fb31442d94f90d8eeb11e167bde7c823fd243d6fc190236870f1425c42dd8bdc7f24732aa9bf6689e7176e4a5129dc84b7fa3af42ed78ca272e9d00fb28dd9ef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1d9bfc6c29953b67c2234c12a2417806c8038d1ca214a25e11ee312ddb548ff9
MD5 a3b729413c5cbd9f375d1248b0e7397c
SHA1 3ed1ec48b62376cf1a32625b775207cc79e353ea
SHA512 0b76cb8f053963595c7072111750f315801595e219d30969c8c9d6a4a205c87aa95472309e1920bb5bc6297c12fa4a800002eca983594435491009d0ad380d0c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a9b462cb934479be98f5863cfd42006d3942609e6ef9b000c98d1ec8e3709d23
MD5 2a7882419e02e10f03f75d2c3b0b3a76
SHA1 abcd0580c08d8617f9cc35dae815a47893d971ea
SHA512 e80454826643028447ad46c0e4ab6abe8841114ca9db5baef0e22236a1e712cd41d9eda19374c9009547e24e767a1e79da5f2ed9f07c4a21a2edd90a43e6c069
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0e0677961d1ba5888c9a5512626df204d4726b5bd8b6a59f8cdf110465aa20a3
MD5 7ec0b33f951b8d111a3151aaf7b74a51
SHA1 89b0dfeb7c8767a0070f3d47e7da1db04cec9bdf
SHA512 510a14c997ec04442206bada8737fec9677375623ca556c4522d5012eb22d7f651c455dc1de01cc609e33b418021ce0ad6395bacaf0057153016f26e9089d1ef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aa6100bc7de64b98adfe1db6ce2df5b1abd973a9720ab854a9ff441fafe18d83
MD5 cbf6ed469f779cedec66a7680456aa7d
SHA1 7282296a94b55dac10d58072b5e044881a4316a9
SHA512 5662bfac24f32d3d00d31d848166e044dc1df458f7c29eb4522a1bf39f07df620864d978dff9599681a083c8c2339039caf3bc905251e8ebd3449d6a9e1d0bef
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3a51d4d720b49edd0f0c34af61321ac9157f6d63caed406ca1e5396352b9a11c
MD5 1ffb5ae83de407db422302f6afde7ae8
SHA1 8ff826cc178311d5407e80d31bc4f1b175d7668d
SHA512 025d19ddecba6fe24f710a0eafcf6be5a1027efe7a21a6873544028975693046ce38f96acd0a280d36fe4b68b08ec1452e5808fe95d2fbb1704c293dd72323f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1225de6eba3d070d1dd79abfd9bb3645e0a1ebdf917737bc703ef868ee75260b
MD5 c75b0b21c9d5ede974aae6934f56cabe
SHA1 fabc59d871feaf52ba245a5ae1d51e1f1b225be5
SHA512 4def68fe37a7a25791fb8f7f84da4de6bd7c74243142a0518999136a4fda1d186403cfe81043193dad879b3e08c15f5a53a8bc359de7a747c74c72103b8c0053
MD5 SHA1 SHA512

Submit Download

svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABAABBCCACCBABBCBBCAACBCBBCCACACACCABBABBAABBBBACACBBC.exe
Size 3.8MB
SHA256 29453435d8f180f084c22981b86f85082aa5ebaa5dbef03b2e516c5ca579c372
MD5 86354c630d8e03608f3a735631359527
SHA1 abf338118617e7bbfb7da8e25723c0ae913ca759
SHA512 fee8e787b849e4d33eb772099e674bd697329a308e1cf088aac515d0e7b8ff749d81429722a82a152217d7061b573fd70d31bac47177c6024e95049a46a1c179
SSDEEP 49152:U+ES+ErhOM+EC+Em+Es+E7+ES+ErhOM+EC+Em+Es+E7+ES+ErhOM+EC+Em+Es+ED:V555
TLSH
T121065B08F58750B5D86B41B04D9BD2BF8931BA3187218DEFE788C67FA923BD06538B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1e084fb920983351d7fab39dbb948504c0901eabba1552d610ed913a62372823
MD5 fdec266330b3874320972af48f00fd41
SHA1 445e7a667432cd40d9f55cc03b3e8ffdf170501f
SHA512 02ea1cf4a0f8bb251e9d23587845c893fcc4ac2ee2e524461085ef708afe1d94acbb23131a71590587b8aabe9b5fc9285e97628dadfe8f1f16c4f134acf8dfdf
TLSH
T16211AB52D1E5D4E7F43268DF922DEA9B0CE4778FAC586A143316C218B7D5C308D558D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1208-34-0x0000000000BB0000-0x0000000000BD1000-memory.dmp

Download

memory/1356-74-0x00000000005C0000-0x00000000005E1000-memory.dmp

Download

memory/3852-8-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download

memory/3852-0-0x00000000002A0000-0x00000000002C1000-memory.dmp

Download