b8aa4c9580f5aaeb424de722d0b79b7d03e55701dbdd9356db7592a71475631d

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe
Size 3.7MB
Sample260831-ms2tgazfkh
SHA256 b8aa4c9580f5aaeb424de722d0b79b7d03e55701dbdd9356db7592a71475631d
MD5 5f5b5e2202860b924cc54054de8109ed
SHA1 cf19cceefb9b283e2cee1dba9faeb84b0f6ecd79
SHA512 674e3c349bb8becee482585f07f096afb17625d81b52db9b078245b59bc8b7eaf581a771ee4cf05696dfad5945af8a47277c02082268693f074eef2b23e7f332
SSDEEP 49152:U+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+:W
TLSH
T15E064B09FD8644B1E97B41B04CDBD2BE9530BE218B128EEBF649E72FA933BD05434615
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3068	svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
2720	svchost_ABACBABCABCAABAABACACCCBCABCCBCBCCCBAACBCBBCAABBBCBCBBC.exe
2608	svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBCAAABCBACABABBAACACABACBBACBCCBBCCBACBAAABCBBBBAAABBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe"	2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCCACBCAACABCBBBACCCBCCBBABACCBBACBBBCAACACAAACABAAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACBABCABCAABAABACACCCBCABCCBCBCCCBAACBCBBCAABBBCBCBBC.exe"	svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4340	sc.exe
3184	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2024	cmd.exe
2284	cmd.exe
4900	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACBABCABCAABAABACACCCBCABCCBCBCCCBAACBCBBCAABBBCBCBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1028	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3452	2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe
3452	2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe
3452	2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe
3452	2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe
3068	svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
3068	svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
3068	svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
3068	svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
2720	svchost_ABACBABCABCAABAABACACCCBCABCCBCBCCCBAACBCBBCAABBBCBCBBC.exe
2720	svchost_ABACBABCABCAABAABACACCCBCABCCBCBCCCBAACBCBBCAABBBCBCBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3452	2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3068	svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
Token: SeDebugPrivilege	2720	svchost_ABACBABCABCAABAABACACCCBCABCCBCBCCCBAACBCBBCAABBBCBCBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 2284	3452	2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe	92
PID 2284 wrote to memory of 1028	2284	cmd.exe	94
PID 3068 wrote to memory of 1216	3068	svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe	95
PID 3452 wrote to memory of 4900	3452	2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe	98
PID 4900 wrote to memory of 4340	4900	cmd.exe	100
PID 3452 wrote to memory of 2024	3452	2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe	101
PID 2024 wrote to memory of 3184	2024	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_5f5b5e2202860b924cc54054de8109ed_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCCBBBBBBACBCCCCBCABACBBABCCCCBACACAAAABBAAABAABCCBABAABBCBBABAACACCBBBAABBBCBCCBAABCACCAACCABBCCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACCCCBBBBBBACBCCCCBCABACBBABCCCCBACACAAAABBAAABAABCCBABAABBCBBABAACACCBBBAABBBCBCCBAABCACCAACCABBCCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1028
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCAABCABBCCAABCAAACABBAACCBAAAACBAAACBBCBBABCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe" start= auto displayName= "UserDataSvc_CACCAABCABBCCAABCAAACABBAACCBAAAACBAAACBBCBBABCACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCAABCABBCCAABCAAACABBAACCBAAAACBAAACBBCBBABCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe" start= auto displayName= "UserDataSvc_CACCAABCABBCCAABCAAACABBAACCBAAAACBAAACBBCBBABCACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4340
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCAABCABBCCAABCAAACABBAACCBAAAACBAAACBBCBBABCACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2024
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCAABCABBCCAABCAAACABBAACCBAAAACBAAACBBCBBABCACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3184

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1216

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABCABCAABAABACACCCBCABCCBCBCCCBAACBCBBCAABBBCBCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACBABCABCAABAABACACCCBCABCCBCBCCCBAACBCBBCAABBBCBCBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
1⤵
- Executes dropped EXE
PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 70f9b28b33cca990078a796c435c375220e66613db9ee87f965e923c752bacab
MD5 1f4ee6eada5c4b23610ce1377ce5915b
SHA1 c7ce8a1034f3f885281c4c17d365fe13881aec81
SHA512 0809a18d608d19c02428c95bed291869ad2f73e9b0791ecf58330bfb7df04ba8668d2d068a776569b3974eb96065b809b890959efa1dc05140cba11bede37496
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 34639a25a42b02ef49fe539fe5f6102904000e08d54dfbabaf8cc250e7968c78
MD5 a0944279b65f0c696f5949402760328e
SHA1 5afa87c201b4bfa47ff3ff832e6949e66cf82a30
SHA512 c7a9a6edc80967e23dabff3be5c509416a55288d712b561ec751110957abc093aa0ccdb1f68263127d27e28834fd53134ed1398708fe0e612476f333b6097115
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a5fa29fbb5e6666515e84e6a0374e2e179819a075699213d4161742a63db6acf
MD5 d4434478a9b82b885dbc4fd64ba4db54
SHA1 73531e7775c84293b02a63548e256e1b8afe4ef5
SHA512 63b3deee10ed7b48f096d202b7cc8b0cd1a61e9637e27f965597f8e8a3c48e2d69500d6df8b8ef8347852505a031861d88f1a449549ef9b1f7a82f21842a7b71
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7d82c33506f521ec8b4d9e2ffdb516ccc7703b515e41f4989951d8c4f031e349
MD5 d38fa5469613298bcc67a7f86450b641
SHA1 17e84f3edd0d634d8a072d51bdc516f495ce8d06
SHA512 9181dd2559c5c2fdb895740432b703e826c1997c7b65d19ff5ffd6ae399b086083a9f63cb6453449096cd9612cb59c686779ac1c8206dcb071b2a737c41458d7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6c4a9939014e8c27dc26e75ef73673c47aec38774b5d7d3c8a08743c74c237a9
MD5 234acd8db07ad507ace1dad91751ed20
SHA1 4f83cf06e2c2acbd3efa3727e8574e31cd8766b7
SHA512 38f89b6ec2d870e51d2c65fcd4d1376509c724d68d9e52c6d01e11828af25d5bf5212f55b5120d9f8f1e97d82a797d81a6fb4213338d0f24ae80161ab8947067
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c0e8abb4fbb68ad00338a626053c12bbb88baa47031ec44e30fa0a08445fd204
MD5 fd0a888b107c28d5b843b9bd5b30f0f9
SHA1 4c0c9e4f56e6817d4c7e16fac013ba4da3359457
SHA512 b47187f20e608b492de9a601558e9c01be6a56e0b5843a8585cf255c1d666bd70d33d7c63fb0a2eb677ae8585f3d637eb9804692d6245c16c4feb1c4fc138a73
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e30ee4e7db46b8606e914943952c9a759c1c26375d809d4b14bae99955404bfb
MD5 eeafdad51f06d659dcedca58e40bd842
SHA1 f8e64f10473416bca15ea7ff3204776d5bb8c425
SHA512 92fc3c4f2c5c27b24d1a68d3be39c3dd100b5be515142fc070407edd395f8566d3266c53db298d51e3eaaed3b2a886787854a5dab1b69f11209d90ed4449bd9e
MD5 SHA1 SHA512

Submit Download

svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBACACCAAACABCAAAACBBCCAAABAAABBBBABCACCAAABAACACBBAAA.exe
Size 3.7MB
SHA256 b8aa4c9580f5aaeb424de722d0b79b7d03e55701dbdd9356db7592a71475631d
MD5 5f5b5e2202860b924cc54054de8109ed
SHA1 cf19cceefb9b283e2cee1dba9faeb84b0f6ecd79
SHA512 674e3c349bb8becee482585f07f096afb17625d81b52db9b078245b59bc8b7eaf581a771ee4cf05696dfad5945af8a47277c02082268693f074eef2b23e7f332
SSDEEP 49152:U+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+Ef+Eg+ES+ES+Eg+ES+ES+EkN+Eg+ES+ES+:W
TLSH
T15E064B09FD8644B1E97B41B04CDBD2BE9530BE218B128EEBF649E72FA933BD05434615
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 d6bd03eab2dd3e76e56de6c750421434fd40fa0d65a4cdcb20fb70ebb29765b6
MD5 851f26cb373e599bade38fea6ecd644b
SHA1 fe020c62d6c2a0ac0081e97a1138a5813133d188
SHA512 e558c9be73d23463cd2f32b77df827494cb8db6b0ee6d673b5720c6f28143fae08c7eed46a482092437b7ec72de3865776aa90b728fb9df7beb7d47f7007abd8
TLSH
T13111012190E5CCE3E43274EF6122CAC708EC379A9C5C6A21631C811CA7D28328D258F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2720-78-0x0000000000810000-0x0000000000831000-memory.dmp

Download

memory/3068-34-0x00000000000D0000-0x00000000000F1000-memory.dmp

Download

memory/3452-0-0x0000000000360000-0x0000000000381000-memory.dmp

Download

memory/3452-8-0x0000000000360000-0x0000000000381000-memory.dmp

Download