287fc4849aab42e934bc359183d8aa10711f8a3a12f38e543483580c92a259ff

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe
Size 26.8MB
Sample260831-tkknjsvhpf
SHA256 287fc4849aab42e934bc359183d8aa10711f8a3a12f38e543483580c92a259ff
MD5 a97d3d5019bcfba8ca0bc5bb7beea939
SHA1 27c59c5b4b9e8e49236051c14377978f7cae3e4b
SHA512 a216865a223e1a80123d168e88a8d6f228d47fa8ed4e1ad76885e27dad46f348b18e7bca0788c33ca4af4b251836a85870a7a921e67eb6cdf51f3f1939c7949f
SSDEEP 786432:+5U5U5U5U5U5U5U5U5H5U5U5U5U5U5U5U5U5V:s
TLSH
T18C572A19FA4350B1D92B50B04CCBD3FF8E606B2583124EFBFA4DCB1B6927AE16439255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2628	svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
4732	svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
4392	svchost_CBBACCCBBCCABCBACBAABCABCACCBBBACBBABCCBABCABABCACAABBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CABCABBABACBACACCCCBCCCAABAAAAABBBBCBCBABBBAACCCCCABBACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe"	2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AABCAAAACACCACACAAACBACAABBBAACCCACCBCBABAABCACBBABBCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBACCCBBCCABCBACBAABCABCACCBBBACBBABCCBABCABABCACAABBB.exe"	svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1632	sc.exe
1204	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2924	cmd.exe
4168	cmd.exe
3612	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBACCCBBCCABCBACBAABCABCACCBBBACBBABCCBABCABABCACAABBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2964	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2732	2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe
2732	2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe
2732	2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe
2732	2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe
2628	svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
2628	svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
2628	svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
2628	svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2732	2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2628	svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4396	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 4168	2732	2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe	98
PID 4168 wrote to memory of 2964	4168	cmd.exe	100
PID 2732 wrote to memory of 3612	2732	2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe	101
PID 3612 wrote to memory of 1204	3612	cmd.exe	103
PID 2732 wrote to memory of 2924	2732	2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe	104
PID 2924 wrote to memory of 1632	2924	cmd.exe	106
PID 2628 wrote to memory of 2576	2628	svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe	108
PID 2576 wrote to memory of 4880	2576	notepad.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-31_a97d3d5019bcfba8ca0bc5bb7beea939_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCBBBBCBCACCCAABCCCCCABABACCABCABABCBCBAABBBBBCACCCCACCCBAABACCBAABACBBBABABABBABABABACCCCAACCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACBBBCBBBBCBCACCCAABCCCCCABABACCABCABABCBCBAABBBBBCACCCCACCCBAABACCBAABACBBBABABABBABABABACCCCAACCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2964
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBBCCCCCACCBBABBCABCCCBCABCAACBBCACCBABBCCAABCCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe" start= auto displayName= "UserDataSvc_BBBCCCCCACCBBABBCABCCCBCABCAACBBCACCBABBCCAABCCBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3612
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBBCCCCCACCBBABBCABCCCBCABCAACBBCACCBABBCCAABCCBBCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe" start= auto displayName= "UserDataSvc_BBBCCCCCACCBBABBCABCCCBCABCAACBBCACCBABBCCAABCCBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBBCCCCCACCBBABBCABCCCBCABCAACBBCACCBABBCCAABCCBBCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2924
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBBCCCCCACCBBABBCABCCCBCABCAACBBCACCBABBCCAABCCBBCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1632

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4880

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
1⤵
- Executes dropped EXE
PID:4732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBBCCABCBACBAABCABCACCBBBACBBABCCBABCABABCACAABBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCCBBCCABCBACBAABCABCACCBBBACBBABCCBABCABABCACAABBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eed8940ce044a9a058798467564b898adeb02f41e84f7c4d51c4ee0efc6a268f
MD5 afc7fe74fb00991deb172cf0c601e5ee
SHA1 b52eef0dc81bf743218ab8c46c18b88a0832d296
SHA512 0bd8c50388d6411dc1366103dc121d9068deff14d160f01f2d481e58c2697ac97d73321a50a2a46982b958b3fe704bbd686dbd6507843551ace6da17163243ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 697f9b501a7e9d3674f3da621f3085093b1fa750519ce19a4e9643a178943ef3
MD5 87cbd61c9f25a9068e0336e34241211b
SHA1 b40041143001f025f257ede7c022317696432377
SHA512 898815d2caa8c54500a2ac2c33c984e24aab68a633d6d85517e2f19e401482e7d1779ec79475db879e802211dbe9408ab556f083d99ed1ebe02b4f5be2a5fc80
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 74ec61cec471f0ae260107c19da45b47bc406f603be5fa76c4a24bb6d0bbc828
MD5 9a4be07fcf4275a5ac3c4009b2a1ae76
SHA1 85a42c29321c0dd013105a892c91a2ed5b1521f7
SHA512 fd497c7b924b55c0984436345606666b612d85b231519831f909151f486378380438cd5233023eb36c0ca062d26e96cf1395f7260fd46bbd025d7d7aebf679d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e9c54b41658719d082d32bd7b36a45834dd26b6cdf3baf25177bfe43b079d23c
MD5 6e1638b50c8af96a98a26d09d44cd9b1
SHA1 08a7ef93501fcdb4b49578cd367a4bf474a5e941
SHA512 3e905f74dc1da74c37a6d0858b242c01fa44ec9ad2a7390a8a072c5f1cf68beba54af70da85e9c863fa42e88511188e2741f63184718d898c7b556530aa7ffc5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ac38c9408dd137a5e566685b072d7f777dcfadfbc3ae3d88a284be5108b5d783
MD5 c26a541c15bb70aa88fedb5193009e5e
SHA1 4bc6f1982eeb2871d28dabb52b220b4db8b5384c
SHA512 e77a679d725ffd91b7ee6d77c044e95471cf47447b4beae140b999c1eaef223a08ad94a24a4cb9bfe7f3dbfac026ff1e1a09a5faf1bec2732dd7f346f5a42f51
MD5 SHA1 SHA512

Submit Download

svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCBBCAACCBCBBBBCBBABCBCAAABCBACCACCBAACCACBACACCCCCCBB.exe
Size 26.8MB
SHA256 287fc4849aab42e934bc359183d8aa10711f8a3a12f38e543483580c92a259ff
MD5 a97d3d5019bcfba8ca0bc5bb7beea939
SHA1 27c59c5b4b9e8e49236051c14377978f7cae3e4b
SHA512 a216865a223e1a80123d168e88a8d6f228d47fa8ed4e1ad76885e27dad46f348b18e7bca0788c33ca4af4b251836a85870a7a921e67eb6cdf51f3f1939c7949f
SSDEEP 786432:+5U5U5U5U5U5U5U5U5H5U5U5U5U5U5U5U5U5V:s
TLSH
T18C572A19FA4350B1D92B50B04CCBD3FF8E606B2583124EFBFA4DCB1B6927AE16439255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2576-67-0x0000000002330000-0x0000000002331000-memory.dmp

Download

memory/2628-25-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/2628-38-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download

memory/2732-6-0x00000000000B0000-0x00000000000D1000-memory.dmp

Download

memory/4392-82-0x0000000000690000-0x00000000006B1000-memory.dmp

Download

memory/4732-75-0x0000000000E30000-0x0000000000E51000-memory.dmp

Download