fc772546fa9238b46c25413e53b88f4257c8ca7375f457b89445f922c8e0ea87

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe
Size 9.1MB
Sample260905-ca4j8sbd48
SHA256 fc772546fa9238b46c25413e53b88f4257c8ca7375f457b89445f922c8e0ea87
MD5 9f8a1a771d01b62647efb30e9221f810
SHA1 42fa88ce0d2cc0a25f7f980057d211869be264a8
SHA512 d32b5132f857a85d497641f2ca5df4b9eeaab5644c1c3cb03a3ccc51ce7b033afb420b1585b86dc7c465a7596630830567bd1d6fd4df34f6157b267fbceb389d
SSDEEP 49152:U+Ef+EPiw25+Ef+EPiw25+EjozMlTzQ/7YGsTjfg+Ef+EPiw25+Ef+EPiw25+EjH:W1MbQS1MbQS1MbQS1MbQS1MbQY
TLSH
T18EA65B09B7ED44A4E5B7E07489AAC636E7B27811473197DF8691C62F1F33AD0AC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4736	svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
6112	svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
5788	svchost_CCACCCBCCBABACCBAAAABBABBCBCCABCCCBBBAACCCBABACBBCBBBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAACAACCBCCBAABBBAACBACACCCCAACCCCCABBABBBCBACBAACCCACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe"	2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCCCBBACAACACCCACBCAACACACBBAAAABBBBBCBBAAABBAAACBAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACCCBCCBABACCBAAAABBABBCBCCABCCCBBBAACCCBABACBBCBBBAB.exe"	svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4528	sc.exe
4092	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1500	cmd.exe
2292	cmd.exe
1968	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACCCBCCBABACCBAAAABBABBCBCCABCCCBBBAACCCBABACBBCBBBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5960	2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe
5960	2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe
5960	2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe
5960	2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe
4736	svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
4736	svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
4736	svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
4736	svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5960	2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4736	svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 1500	5960	2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe	94
PID 1500 wrote to memory of 1820	1500	cmd.exe	96
PID 5960 wrote to memory of 2292	5960	2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe	99
PID 2292 wrote to memory of 4528	2292	cmd.exe	101
PID 5960 wrote to memory of 1968	5960	2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe	102
PID 1968 wrote to memory of 4092	1968	cmd.exe	104
PID 4736 wrote to memory of 4868	4736	svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_9f8a1a771d01b62647efb30e9221f810_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAABBBCCBCACBCCABAABBAAABBCCBAABCCBAAACACCCBCAACCCACABBBBACABCABBAABACBBCBBCCABBAACCAACBBBCCBBCCACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBAAABBBCCBCACBCCABAABBAAABBCCBAABCCBAAACACCCBCAACCCACABBBBACABCABBAABACBBCBBCCABBAACCAACBBBCCBBCCACBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBBACCACBBAAACAAACAACCCBBCABCBBCBABABCCBBABAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe" start= auto displayName= "UserDataSvc_BACBBBACCACBBAAACAAACAACCCBBCABCBBCBABABCCBBABAABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBBACCACBBAAACAAACAACCCBBCABCBBCBABABCCBBABAABCB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe" start= auto displayName= "UserDataSvc_BACBBBACCACBBAAACAAACAACCCBBCABCBBCBABABCCBBABAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4528
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBBACCACBBAAACAAACAACCCBBCABCBBCBABABCCBBABAABCB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBBACCACBBAAACAAACAACCCBBCABCBBCBABABCCBBABAABCB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
1⤵
- Executes dropped EXE
PID:6112

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBABACCBAAAABBABBCBCCABCCCBBBAACCCBABACBBCBBBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACCCBCCBABACCBAAAABBABBCBCCABCCCBBBAACCCBABACBBCBBBAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EnableOut.exe

Path C:\Users\Admin\Desktop\EnableOut.exe
Size 448KB
SHA256 3f07e492a8bf37f48313b81a73750e0d0db82d8c706d3fa2e76368fb58638131
MD5 b1059c42bc4bc219bf6b0cb7c99cb69b
SHA1 cc5bc9b877d82b10cd2c88af5ad18512fa951f33
SHA512 2ce4b4f3184d794300b9444048c0a156b097aceadf400c26222eb566454557e894ed384c5f5deada6311dd09f141d3a54894882bf6d6d8753f89cc785ad90209
SSDEEP 6144:m+dTTUFgEs3XojAdFI+dTTUFgEs3XojAdF0VPUgjnRtnNlW4+WD8TbVC2ari:mgUFgEsnojAQgUFgEsnojAMTjkWIw2l
TLSH
T1C9A41A09B7ED0864E5B7713089A6C679DAB2B8518732C7DF9245C73E1E33AE0AC34B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

EnableOut.exe

Path C:\Users\Admin\Desktop\EnableOut.exe
Size 4.6MB
SHA256 e30a8bd36be5e8dd6bc19f84e2c038729dc984d58bda999bb74072d0f6d1378e
MD5 ccccd0c7146d828884e8a47ab2682d51
SHA1 0ffcc46523873614e48681bde36de32fd2127269
SHA512 88f2a590e130941b01eb8030f019d30f791e18ef02ad14b210abe9fa839d31ee41a0754aff4f19958c7b26d7ff243a033a5ad1b4a4c34ceefd3baf3d19c5454c
SSDEEP 49152:U+Ef+EPiw25+Ef+EPiw25+EjozMlTzQ/7YGsTjfg+Ef+EPiw25+Ef+EPiw25+EjS:W1MbQS1MbQW
TLSH
T10D266B09B7ED4464E5B7A13489A6C63AE7B278514731D7DF8291C63E1F33AE0AC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0277effa58cc192ea4903e97241cdcfabd2c41db7b0d1427f9edfde4f8295b51
MD5 83c1a4e0f37fdab517aa5e32f493893b
SHA1 3924152ddd04b6e7e0fffe502a956b8a45528e03
SHA512 f908c4dc3543869e3a8680dd8baaeb0809ecf7d2c60723277812623c2afb01a7582b70faeaeb9a02abef55570ffcf7841cde59d54cd214bfb39dfb5a05bd0bdb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 04be757dbe72f37a9b9028fab84e1d1ce5fa4cb82a5c3b8bf752acf22b60576b
MD5 a92d283b984d179ab469cab7b12eb84e
SHA1 2392ed771687d19eb9a2e37e67dd46ce2b51ae10
SHA512 678676100b0c071c2220374b77f3853afb033754972579078819141a9c08ffc150ae5e32e331eaa0499e89ba62a34aa8468cbca5a1e428a9618b8badb393745f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2dcc465609aa474bf0c786a74cac180165d1288c71e1c5d0cff2f95c0b669c77
MD5 e19903ec5c281d739bf0fede4cb9046f
SHA1 b818729e7daf6480a67e6c0b3d88231db14dda69
SHA512 b0973e052b5aa29d889dac9a4ddfff6296c67ca6b4c2933a2b3c02c9ab562ca63aa74155117f8342a2c02bd80956453f4e88b2b1fe4a2d5b020844c37117ffdb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c08e61e3c6a8cf758d0555bc09de73fe7d454bd9eb7eb1a1ef3c9d86463d73eb
MD5 3b3428270f1bcd9782b230ae13e5ab11
SHA1 9c6dea0670a8bab95f9d7671b4a99a3f21ae1110
SHA512 c2f9e8e2e726e1961165c03529680aa4a02e3eeb803ab4fecc952e47bccdd2823f0e5c2eb5dfa5e1dc1f4afc9312bb7ea9973c9b25c35ee1231e94231fbfc6ba
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 75a0286f39e79453011a5f5e18637d29e2e43ccc44a21ea978f3afe48ab19ddc
MD5 3d61165866dc9ab5f725513c57446d7a
SHA1 b9931bb64571d7eb6813779e962e959018fa757f
SHA512 e2a2b2d4cb9a2cf3b8c4edf9bf84d79b36e30a09aaaaaa2302bfa3e835796e71023b776b9bbcbd8ad81dbcd5d8c5662b8034a1d87c7c148a0805f7e3d42cf43f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 32e9b3f99147baeb5c14b0076ad37968e0f0323cd8d0235a2362c60306f3e8f5
MD5 605f01d241b180433a2365df3c4a7d70
SHA1 b026654705d054ca94ca429d4252e8e93494aee6
SHA512 f9aaf5e2404c971888be2b8254513bf1181c7e007f39d2da4957352ccede922894040ab940c61f8f3f53bb70dff9069e5adcd8fdd2a6c4ab1d64b955ecab9663
MD5 SHA1 SHA512

Submit Download

svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACCBBBCCACACBCCCBCAACBBBCCABCCABBBBABBCBABCABACBACBCAC.exe
Size 9.1MB
SHA256 fc772546fa9238b46c25413e53b88f4257c8ca7375f457b89445f922c8e0ea87
MD5 9f8a1a771d01b62647efb30e9221f810
SHA1 42fa88ce0d2cc0a25f7f980057d211869be264a8
SHA512 d32b5132f857a85d497641f2ca5df4b9eeaab5644c1c3cb03a3ccc51ce7b033afb420b1585b86dc7c465a7596630830567bd1d6fd4df34f6157b267fbceb389d
SSDEEP 49152:U+Ef+EPiw25+Ef+EPiw25+EjozMlTzQ/7YGsTjfg+Ef+EPiw25+Ef+EPiw25+EjH:W1MbQS1MbQS1MbQS1MbQS1MbQY
TLSH
T18EA65B09B7ED44A4E5B7E07489AAC636E7B27811473197DF8691C62F1F33AD0AC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4736-50-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/4736-95-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/4736-32-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/4736-71-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download

memory/5788-97-0x0000000000AD0000-0x0000000000AF1000-memory.dmp

Download

memory/5960-33-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/5960-82-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/5960-59-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/5960-10-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/5960-21-0x0000000000C10000-0x0000000000C31000-memory.dmp

Download

memory/6112-87-0x0000000000C60000-0x0000000000C81000-memory.dmp

Download