efeda9b57b581d5eef3dd9c275cff0acfec12ff8d1544c171daa72caba259148

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe
Size 13.2MB
Sample260905-dzkzvsbf73
SHA256 efeda9b57b581d5eef3dd9c275cff0acfec12ff8d1544c171daa72caba259148
MD5 91befed9da693283241aeafb8574abdc
SHA1 1711bfe7f83f383ee0017a9d8d976990128e231b
SHA512 fd8e48e8f29b5da0fc4525ed821a7f806ed66cdc1e02fffe6a8e8d20e5c8f26164bbe79bb4d2825a31945025740f2ff6f2df2eff464a151a2578d42ea46f3af1
SSDEEP 49152:U+EnK+ES+ES+EnX+ES+EnG+EnK+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ER:w
TLSH
T13DE64B09F94340B1DD2B10B04DCBD2BF8A60BF2586128EE7F78DDB5B7933BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2572	svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
4468	svchost_CBACABCABAAACCBACBCCAABACBBBBBCABCACACCAAAABCABCAAABAAA.exe
1384	svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCCBCBBBBBBACCABACCBABCBCBCBCCCCBCAABBBCBCCACAAACACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe"	2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCABBCABAAABBCCBAABCBACCBBCCCACACABAACCBCBBCBBCBCCABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBACABCABAAACCBACBCCAABACBBBBBCABCACACCAAAABCABCAAABAAA.exe"	svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2764	sc.exe
3272	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
808	cmd.exe
1004	cmd.exe
2832	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBACABCABAAACCBACBCCAABACBBBBBCABCACACCAAAABCABCAAABAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3328	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1216	2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe
1216	2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe
1216	2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe
1216	2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe
2572	svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
2572	svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
2572	svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
2572	svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
4468	svchost_CBACABCABAAACCBACBCCAABACBBBBBCABCACACCAAAABCABCAAABAAA.exe
4468	svchost_CBACABCABAAACCBACBCCAABACBBBBBCABCACACCAAAABCABCAAABAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1216	2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2572	svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
Token: SeDebugPrivilege	4468	svchost_CBACABCABAAACCBACBCCAABACBBBBBCABCACACCAAAABCABCAAABAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 808	1216	2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe	92
PID 808 wrote to memory of 3328	808	cmd.exe	94
PID 2572 wrote to memory of 1972	2572	svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe	95
PID 1216 wrote to memory of 1004	1216	2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe	98
PID 1004 wrote to memory of 2764	1004	cmd.exe	100
PID 1216 wrote to memory of 2832	1216	2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe	101
PID 2832 wrote to memory of 3272	2832	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_91befed9da693283241aeafb8574abdc_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACCBBBCCACCBBCCCBBCABCBCABABCCABCBBBBBACACBABCCABAAAAACCBCBAACACACACBCCAAAACCABBBBBCAACCACCBBAABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAACCBBBCCACCBBCCCBBCABCBCABABCCABCBBBBBACACBABCCABAAAAACCBCBAACACACACBCCAAAACCABBBBBCAACCACCBBAABABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3328
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBACCCABBAACCBCCABCCCACBCCAABABAABAACCCACCCACCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe" start= auto displayName= "UserDataSvc_ACBACCCABBAACCBCCABCCCACBCCAABABAABAACCCACCCACCABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBACCCABBAACCBCCABCCCACBCCAABABAABAACCCACCCACCABCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe" start= auto displayName= "UserDataSvc_ACBACCCABBAACCBCCABCCCACBCCAABABAABAACCCACCCACCABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBACCCABBAACCBCCABCCCACBCCAABABAABAACCCACCCACCABCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBACCCABBAACCBCCABCCCACBCCAABABAABAACCCACCCACCABCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3272

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1972

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCABAAACCBACBCCAABACBBBBBCABCACACCAAAABCABCAAABAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBACABCABAAACCBACBCCAABACBBBBBCABCACACCAAAABCABCAAABAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
1⤵
- Executes dropped EXE
PID:1384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e1b6d14d83c1e3d270602aee277548e9cee380f379ef867da93f0e800fefd1f4
MD5 c515d598f2f30e710b4a2ff0ee9e3961
SHA1 8279cb3b37bd3c3a78478e1664c3f007a0f91380
SHA512 bb5173e8b3750e843038ac7b61e158bbb7d0d0dec7d42ee931d5365d0994ac8159d352b6e5fa002fc5de18a44281ee2e61f171e0f66f5c196e30f9bd42acd95c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ed24bbf04454c87b9bb1ea851c6a88008d50a50a9be5c34b53cae5decb26edc8
MD5 9265a95823460a951029fd847192e674
SHA1 122fb509e7a30668251d3bdcedaee9e01f1d5b40
SHA512 5dba09df0dde7d76e67e1b94abb287ad371e45a85cdc2d33112f6ccca3a360a77e3157a5a142cefb233d4d539d76598a977a70f9a285ee3cabb3d01c3d59ad02
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b9d341165892142dbcac7b333287de530e72c85fc20c331a67d3292c4ee6498f
MD5 65014ddb0f08155f7f7e3b653ccc2346
SHA1 6e3992b95da6447a07c9933f7beae1002d701bc6
SHA512 ee110611ae512bd2f83fe173a63ce2b096beea40bb8ae93a5eeccbc4cb07a89f995d30545c352b38446631a4de970935395288279bb9422a1e37ba764c1e824f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 f776749038e6b890555250c53115558fa2946a4a6e80606c9f836ebdffb6ffd9
MD5 30d7716768bb7f0dfdd98e0ed2de77f5
SHA1 d273f670406009d1467439711e05381db868b061
SHA512 62610d11056c77cbf6d5171bf904155b2a5c8a2a0805a530e6105a5a6a1c81cbe89b32233a04ec2a2eec1b614859fd83f918776f58150e3e0b6c1177dafbf912
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b23b1457950c73da2ddd77fcb0e9e887da9fb7d32219a686bc9046e02dd92584
MD5 b2c183a7fc9be23d6799ea34f16e7891
SHA1 834d8aafd34ed842ae6ab9483bb14e8dfa2a070f
SHA512 fc4447636b8e1512dcea5bb3a2bf2a46fbf6f8626c919c046cb6eead12fbdb84a1589b65d2629ef63e2594682414f437929999c0c10eba8fccd5251703549cd1
MD5 SHA1 SHA512

Submit Download

CloseGroup.exe

Path C:\Users\Admin\Downloads\CloseGroup.exe
Size 40.0MB
SHA256 296da442e49c75ea59e9f55b2d36f13dde2353b8c458bb9e36a46c5b51435817
MD5 b2ad6efebcd05307e321326a932368c3
SHA1 6cddcb3bfeeddd28dc1370d4ad2f36c8a572ede5
SHA512 730dfa25564d797404621086f2ac4d42bbeaeedfc311ef87f664c3eb87c5931b5f1856ce9d994e34499c94a31fee9154b58c17f1612f011aeb8d1b2813443551
SSDEEP 49152:U+EnK+ES+ES+EnX+ES+EnG+EnK+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+EL:xmF
TLSH
T14D974B09F94340B1DD2B10B04DCBD2BF8A60BF2586128EE7F78DDB5B7933BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 b465ff112d5c131aa795d91e64e768c249da156fe831215fe6cf50cfa9831a3b
MD5 d1ad3efa1f517bf488677e567a3feff8
SHA1 933f7f017abaca5633d76d03590f12ee845b63c4
SHA512 2dbabbf4b19098ce1c81beeb437d99eec57672c996343800ddf94c2484946b6a27bb41550f8dbf1e4dcfdbe4d38c84f1fcd99400524762ea0d8768e03fc6fdbd
MD5 SHA1 SHA512

Submit Download

svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCCCCAABCBCCCCABBCCBBCACACBCBBCABAABAAABBCAACBBAACABBAB.exe
Size 13.2MB
SHA256 efeda9b57b581d5eef3dd9c275cff0acfec12ff8d1544c171daa72caba259148
MD5 91befed9da693283241aeafb8574abdc
SHA1 1711bfe7f83f383ee0017a9d8d976990128e231b
SHA512 fd8e48e8f29b5da0fc4525ed821a7f806ed66cdc1e02fffe6a8e8d20e5c8f26164bbe79bb4d2825a31945025740f2ff6f2df2eff464a151a2578d42ea46f3af1
SSDEEP 49152:U+EnK+ES+ES+EnX+ES+EnG+EnK+ES+ES+Ena+ES+EnG+EnK+ES+ES+EnG+EnK+ER:w
TLSH
T13DE64B09F94340B1DD2B10B04DCBD2BF8A60BF2586128EE7F78DDB5B7933BA16428655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 0feb7b5705c04a57ad863dce0c13eb53612d36d11d6effb0eb6897f1ac12f699
MD5 86bb67d9f5c75c23a8a2b1c32dcc2e11
SHA1 05a9fade889a29874fe09b2dd3899dda991c51ec
SHA512 29efbcd4fe4d576a55fdbfddac3b1e1572c652d1824b0389d7b1ef26b373a922a2f1a754d09588f0c11d5cec68aba97041d3636bb5594034d4e1bd5e587696ca
TLSH
T1A211946170A5EC17F53228C79319EA874CB43B8BDC9CEBB4931856186B81C36DD568A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-60-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1216-0-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1216-34-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1216-22-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1216-94-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/1216-11-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/2572-48-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/2572-70-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/2572-33-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/2572-103-0x00000000004F0000-0x0000000000511000-memory.dmp

Download

memory/4468-102-0x0000000000820000-0x0000000000841000-memory.dmp

Download