4e9b95689f99a8f65b4af12cd01e59ce237fd299f2564f35f6da4f7e6ee0a132

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 05:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe
Size 12.3MB
Sample260905-gdatjst1f1
SHA256 4e9b95689f99a8f65b4af12cd01e59ce237fd299f2564f35f6da4f7e6ee0a132
MD5 7df16842a46ac8902b62b7d78fa4e4b5
SHA1 5018f50cfa2e1399e4c971ca0492093927eac81e
SHA512 75d65762a46fc24e847b4091e7e7ea3db596126aef38882317fb80da47d3f6f0f610b185aebcd689c44519d2016f4c3dbb8c69c5a63ebc56f665649e38202c9d
SSDEEP 49152:U+ESHP+ESHP+ESHP+ESHP+ESHP+ESH9++ESHP+ESHP+ESHP+ESHP+ESHP+ESHP+X:0
TLSH
T11BD6390CE6DE00B4D56AA0B08987C67ED5F17421472249EFE695CB3E1F33AE5B538B48
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5420	svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
1976	svchost_CCCBABACBCCBAACBBBAACBABABABBABBACBBCCABCCCCACBCBCACCBC.exe
2012	svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBAAACCCACBBBACBCCBCBCCCCAACCBBAAAACCACBCBCAABCCCACAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe"	2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBCBAAABAACCBACACBCBCABCBCBCACABCACAAABABCCABBBBCBCABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBABACBCCBAACBBBAACBABABABBABBACBBCCABCCCCACBCBCACCBC.exe"	svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3112	sc.exe
2040	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4440	cmd.exe
4396	cmd.exe
4616	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBABACBCCBAACBBBAACBABABABBABBACBBCCABCCCCACBCBCACCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5244	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4316	2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe
4316	2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe
4316	2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe
4316	2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe
5420	svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
5420	svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
5420	svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
5420	svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
1976	svchost_CCCBABACBCCBAACBBBAACBABABABBABBACBBCCABCCCCACBCBCACCBC.exe
1976	svchost_CCCBABACBCCBAACBBBAACBABABABBABBACBBCCABCCCCACBCBCACCBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4316	2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5420	svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
Token: SeDebugPrivilege	1976	svchost_CCCBABACBCCBAACBBBAACBABABABBABBACBBCCABCCCCACBCBCACCBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 4440	4316	2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe	91
PID 4440 wrote to memory of 5244	4440	cmd.exe	93
PID 5420 wrote to memory of 5660	5420	svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe	94
PID 4316 wrote to memory of 4396	4316	2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe	97
PID 4396 wrote to memory of 3112	4396	cmd.exe	99
PID 4316 wrote to memory of 4616	4316	2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe	100
PID 4616 wrote to memory of 2040	4616	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_7df16842a46ac8902b62b7d78fa4e4b5_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACACBCBCBBACAABAACBCABBAAACAACBCBAAABACCAABBBBACCBBBAACBBBBAAACBCBCCCCABCCBAACBACCACACACBCACABABBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4440
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBACACBCBCBBACAABAACBCABBAAACAACBCBAAABACCAABBBBACCBBBAACBBBBAAACBCBCCCCABCCBAACBACCACACACBCACABABBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5244
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCBCBAAABACCBCBCACBBAACCBCCCCCABAACCBCBAAABBCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe" start= auto displayName= "UserDataSvc_CBCCBCBAAABACCBCBCACBBAACCBCCCCCABAACCBCBAAABBCAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCBCBAAABACCBCBCACBBAACCBCCCCCABAACCBCBAAABBCAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe" start= auto displayName= "UserDataSvc_CBCCBCBAAABACCBCBCACBBAACCBCCCCCABAACCBCBAAABBCAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3112
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCBCBAAABACCBCBCACBBAACCBCCCCCABAACCBCBAAABBCAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4616
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCBCBAAABACCBCBCACBBAACCBCCCCCABAACCBCBAAABBCAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5420
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABACBCCBAACBBBAACBABABABBABBACBBCCABCCCCACBCBCACCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBABACBCCBAACBBBAACBABABABBABBACBBCCABCCCCACBCBCACCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1976

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
1⤵
- Executes dropped EXE
PID:2012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 781052c25859eaa304cd9c8c1ecdddf17b17c025dbca34598d962dea7281e0bb
MD5 c1481bc25a065f4c4ebe60e5a0b9513e
SHA1 406862bd31fcd77e761840deb2970f7fe732823e
SHA512 88399ea11eab7d675b04d42d487bde8eb3bdd244bf4608bc860c6dd5a1a2912fa83c2a9d06bc93d4c29a3f2c73a22fcdd96b0d7f2d9b7b78a1ed3b3ceffeea2a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 29de247a646195f103ce0895097f349f6a394447953342d43b4ff943d96e467e
MD5 d21920bf70840ecdd7ed99d3803526a2
SHA1 22aa141654e836d9b06843503320113627d17bcc
SHA512 e4a0c352ad0f236da4dbb5336f53e1b2a79803b9ae9ba604d6c55104d270e812cab01c163f9790b056d34055fdc6d8c869c2c592a331041fd898c7efe0158b5c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1a167a2dd2696f63128f67341ac8ba42c18cd371a803816e8b1e1ccd3e6e1997
MD5 3c6afa4dcc8be9fb7bc71acc6a82a280
SHA1 5e8fc000e17d1efb330639ac23bf3bccff5172fb
SHA512 9d3bdbb9c0aee4ccb5797bc761b269241f1d658cdf9e1a059948a69060e31bbbd3eabdafcb4091a7f9d4830fcb09851ec2e62756972afb995ef750415c3abb5b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 731a9556a8e10054b6e10ae83656e903457e5bb724edc4362e184e89f7d03760
MD5 33286fd4a20c32382a44a853d0c1b667
SHA1 a4f1f0580cafab0b0d9d0e26b01d30773b440962
SHA512 5c9a3a73a1145787e42d4570c25bae72e427f50e424f7974b3da6a67ab64d089af5321cbac52bf96e23ff1e6be53bc9f2c8a0e36f21c9dedf30ca391b88d7fac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2e15ee776bad7834dd578300ce88dc55ce9c4662ecdd1af346faf23d8cf25f8e
MD5 71bb5e463ba1ffab0545d1209ff3497b
SHA1 971c77f86642dbb3e475fbf7e3cc06bda3baf8c0
SHA512 53fe4cc129c1d2c9efe829d54292672d7af5d67ada092e17b995d47232a4b1348fd513f0daafd36d422122a42345cbb785da0f2293d4cc9a375b9dfb2e5b2243
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6ac930510730d8dda1f9205628346ce18a156192690657cd9373b79ddc2d8418
MD5 74a98f3b6dc50ae3ffe3fd51afa81706
SHA1 97f681e060ed16525eea8fb88e9a454b381024ed
SHA512 6de29cd29c22daa8eb15159b1f9f0a143814c8c85eacbfeeb67ab48e548bb1f55fdb06ac602e792a027a4e9870b0633e6b91518d176f89a027f241696fe6482a
MD5 SHA1 SHA512

Submit Download

svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABCBBCCCCCAABABBCAACCBACCCBBCCAACBAABABBCBABACBCCBCBCA.exe
Size 12.3MB
SHA256 4e9b95689f99a8f65b4af12cd01e59ce237fd299f2564f35f6da4f7e6ee0a132
MD5 7df16842a46ac8902b62b7d78fa4e4b5
SHA1 5018f50cfa2e1399e4c971ca0492093927eac81e
SHA512 75d65762a46fc24e847b4091e7e7ea3db596126aef38882317fb80da47d3f6f0f610b185aebcd689c44519d2016f4c3dbb8c69c5a63ebc56f665649e38202c9d
SSDEEP 49152:U+ESHP+ESHP+ESHP+ESHP+ESHP+ESH9++ESHP+ESHP+ESHP+ESHP+ESHP+ESHP+X:0
TLSH
T11BD6390CE6DE00B4D56AA0B08987C67ED5F17421472249EFE695CB3E1F33AE5B538B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 36c7f2d33ae619f64d633b987847fc5a1546f380eb156fb496c57674220beeac
MD5 a8b673c14fd123c674426d7423dcf6ca
SHA1 ccc38f7e6da33f5302023e56b44dde8c8ed5c31b
SHA512 3b035d2416991146e47a0ca38f4200a1092e86ae9ba069d3bff8dde579f4e3c825a2f5eb918669302cc7e89591b748101c660bbf3f4d6f0cb7a64e06d752a4fc
TLSH
T179110D51F0A6D863F470389F86255DD708D83BDE5C5CAB18230E411DB7DDC35AE168E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1976-79-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4316-7-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/4316-0-0x0000000000210000-0x0000000000231000-memory.dmp

Download

memory/5420-24-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/5420-34-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download