15aa56f3884e3c5257a0fe74153c851b22fdcf995f0a766dd08845535981117e

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe
Size 10.9MB
Sample260906-199sasterg
SHA256 15aa56f3884e3c5257a0fe74153c851b22fdcf995f0a766dd08845535981117e
MD5 944e3c6fc992c36e812a4eefbbd049be
SHA1 db29e1f85d0dea64b0183941af6e1f5ed468c0db
SHA512 244deb9741b2e5a98015e1ea3bc89d6797c1f2ca3893c204a6330888239c947f936e39354fa74322c56adafbb7f1dec7b59a3173643ae42910f07201c7368e22
SSDEEP 49152:U+Ef+EPiw25+EjozMlTzQ/7YGsTjfg+Ef+EPiw25+Ef+EPiw25+EjozMlTzQ/7YR:J1MbQS1MbQS1MbQS1MbQS1MbQS1MbQ9
TLSH
T156B65B09A7ED44A4E5B7E17489AAC636E7B27C51473097CF5291C62F2F33AD0AC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery execution persistence

Malware Config

Signatures

Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000001c516-18.dat	INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3980	svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
1616	svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
4732	svchost_BABBBACBCBABCABACBBBACBBBABAACCCBBACCACACCCCABACCCABBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCAABABAABAABAABBBCCCCAABCCBAABBCBABBBACAABACBAACCBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe"	2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCCBBACBCABBACBABCBCCCAAACBBABABCACCCCABBABBCCABACBAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBBACBCBABCABACBBBACBBBABAACCCBBACCACACCCCABACCCABBBC.exe"	svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4876	sc.exe
1424	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2768	cmd.exe
1560	cmd.exe
3988	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBBACBCBABCABACBBBACBBBABAACCCBBACCACACCCCABACCCABBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4988	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1612	2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe
1612	2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe
1612	2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe
1612	2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe
3980	svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
3980	svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
3980	svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
3980	svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
4732	svchost_BABBBACBCBABCABACBBBACBBBABAACCCBBACCACACCCCABACCCABBBC.exe
4732	svchost_BABBBACBCBABCABACBBBACBBBABAACCCBBACCACACCCCABACCCABBBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1612	2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3980	svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
Token: SeDebugPrivilege	4732	svchost_BABBBACBCBABCABACBBBACBBBABAACCCBBACCACACCCCABACCCABBBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 3988	1612	2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe	92
PID 3988 wrote to memory of 4988	3988	cmd.exe	94
PID 3980 wrote to memory of 1132	3980	svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe	95
PID 1612 wrote to memory of 2768	1612	2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe	96
PID 2768 wrote to memory of 4876	2768	cmd.exe	98
PID 1612 wrote to memory of 1560	1612	2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe	99
PID 1560 wrote to memory of 1424	1560	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_944e3c6fc992c36e812a4eefbbd049be_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBBABCBACABABACBCBABBBBBAAACCACBBBCBBCABABCACBCBCBCBBBBABABBBACBABBABBAACCBCACACBABBCBBBCACACCABCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AAABBBABCBACABABACBCBABBBBBAAACCACBBBCBBCABABCACBCBCBCBBBBABABBBACBABBABBAACCBCACACBABBCBBBCACACCABCBBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4988
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBACCCABABBABABBCCBABACCAAABBAABACAACABABCCBAABBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe" start= auto displayName= "UserDataSvc_CBACCCABABBABABBCCBABACCAAABBAABACAACABABCCBAABBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2768
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBACCCABABBABABBCCBABACCAAABBAABACAACABABCCBAABBCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe" start= auto displayName= "UserDataSvc_CBACCCABABBABABBCCBABACCAAABBAABACAACABABCCBAABBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBACCCABABBABABBCCBABACCAAABBAABACAACABABCCBAABBCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1560
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBACCCABABBABABBCCBABACCAAABBAABACAACABABCCBAABBCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1424

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1132

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
1⤵
- Executes dropped EXE
PID:1616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBACBCBABCABACBBBACBBBABAACCCBBACCACACCCCABACCCABBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBBACBCBABCABACBBBACBBBABAACCCBBACCACACCCCABACCCABBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e4a21defd0c93003b02b9dcf16810ed48da4fe251330e7bc53eab53c15bec36d
MD5 46363f4e06ccb3c08a48646291607e64
SHA1 693e873528354f5e0b58e835e3a50af96670f743
SHA512 358dd4a38ea671280f2f00bf4f76f0b60a5348bc4771129cb94fa7d718aceda30954ae7cdeacb9e6a2d399be3028ea9c971359ed3efc73f92600a4d6cf736c06
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cde42dfa606f029209fd7625ae433cef037551aa07ae577b64ce11b8428b22ca
MD5 71b790b7abd5703cfe912b8fd35150ce
SHA1 807f48399fc0b4f7538b7c3eff8e4197f0796ac5
SHA512 7d0d0107b8643a6a2ae64a407b212ab904144d3fbb603e56eb9b009b5078929c2f5c7e390298a109e1a171595a2d8dae0bece915585ec57afbbb767c4cbf24a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4cdf94ba1962f43e27fcb810e736a6cca56cbc203a5374a470918e548037012d
MD5 7bf319e6e2d81dfe08b01bda725fe646
SHA1 53473b9155b1fce5f6a7aa6998170a00b2066423
SHA512 a1d574e133ca2aeeccedf4f6318c787db4ebd2550c987108572ecfec2f473686f0963f01093f8164bfd19cd7e6b2e105bea0dfe688024c648d1e94c22a8d2499
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c4bd1f3b39ef29a240f42069f86f22a7fa18dc530c2b93c21318fd3844080a5a
MD5 8b575890c2204cc8db90e7f4127ff0fc
SHA1 c6d460e2173ad7590eb105025ea3ef35c3d28665
SHA512 c5ad8e285122d6584f76cd07e2740ef8ee28616a1f2d9e3b7b1d02f5a5fa5b73cad4cca8fe5ca3635c5e4b5e149d6fc294ded05f37dd16e58819bda985ecef3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e96214563761ca0f031829cd5ec4410ea45584f0073ede29799b32219c520e45
MD5 97e4601d65ab12ed0e6732b1b9885e03
SHA1 6ad7a257ea0c74ebd330051f01657e7a82952f1a
SHA512 6b8849bd08d64aa587d9493db390bf09016500cd66fae6182188f2decaaee4637e75ac2c399dc18a4eb0d3b0618f4a757a689714cb1722ccb5c391eeda611ab4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f1260331d9bae07eca967b0297deed75ec0c9b3f9c9ffe7755d6b3b4e43daeb
MD5 de568d47491459152fa484a4b0ab9948
SHA1 10e7fedfa9c274479cb408ab282255e870980ba7
SHA512 3a917230ed9cc84fdd650dd96ef4b603e7e9d0f8495270f5297d48e40997c23291c18c1240439d065705e10cdeca272c23043a6200a9768987af35cf3b5300b3
MD5 SHA1 SHA512

Submit Download

svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBAACCBCBACABBBCCCBCCCBABBABBBCBBCBAABACCBCCAABCACBACA.exe
Size 10.9MB
SHA256 15aa56f3884e3c5257a0fe74153c851b22fdcf995f0a766dd08845535981117e
MD5 944e3c6fc992c36e812a4eefbbd049be
SHA1 db29e1f85d0dea64b0183941af6e1f5ed468c0db
SHA512 244deb9741b2e5a98015e1ea3bc89d6797c1f2ca3893c204a6330888239c947f936e39354fa74322c56adafbb7f1dec7b59a3173643ae42910f07201c7368e22
SSDEEP 49152:U+Ef+EPiw25+EjozMlTzQ/7YGsTjfg+Ef+EPiw25+Ef+EPiw25+EjozMlTzQ/7YR:J1MbQS1MbQS1MbQS1MbQS1MbQS1MbQ9
TLSH
T156B65B09A7ED44A4E5B7E17489AAC636E7B27C51473097CF5291C62F2F33AD0AC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 6d49e4fb8037e8158bc8a76f7289c73cd325c1c1b804fbfd30c69681c956cc4d
MD5 bec8625824dc1647de3666e3ac802df6
SHA1 806f8a1f7d552654fb07f40cc200d93e0c4ccc88
SHA512 75ab77aa89f7fa790b62557c74b81f02070dff54100cc8158fa8028578c4e7eea097a7b2d50aa803930a62ca46fa348e99ad9002d3779b2740299e04a54ca0a6
TLSH
T174110452F0F9D853F53228875A3DDE8B5CE43B4B985CABB812055119A32DC7D8F154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1612-6-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/1616-66-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/3980-22-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/3980-35-0x0000000000410000-0x0000000000431000-memory.dmp

Download

memory/4732-81-0x0000000000930000-0x0000000000951000-memory.dmp

Download