a010574b066afe86f8326b8f582ed9003d131803f04801441f97e254ad17d775

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe
Size 6.1MB
Sample260906-264ybavalb
SHA256 a010574b066afe86f8326b8f582ed9003d131803f04801441f97e254ad17d775
MD5 893dcc1bfd7fcaf57fb67a12928e083d
SHA1 664e2ea5312ca22b5b7a45b6d444c962db7df0f1
SHA512 64ff758e687868b31c845889b384be567d0d7766aaa8cf32d4c461740fc836e26cf1a1531e533cfe62b89d3c659dd2f4221599e7d59df829379441e8bd9544d8
SSDEEP 49152:U+Ez8obnyMWmddj6+Ez8obnyMWmddj9Y+Ez8obnyMWmddj6+Ez8obnyMWmddj9YI:irCrerCrerCrerCrerCrH
TLSH
T1F7563B1F22BC00B6C96ED179E2D18156D6B0B03127622AEFA160CB7D9F5F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1536	svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
1364	svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
6104	svchost_ABBABCBACCAACAACCCCABACCCCBCCAAAAACBCCBBACBBBAAACBCABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBAACBCBCBCACCCBABACBBCCCCCABCCCBAAAAAAABAAABBCBABCACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe"	2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCABCCCAABABBBACBAACACCBBBBAABABCBBCBBBBACAAAACABABBAACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBABCBACCAACAACCCCABACCCCBCCAAAAACBCCBBACBBBAAACBCABCB.exe"	svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5464	sc.exe
2824	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5968	cmd.exe
2192	cmd.exe
2148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBABCBACCAACAACCCCABACCCCBCCAAAAACBCCBBACBBBAAACBCABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4932	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4768	2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe
4768	2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe
4768	2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe
4768	2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe
1536	svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
1536	svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
1536	svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
1536	svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
6104	svchost_ABBABCBACCAACAACCCCABACCCCBCCAAAAACBCCBBACBBBAAACBCABCB.exe
6104	svchost_ABBABCBACCAACAACCCCABACCCCBCCAAAAACBCCBBACBBBAAACBCABCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4768	2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1536	svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
Token: SeDebugPrivilege	6104	svchost_ABBABCBACCAACAACCCCABACCCCBCCAAAAACBCCBBACBBBAAACBCABCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2192	4768	2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe	92
PID 2192 wrote to memory of 4932	2192	cmd.exe	94
PID 4768 wrote to memory of 2148	4768	2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe	95
PID 2148 wrote to memory of 5464	2148	cmd.exe	97
PID 4768 wrote to memory of 5968	4768	2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe	98
PID 5968 wrote to memory of 2824	5968	cmd.exe	100
PID 1536 wrote to memory of 4608	1536	svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_893dcc1bfd7fcaf57fb67a12928e083d_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCAABABCBBBCCACAAABCABBBCCCBBBCABCCCCBCAABAABBAAAACACBACBBBACBBCCCBCAABCCACCCBCBACCCBACBAACBBAACACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2192
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACCBCAABABCBBBCCACAAABCABBBCCCBBBCABCCCCBCAABAABBAAAACACBACBBBACBBCCCBCAABCCACCCBCBACCCBACBAACBBAACACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4932
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAABBAACBABCBBBACBBCACBBABCCBBABBABABACCACAABCCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe" start= auto displayName= "UserDataSvc_CAABBAACBABCBBBACBBCACBBABCCBBABBABABACCACAABCCBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2148
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAABBAACBABCBBBACBBCACBBABCCBBABBABABACCACAABCCBBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe" start= auto displayName= "UserDataSvc_CAABBAACBABCBBBACBBCACBBABCCBBABBABABACCACAABCCBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAABBAACBABCBBBACBBCACBBABCCBBABBABABACCACAABCCBBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5968
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAABBAACBABCBBBACBBCACBBABCCBBABBABABACCACAABCCBBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2824

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4608

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
1⤵
- Executes dropped EXE
PID:1364

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCBACCAACAACCCCABACCCCBCCAAAAACBCCBBACBBBAAACBCABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBABCBACCAACAACCCCABACCCCBCCAAAAACBCCBBACBBBAAACBCABCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:6104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b0cf61b5c9b65380c1ee39245534e5a6f316e336851d36a44a3702f7d5ff8dc0
MD5 1f1cea53d4cb3fa4074a69088b30f317
SHA1 d2abe578568e0a715042118ea2b4b83129c88c0e
SHA512 be0c5f10e047c81e7e64758d39455d3e618bec84dc5dfc8911125c73714ae83313e9a997a96c25123971a1c03e8055d043887a7c44f110016ab6736ccb87c0a5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62921fd9e9295cacc39912cb305033561e55d7769580919662adf8ff601a0ebe
MD5 247a3ab9c935cd427cf76fbe0cfe0a82
SHA1 38d2e1643e07a90e20b0d57903dd186a83548057
SHA512 e2dc74ea991fa47d91613d53438a73df25263cbf0b6f48139ce5afedacaeb1fc9d84c264492bca2b8ee456905bb867d50105554688a669bdfc1c58f4de3ae770
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d9ead1248e5682e126c669f1667f91806afb10573c386373a386abb4f0843149
MD5 e25fd372a00a21f2cb7e656706f1bd1b
SHA1 f0acf2ef9a4128ae87c45103c339ee4bd15497a6
SHA512 e2605b3feab4ca13ad43f8321f928fb422c3b0992e5df040339a2a991dc31bf4c9c00bfb465852f24f0ac43f0919a257c2aedac896e099b3b9a9e31210da486a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4f6dafac4622a4fcf0fe0ef34afa884882b343920a59293fc9399c67f6308ffe
MD5 c53d01577034806838f55cab98c1a130
SHA1 1b99a6e1c9ec7d79037a2562183186e6395f666d
SHA512 1baaae5d5489723ab421c4501e770515126cdeda17ead6be48de8bb570d18e134b7a0f7a05f80d2487bb22bf228b504f64513826e28c6507e00c5329775e3329
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 25538301f172677fe0abe6394fb4018fca03251c54e8fbc73cc3d0bd344e5a4d
MD5 7ec945458c046a444ace9a195c594d6a
SHA1 9a12abbae61cbb2e9142c3b0c9d2bee3bd8a6832
SHA512 d3b07c4ad8fdeb7c00a3fc36cf5c3b0363ddefe39ea200531110ce2d43c6f0c30a1eeda9e0e11d9462e9dfb7e4bec5f6449612048aa432e1714bfff82008b1e2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 858415b3de7761eb096dc1ce2da8d12aabe97c755a0ca3af75ee64b2c261c3fa
MD5 5f851339a34bab7a8f5db05a435207e4
SHA1 6bccfe65c21886baa87e9b0a49ab6f5094f77d7a
SHA512 f2a99a48dfd801a0fe2e253a28a74daf6f4da52abd8ae22372062c26a73e2ab5d44ac9131da3b9534a1b362bca7d5f646ee404ebb58e03ab43109cc3a059ddbe
MD5 SHA1 SHA512

Submit Download

svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBCBAABBAAABCCBBBCAAACABAABAAACCAABCACACBBABCACBAABCC.exe
Size 6.1MB
SHA256 a010574b066afe86f8326b8f582ed9003d131803f04801441f97e254ad17d775
MD5 893dcc1bfd7fcaf57fb67a12928e083d
SHA1 664e2ea5312ca22b5b7a45b6d444c962db7df0f1
SHA512 64ff758e687868b31c845889b384be567d0d7766aaa8cf32d4c461740fc836e26cf1a1531e533cfe62b89d3c659dd2f4221599e7d59df829379441e8bd9544d8
SSDEEP 49152:U+Ez8obnyMWmddj6+Ez8obnyMWmddj9Y+Ez8obnyMWmddj6+Ez8obnyMWmddj9YI:irCrerCrerCrerCrerCrH
TLSH
T1F7563B1F22BC00B6C96ED179E2D18156D6B0B03127622AEFA160CB7D9F5F9D1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1de469b900fe90abf2c39925dff8e83a5a3dfca1275d2ee8ebdd5646a534decd
MD5 6bbf908ab288b572d83a5d92b064712a
SHA1 ec45c87ac5b835537d8ea1309ca5988d91f77854
SHA512 ab5aecf6496a0dbc9c41dd201595a6c19d8b3a5113656577d0bf818a9dd593367b8d61308401ecec950a47373f98ae0285f53eec72e87a778b56d62548fe32b7
TLSH
T1D7118661E0B6DC67F1232CCF4A29EE871CE03BCF9968AB582305471966298768E154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1364-66-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/1536-22-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/1536-35-0x0000000000DD0000-0x0000000000DF1000-memory.dmp

Download

memory/4768-6-0x0000000000100000-0x0000000000121000-memory.dmp

Download

memory/6104-72-0x0000000000E50000-0x0000000000E71000-memory.dmp

Download