36a98bc8ec4434708730ab2bee352d9fe564641f33cff8f126a337abdad1a8f5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/09/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe
Size 425KB
Sample260906-v2edjaygja
SHA256 36a98bc8ec4434708730ab2bee352d9fe564641f33cff8f126a337abdad1a8f5
MD5 d07a9fe44088100467b43492b40b90e0
SHA1 17caea099036bb743288db5427ef2dbca9eadcd8
SHA512 0693ace26c8870b7568ff11ee816dc0d63924da2e86783158c12364816a7d0928096302114690587e1df82694d377002d885804ca74f3d06479d05dc92756103
SSDEEP 12288:mgUFgEsnojAD+BeDuUlEqatglDagwUmPWmCbxu8JGV:m9+EM0GExqatglOLQAoGV
TLSH
T14B947C46FA8480A1D57601308DA6C6BAA732BC254F118BDF7394B36F2F337D09E35A59
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3384	svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
4128	svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
2284	svchost_BBBCABAACBBAACACBABBCCCAABABBABBBCACCBBCCAACCABBAABCACA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBBBACBCAACBBACACABBACCABBBCCBBBCBCACBBBCABCCCBCBABCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe"	2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBBAACCCCAABCCBCCBBCBAABACBACCBCACCCBCBAAABAAAACCCAACBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCABAACBBAACACBABBCCCAABABBABBBCACCBBCCAACCABBAABCACA.exe"	svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2188	sc.exe
3892	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1040	cmd.exe
640	cmd.exe
2640	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCABAACBBAACACBABBCCCAABABBABBBCACCBBCCAACCABBAABCACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4120	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1664	2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe
1664	2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe
1664	2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe
1664	2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe
3384	svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
3384	svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
3384	svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
3384	svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
2284	svchost_BBBCABAACBBAACACBABBCCCAABABBABBBCACCBBCCAACCABBAABCACA.exe
2284	svchost_BBBCABAACBBAACACBABBCCCAABABBABBBCACCBBCCAACCABBAABCACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3384	svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
Token: SeDebugPrivilege	2284	svchost_BBBCABAACBBAACACBABBCCCAABABBABBBCACCBBCCAACCABBAABCACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3128	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1040	1664	2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe	109
PID 1040 wrote to memory of 4120	1040	cmd.exe	111
PID 1664 wrote to memory of 640	1664	2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe	113
PID 640 wrote to memory of 2188	640	cmd.exe	115
PID 3384 wrote to memory of 4228	3384	svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe	116
PID 1664 wrote to memory of 2640	1664	2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe	117
PID 2640 wrote to memory of 3892	2640	cmd.exe	119
PID 4228 wrote to memory of 5076	4228	notepad.exe	121

C:\Users\Admin\AppData\Local\Temp\2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_d07a9fe44088100467b43492b40b90e0_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCCCACBCABAABCCCCABBABAACCBBBCAABCABAAAABBBBABCBCBCBCCBBBCCBCCBBBBACCACBCCCABBCCACBBBCCCCACCAACBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1040
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABBCCCACBCABAABCCCCABBABAACCBBBCAABCABAAAABBBBABCBCBCBCCBBBCCBCCBBBBACCACBCCCABBCCACBBBCCCCACCAACBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4120
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACBCAABAABBBBCCCABCCACBCCAAABAACCABCCCAABACABAACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe" start= auto displayName= "UserDataSvc_ACBCAABAABBBBCCCABCCACBCCAAABAACCABCCCAABACABAACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:640
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACBCAABAABBBBCCCABCCACBCCAAABAACCABCCCAABACABAACBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe" start= auto displayName= "UserDataSvc_ACBCAABAABBBBCCCABCCACBCCAAABAACCABCCCAABACABAACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2188
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACBCAABAABBBBCCCABCCACBCCAAABAACCABCCCAABACABAACBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACBCAABAABBBBCCCABCCACBCCAAABAACCABCCCAABACABAACBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3384
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4228
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
1⤵
- Executes dropped EXE
PID:4128

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3128

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABAACBBAACACBABBCCCAABABBABBBCACCBBCCAACCABBAABCACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCABAACBBAACACBABBCCCAABABBABBBCACCBBCCAACCABBAABCACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e54b35ab8ccbfcdb0c7ce0a3ce859e30131c3f6997114dca49f0cd85bca05cb8
MD5 2f03bda36284a6bb622008301f6ab704
SHA1 ed48b4e03fad2b2468abe9230967f43ad0108bf6
SHA512 86ac7eba270be9bc75e295a52cca80462a3c7561786cf32653b04fb4b7983dfb2fd1f0aa5b740da3b37771c4f4f384117c9ea495b4a5816d9f1de0e3910d07ce
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 141f79fd0b5858fae21858beb56fae9a9e06532e4c732ff19953614997c321f9
MD5 53ad41a4ccd5af20df525db01601c271
SHA1 5da402bd8a505636fa16fcebac284f28e6debf5f
SHA512 4636a278cb6279bd7ea54f973085b4433e8a9d81e8a14552aa655a0a523e16b3bcbdda128ea6e23dfc68e7a45ef0422a321000497d6d88b25e0bdf2de21b24f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 348e2dfa06025c02685fcf0a8f0a433677a44fccb7fe2c994636fb3864920e21
MD5 ec3bb167e9677b74a8045e617dc2bf6e
SHA1 45df2e323e4fb82ec60f1ae74179f20d5b108668
SHA512 b6b6110579af8949ce9e298a32efbd12230aaf0fa045a1b90d362929539b9455d7f54d2b6834099f540a5adf688511a91db43cfd0b66fb1bd100e12e3c023106
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e41852752cbc0ee9d22e2c614698eb8d65a61b55f57d5fbbf56ea7d9ed4c40f3
MD5 95f10c429e2ae63dc9cae5d7e78ab1a3
SHA1 027dd5946d3b4421feb9dd1dc4255bc6977d4695
SHA512 41ce01c1f8297bf64a688ecd877caef64554efd35e50e1bb1ea7e4e467d890e6ef3fdf4f5082831f61bca0c9899590bf61d019d26eabafa6aeaba8e0c5b00255
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e05902822810e08e297255bb83cc9e533a2465413362cc82b111352dda3de674
MD5 bb010742ee9fc01b49cb387c7055d0ce
SHA1 000ba7c7de927ea9c584cff743c64709e7d9de46
SHA512 8c3cbf96185402ec32e8ba08f7045f3bc55e64e3e69d07fb002e0581e8848c3f41ccfcbadac79872f29c18e2d9a8da452ec6101e453f38a2622bf217861652c3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3c9e9e11f1c4bec43ac70deaebb5c71f55325c4c14be1fac0bdba9e77613e356
MD5 e4dd953f6804200c5f8f853745924c6e
SHA1 c12f3582ae14c1d56837d5576a041ed84de903f2
SHA512 1fbb74f1e5da2ff533b19fc863669e7340195d116488af515144572cd9f52a2108ac3f242a2e71531cbe77287597a4b8fdc65a30138f2c11da3e007acf5a8ad3
MD5 SHA1 SHA512

Submit Download

svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBBCCABCCBACCBCABCAACCCBCBABBCBACCAABCCCAAABBBBABCCCA.exe
Size 425KB
SHA256 36a98bc8ec4434708730ab2bee352d9fe564641f33cff8f126a337abdad1a8f5
MD5 d07a9fe44088100467b43492b40b90e0
SHA1 17caea099036bb743288db5427ef2dbca9eadcd8
SHA512 0693ace26c8870b7568ff11ee816dc0d63924da2e86783158c12364816a7d0928096302114690587e1df82694d377002d885804ca74f3d06479d05dc92756103
SSDEEP 12288:mgUFgEsnojAD+BeDuUlEqatglDagwUmPWmCbxu8JGV:m9+EM0GExqatglOLQAoGV
TLSH
T14B947C46FA8480A1D57601308DA6C6BAA732BC254F118BDF7394B36F2F337D09E35A59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 9f0fe027d538e4b11c893edba5a9045e77375c813c5874f6e72e7d09d9833761
MD5 3c451498b0e48e400a2ad3fb101ef1f5
SHA1 7249f9a2febe9d7121cff5bbfcdad88d93797d39
SHA512 1fe90e914306eed22a9a18ae65559ad6d956624d431d3ec57958dafe17ffa9823ae7f9d1c222984a440f99d7d378dcc3602f82444aa4a7b57b3310320e52d489
TLSH
T1D2112B21F0E9A8F3E4316887162DEF970CE43B8A68DCEB6813498158B714C398F154E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1664-6-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/2284-89-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/3384-38-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/3384-25-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/4128-74-0x00000000007C0000-0x00000000007E1000-memory.dmp

Download

memory/4228-66-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

Download