3b36c020d6a065ad420d8552eda50c86c7128e6d5d2fa6c462972225bf0c01b4

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe
Size 8.0MB
Sample260906-xfsedaer71
SHA256 3b36c020d6a065ad420d8552eda50c86c7128e6d5d2fa6c462972225bf0c01b4
MD5 c0e69219f1b7e4f6349b92bdd3dfc084
SHA1 77e9ddc396ea448fe6a869f11286a012ab9daf20
SHA512 9d4142d9059934ba597bbde3f51323c5ae80d62a98ced277da1a7774e0d9e7771b42b0989a46445ca9a3acba55ae2bcf5ae1ea1a694bd73bc6dc6ad7ee8fd810
SSDEEP 49152:U+ES+ES+ES+ES+ES+E2iw22v+ES+ES+ES+ES+ES+E2iw22v+ES+ES+ES+ES+ES+q:P
TLSH
T1B7864B09FADA0460E97761704DE7C27E8A71B9218732CAEFE649C72E5D33BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
252	svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
4308	svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
2096	svchost_ACAACBCBABCCACABACBBBCBBACABBCCBBCCAABAAABCCACCBACBBCCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABACCABACCBAAABCBAABBABABCACACBABAAAAABABBBACBABCCCBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe"	2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBABABBABBBCACCCCCABCBCBACBBCCBABCABCACABBBACABAABAAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACAACBCBABCCACABACBBBCBBACABBCCBBCCAABAAABCCACCBACBBCCB.exe"	svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2424	sc.exe
876	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5300	cmd.exe
772	cmd.exe
476	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACAACBCBABCCACABACBBBCBBACABBCCBBCCAABAAABCCACCBACBBCCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5284	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5864	2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe
5864	2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe
5864	2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe
5864	2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe
252	svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
252	svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
252	svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
252	svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5864	2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	252	svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5864 wrote to memory of 772	5864	2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe	92
PID 772 wrote to memory of 5284	772	cmd.exe	94
PID 5864 wrote to memory of 476	5864	2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe	95
PID 476 wrote to memory of 2424	476	cmd.exe	97
PID 5864 wrote to memory of 5300	5864	2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe	98
PID 5300 wrote to memory of 876	5300	cmd.exe	100
PID 252 wrote to memory of 1332	252	svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_c0e69219f1b7e4f6349b92bdd3dfc084_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBAAAAACBAACCCBBBBCBABBBCBBBACBBCCABABBACBABAABCABAAAACBCBCBCBCBBCABBABCBBABACACCCBABCACBBACACABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:772
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBAAAAACBAACCCBBBBCBABBBCBBBACBBCCABABBACBABAABCABAAAACBCBCBCBCBBCABBABCBBABACACCCBABCACBBACACABAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5284
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACBAAACCACCCACBCACCCBBBBCCAAACCABCBCCAACABCABCCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe" start= auto displayName= "UserDataSvc_CACBAAACCACCCACBCACCCBBBBCCAAACCABCBCCAACABCABCCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:476
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACBAAACCACCCACBCACCCBBBBCCAAACCABCBCCAACABCABCCBAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe" start= auto displayName= "UserDataSvc_CACBAAACCACCCACBCACCCBBBBCCAAACCABCBCCAACABCABCCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2424
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACBAAACCACCCACBCACCCBBBBCCAAACCABCBCCAACABCABCCBAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5300
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACBAAACCACCCACBCACCCBBBBCCAAACCABCBCCAACABCABCCBAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:252
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
1⤵
- Executes dropped EXE
PID:4308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBCBABCCACABACBBBCBBACABBCCBBCCAABAAABCCACCBACBBCCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACAACBCBABCCACABACBBBCBBACABBCCBBCCAABAAABCCACCBACBBCCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4e8f96c97ebe28cf998bd7c9dbf1ca2f6f34d3d8f9ed2fe18827769a2d4621aa
MD5 95f3a883a4619ebfe835d94c50ecce9c
SHA1 066f161f91b89bd805f062db704bc913dfa30c19
SHA512 437668f882a2c5fdde9d9930e13291f31a02166e8ac3e9dc88339b5bea5a39bc571dfcc660205e0e6cf4db4c4a1b4a0b71de6b475a3c274d33a43884843a9dfa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c50b6244a162f7684624a47a56f06fbc409590add12eff1bf375b41ee7528cd8
MD5 0fd60cbf961c5437a61c070121106486
SHA1 2839ec5e0d0a85d1cf8bb9cfe1bf4d4cb131807f
SHA512 448982c29cf2063beb4558487309b4f2a5e8c9cced8cda49efb81091d9cb2dbc59b6be2f362a9a26912e4d0e4ec53c04b5128d9935e95faab5e2c1b3c5bd2418
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 631defb36dbaf41ba7e211cddc777b5d0569dd4ff5f9e758955df4246949b448
MD5 f3e59c3ca507016a254c455c5926afc4
SHA1 68964ee38e5752d5bf3dcb3a707eda40d8d951e7
SHA512 12ba1ec9766ed7d766522e59b50fa981ac181923edf6845f199bcf205404d7142eeb17e0c33374ea58afee831406fc425f5f422f6214b1ff697dfd18360016d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a7f769ef8a56993ccf8a9d802ceb93fd2090a0d364c67df019f63d0d99635666
MD5 3b854f509480a9194604470f2c81f97a
SHA1 8f807ddc8c790dcd347584ef06e110d7b8e002cf
SHA512 ad5748f30b4dd3b75a40fcb3992a30d3c09531f74295a8a540013211ad0a41438c07c657ab3cf7653b232b841693c44da377c4db404bb95ea0b6a9dab1528e82
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 88250d075d4fe106959ba64bd665e3ce531a5e377015a264e376268f3476d206
MD5 12c60767d3e21617aa2a7fe85bb34426
SHA1 784b713f7c62b53c84af0ccee97e4252d2acc67c
SHA512 724d4d2a5aa11d7fa2f6d242dc0ea012120b4942812b27fbc809dc91065e045802d671c8eab287147b84641a40ab8e8080172b3890c0801e13cfe2b482e25bd6
MD5 SHA1 SHA512

Submit Download

svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCAACACCCCBCBACCBABCCBBCBAABACBCCABAAAACCBCBBCCAAACBCB.exe
Size 8.0MB
SHA256 3b36c020d6a065ad420d8552eda50c86c7128e6d5d2fa6c462972225bf0c01b4
MD5 c0e69219f1b7e4f6349b92bdd3dfc084
SHA1 77e9ddc396ea448fe6a869f11286a012ab9daf20
SHA512 9d4142d9059934ba597bbde3f51323c5ae80d62a98ced277da1a7774e0d9e7771b42b0989a46445ca9a3acba55ae2bcf5ae1ea1a694bd73bc6dc6ad7ee8fd810
SSDEEP 49152:U+ES+ES+ES+ES+ES+E2iw22v+ES+ES+ES+ES+ES+E2iw22v+ES+ES+ES+ES+ES+q:P
TLSH
T1B7864B09FADA0460E97761704DE7C27E8A71B9218732CAEFE649C72E5D33BE06834715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/252-23-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/252-36-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/4308-67-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/5864-0-0x0000000000220000-0x0000000000241000-memory.dmp

Download

memory/5864-7-0x0000000000220000-0x0000000000241000-memory.dmp

Download