fd44702d3f49b54b6c9bd87bc4eaba7a252e3c5393315a68066919821205e619

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 01:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe
Size 50.0MB
Sample260907-bph2eawdne
SHA256 fd44702d3f49b54b6c9bd87bc4eaba7a252e3c5393315a68066919821205e619
MD5 6da568c5f787a6d95850fe36bd266819
SHA1 f4ac69eb6143a54a06f92eb7e56e8b0008e325b7
SHA512 c8adfce7f23908d4b34fcd0196391f702d4e991fc648c82948a28327ab9f44c0cc6655e1f9550bb72450e55b309c103a46a2caad074ec041be42d3187592f4a6
SSDEEP 98304:RK7K7K7K777K7K7K7K7K7K7K7K7bK7K7K7K777K7K7K7K7K7K7K7K7bK7K7K7K73:pnSU
TLSH
T188B72909F98344B2D92B11B04CCBD3BF8A30BE258B128EEBF64DD75F6933B915428655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
260	svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
4876	svchost_BBBCCAAACABAACCACCBAAACCBBCABCACCCABAACAACBCABCAAABBACC.exe
3604	svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CACCCCAABCBBCACBCAABCCCBCBCAACCAAACABACBCAAABBCBCCCBBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe"	2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABCACABBBBCAABCBAAABACCCCCABAABBCCBBACABABACCAACACABBAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCCAAACABAACCACCBAAACCBBCABCACCCABAACAACBCABCAAABBACC.exe"	svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1088	sc.exe
5000	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1136	cmd.exe
2724	cmd.exe
668	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCCAAACABAACCACCBAAACCBBCABCACCCABAACAACBCABCAAABBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4736	2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe
4736	2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe
4736	2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe
4736	2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe
260	svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
260	svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
260	svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
260	svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
4876	svchost_BBBCCAAACABAACCACCBAAACCBBCABCACCCABAACAACBCABCAAABBACC.exe
4876	svchost_BBBCCAAACABAACCACCBAAACCBBCABCACCCABAACAACBCABCAAABBACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4736	2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe
Token: SeDebugPrivilege	260	svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
Token: SeDebugPrivilege	4876	svchost_BBBCCAAACABAACCACCBAAACCBBCABCACCCABAACAACBCABCAAABBACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3104	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 1136	4736	2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe	99
PID 1136 wrote to memory of 3224	1136	cmd.exe	101
PID 260 wrote to memory of 1044	260	svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe	102
PID 1044 wrote to memory of 4204	1044	notepad.exe	103
PID 4736 wrote to memory of 2724	4736	2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe	107
PID 2724 wrote to memory of 1088	2724	cmd.exe	109
PID 4736 wrote to memory of 668	4736	2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe	110
PID 668 wrote to memory of 5000	668	cmd.exe	112

C:\Users\Admin\AppData\Local\Temp\2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_6da568c5f787a6d95850fe36bd266819_coinminer_elex_hijackloader_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABAACCCBAABBCBBABCCCABBCCCBCABACBABACAABCCBCABCBCBBBCBBBCBABCBCACABBACABABBCABBACBCCCACCCBBBBABAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1136
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABAACCCBAABBCBBABCCCABBCCCBCABACBABACAABCCBCABCBCBBBCBBBCBABCBCACABBACABABBCABBACBCCCACCCBBBBABAAABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABBBCCAAABBCAAABBBCBCBABABCABCBAACACAACCBACCBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe" start= auto displayName= "UserDataSvc_CCCABBBCCAAABBCAAABBBCBCBABABCABCBAACACAACCBACCBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2724
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCABBBCCAAABBCAAABBBCBCBABABCABCBAACACAACCBACCBCCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe" start= auto displayName= "UserDataSvc_CCCABBBCCAAABBCAAABBBCBCBABABCABCBAACACAACCBACCBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABBBCCAAABBCAAABBBCBCBABABCABCBAACACAACCBACCBCCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCABBBCCAAABBCAAABBBCBCBABABCABCBAACACAACCBACCBCCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5000

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:260
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1044
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4204

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3104

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCAAACABAACCACCBAAACCBBCABCACCCABAACAACBCABCAAABBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCCAAACABAACCACCBAAACCBBCABCACCCABAACAACBCABCAAABBACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACAACBCCACCACCBABACBAACACAAAAACCBBCCAACBABCBACCBCBABA.exe
1⤵
- Executes dropped EXE
PID:3604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4615830a1ff12b8f18ee8c459e0dcf9c31a789915cf27f23e1d5f52a3679467a
MD5 216974ad43a0c2c576f6cf6965eed535
SHA1 e0166a27cfc9b48a09371ca38e4338f469aba620
SHA512 246a335a787dba9b94fe1ba556fdf26f8ecf89a10601a975858a16e0a0190b3ab199947e6dba1bf40d6217109e1680d5589e404724f7efa1d480b1fbb5e7ba93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8845e9c63628842390a91e1819c168d4d891311a5036b7362b9e733c9893d3ac
MD5 a987e110de5d664e3fb89cef90900c6a
SHA1 c5bcd216a53e04e6068824d9c18f181a1ea72b06
SHA512 854427c08805cbaabf1a6f46ba18ba27182af816d11550b47f84f0a3d6d57b4a0cbb94d5828aa834ac1b83100497d9f7fa2782f448d7763d509c1a8848de9682
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59c8ee8bce1dd32856699bd24d19b4a67095572f5dc44b7f2a1898a1b12b345f
MD5 6b86626714d93475feb4c29f970d891e
SHA1 69cf33971ad53ff737750bff9147feb091653fa5
SHA512 9be111aac78682a9b39e0a093b9e0881622b77369078b2fa4da652fd7818d137338e1d7358aa1f1ed9b87c692df95031caadf33b0dcdf829f1ce2c5ee344aee4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7a66cf8946d16eb5a6468808231ecd1977ef021451193e16dba4f2064f998961
MD5 fe5a0f9ac6243bf9f432a9458cd49ff9
SHA1 4ef9bd1c8b0ef2845e808abc9380e7e3f8481306
SHA512 6c397ec5ef1840dbe192160a3161ad5726b36c1392f60317f7c0ba1a8b9634aad9d147d2138e072bba96a079abfcf6d62a8714e285aa42b256a493956b97f5a9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a5bc2472238f39f39b87ad5e5306998a2495bbeaeb171582ed29bc3a78517387
MD5 c62ea8b87ab394a9cdbe6750062623bc
SHA1 eed6568366dab319de878d773d1168c9e2f8874c
SHA512 bc15a8978e7bdf82bd46fd07cfc6da1c3534d1896ca85115a0abb04c0e613263568e3feca9fbc281f562b104e6a9593eba84662796bdea92edac2774d93cf442
MD5 SHA1 SHA512

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 a9d18a1412559914a0eb1f2d3142ce22beebc25c78727e75ba706d16f535da71
MD5 c47ad9f51b3c66fd995f6396eb5ff5c1
SHA1 55ae58d83d2bbb86b5af9e447030d5c92b5048ed
SHA512 99bb3f103410aef65d2113937ed0cd52182488e654dbe59391226a667c5c4b4736a1a30c4942263a88f2dfc3d0a11ed8b4454d22ec933cf3cfa178da1c5030f8
TLSH
T15601C850B075E823F12138DF5D2D7F4B4CB2BB4FAD549B89130C83186765C368E518E1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/260-27-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/260-37-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/1044-59-0x0000000005170000-0x0000000005171000-memory.dmp

Download

memory/4736-0-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/4736-8-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/4876-87-0x0000000000210000-0x0000000000231000-memory.dmp

Download