27426e377c93adb6480d10adf643e59185069a1f1f55d54ff6414e1cd6814780

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe
Size 3.2MB
Sample260907-pc573ahq2w
SHA256 27426e377c93adb6480d10adf643e59185069a1f1f55d54ff6414e1cd6814780
MD5 943db31676a2dad88205b11472cc7d79
SHA1 04fb457676f8d87eb6404499dd2e5403dc01ae14
SHA512 a639cc83659e293cbea7000b9b608a9ecb211d21ec3cbe418b2bd9ec5ad9eaf64ff9a4bf829c96672b1e005a1bdbc80dbf1bf65639793a437a04e9ef40fe5599
SSDEEP 49152:U+EZpH+EZpH+EZpH+EZpH+EZpH+EZpH+EZpH+EZpH+EZpW:h
TLSH
T18FF54C09FBE910A5F4B742708966827A9630BD344711D6FFA294E33E9E33BD09D34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3672	svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_AAABCCCBCAACABCCCBABCABCABAAABABBACACCBAACBCAABCAACCBAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe"	2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4364	cmd.exe
2472	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3352	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4032	2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe
4032	2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe
4032	2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe
4032	2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe
3672	svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe
3672	svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3672	svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4032 wrote to memory of 4364	4032	2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe	90
PID 4364 wrote to memory of 3352	4364	cmd.exe	92
PID 4032 wrote to memory of 2472	4032	2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe	99

C:\Users\Admin\AppData\Local\Temp\2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_943db31676a2dad88205b11472cc7d79_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4032
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBCCBAACBBBACCBBBBBBBCCBBCACCBBBBCBBCACBCCBCBCBABABCBCABBACBABCCACBCCCCCCBAACAAABBABBABCCCAACCCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCCBCCBAACBBBACCBBBBBBBCCBBCACCBBBBCBBCACBCCBCBCBABABCBCABBACBABCCACBCCCCCCBAACAAABBABBABCCCAACCCBACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AAABCBABBCABBABCBBCBAACCBBCBACBCCBBBBACACACCACCBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe" start= auto displayName= "UserDataSvc_AAABCBABBCABBABCBBCBAACCBBCBACBCCBBBBACACACCACCBAAA"
  2⤵
  - Executes a command shell one-liner
  PID:2472

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ca7dd2c9fee96a7b8eaa477f65bd7935a44667ecfbcee51f384d2f946f0bf6e
MD5 591c1c1de4c7c07c4b1cfebff61fe87c
SHA1 85ba3a670867c59a1677898adccd193ec474e23c
SHA512 80817b1454f7fc6e5385c48fe90ed29033ec2a03906410df29341e1b7c81776ccb5feb1fdbbc52ddf52222bc493c97c067aa4a9fe3a00a323d6917db67db01af
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ca294b925b3ab1c454bcdfae3d1ead1ddbb1ffef31f23a7970594d313ff7da4
MD5 8d98a9d8a070e3def4bd6a10e10cc363
SHA1 980aa136a257b2efb51238a0f4c27012f33c6b3e
SHA512 2e62c679fab096dae3e4bcae3b9c63d2b34f0c8604c959bb925892c55f586a7a763cf55d045f3b03aebc7f5a97f21215e9f8d386a2e8e45e4e7dbee820baeb10
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e2d4420b79bd5c23660b292b9b345528e256b68b5899217c5c31b29f85a6fea4
MD5 3c3ddf5f07f4e4bb4a571488dab53e6d
SHA1 a47eda162795a6f74201573a82534985e51e2a8c
SHA512 e7f6a0e44a7e7cef60707f1c7b39ca12608f447cb6bcbd3197dc830ee86048895a890b4c6cd774530ce060e0a60c0f64e8e7f685e8dd559099cec41481a94c53
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 55180cb1be1e667d54879e134b08a67fdb2a6f093689268a869de85b78cd42e3
MD5 4ae02e99b59af7925989cf4352a3e7d3
SHA1 ddedfb19c01cb29fd855a511b0ef8743051a52d5
SHA512 20071b3c7bc9dd5494cb0ce4f93b9a78f2bc48412f79e583650d969e59cd9bb96f10c2977a6034806eb2289c7e769858fcf5eb77e7a1cd672e8f8e0d0a418345
MD5 SHA1 SHA512

Submit Download

svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACBCBCAAACBCBACBBBABCBBCBBBACBACBBACBCBAACCBCCBCACBCA.exe
Size 3.2MB
SHA256 27426e377c93adb6480d10adf643e59185069a1f1f55d54ff6414e1cd6814780
MD5 943db31676a2dad88205b11472cc7d79
SHA1 04fb457676f8d87eb6404499dd2e5403dc01ae14
SHA512 a639cc83659e293cbea7000b9b608a9ecb211d21ec3cbe418b2bd9ec5ad9eaf64ff9a4bf829c96672b1e005a1bdbc80dbf1bf65639793a437a04e9ef40fe5599
SSDEEP 49152:U+EZpH+EZpH+EZpH+EZpH+EZpH+EZpH+EZpH+EZpH+EZpW:h
TLSH
T18FF54C09FBE910A5F4B742708966827A9630BD344711D6FFA294E33E9E33BD09D34B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3672-28-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/3672-41-0x0000000000460000-0x0000000000481000-memory.dmp

Download

memory/4032-0-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/4032-8-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download