4f780a9a78988f6732c73e0421086e7e89c4bacf7c60e1b8acc380449fddc46e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe
Size 8.6MB
Sample260907-vfegeaaa75
SHA256 4f780a9a78988f6732c73e0421086e7e89c4bacf7c60e1b8acc380449fddc46e
MD5 771089fae18a597c1fac7b7618877d96
SHA1 3120121b4a26a66e8796c5a16f431a5f01597845
SHA512 23e12e3441f2fcf7ac2bf7e3a0f1c098e2c9afd070cf52be590ebcbf42ca0bc6f314a99af01a9b7f0aaef4aafa1484dbb811a20356aca5493c1daacd0abb6ee5
SSDEEP 49152:U+Ef+EPiw25+EjozMlTzQ/7YGsTjfg+Ef+EPiw25+Ef+EPiw25+EjozMlTzQ/7YD:J1MbQS1MbQS1MbQS1MbQS1MbQY
TLSH
T14C965B09B7ED40A4E5B7E17489AAC636E7B17811473197DF8691C62F2F33AD0AC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2948	svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
4636	svchost_BCACBCABCCCCBAACCABBBBBBACCCACCAACBBCCCABBBAACBABBCAAAC.exe
220	svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CBACABBCAABACCBCBABABACBBCCCCAAACCACCCABCCACBAACBCABCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBCABCCCCBAACCABBBBBBACCCACCAACBBCCCABBBAACBABBCAAAC.exe"	svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_BAABCCAAACACBBBCCBAAABBBBBBBCACCBBAABBACACBBACBBCCCCCBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe"	2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4680	sc.exe
4852	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1760	cmd.exe
3080	cmd.exe
2280	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBCABCCCCBAACCABBBBBBACCCACCAACBBCCCABBBAACBABBCAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5084	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5228	2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe
5228	2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe
5228	2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe
5228	2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe
2948	svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
2948	svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
2948	svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
2948	svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
4636	svchost_BCACBCABCCCCBAACCABBBBBBACCCACCAACBBCCCABBBAACBABBCAAAC.exe
4636	svchost_BCACBCABCCCCBAACCABBBBBBACCCACCAACBBCCCABBBAACBABBCAAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5228	2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2948	svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
Token: SeDebugPrivilege	4636	svchost_BCACBCABCCCCBAACCABBBBBBACCCACCAACBBCCCABBBAACBABBCAAAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3916	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 1760	5228	2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe	95
PID 1760 wrote to memory of 5084	1760	cmd.exe	97
PID 2948 wrote to memory of 4740	2948	svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe	98
PID 4740 wrote to memory of 5716	4740	notepad.exe	99
PID 5228 wrote to memory of 3080	5228	2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe	103
PID 3080 wrote to memory of 4680	3080	cmd.exe	105
PID 5228 wrote to memory of 2280	5228	2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe	106
PID 2280 wrote to memory of 4852	2280	cmd.exe	108

C:\Users\Admin\AppData\Local\Temp\2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-05_771089fae18a597c1fac7b7618877d96_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBACACACABAABBCCACBCAAAABABCBCCCACCBBCBBCCBCBAAAACCBAACBCBABBBABAACCABBCBBACACCBCBBBBAACABBAACCCCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBACACACABAABBCCACBCAAAABABCBCCCACCBBCBBCCBCBAAAACCBAACBCBABBBABAACCABBCBBACACCBCBBBBAACABBAACCCCBBCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5084
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AACBABCCCAAACCCCCBCCAAACBBCABCAAACBCABBCCABBACBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe" start= auto displayName= "UserDataSvc_AACBABCCCAAACCCCCBCCAAACBBCABCAAACBCABBCCABBACBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3080
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AACBABCCCAAACCCCCBCCAAACBBCABCAAACBCABBCCABBACBBAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe" start= auto displayName= "UserDataSvc_AACBABCCCAAACCCCCBCCAAACBBCABCAAACBCABBCCABBACBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4680
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AACBABCCCAAACCCCCBCCAAACBBCABCAAACBCABBCCABBACBBAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AACBABCCCAAACCCCCBCCAAACBBCABCAAACBCABBCCABBACBBAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4852

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:5716

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBCABCCCCBAACCABBBBBBACCCACCAACBBCCCABBBAACBABBCAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBCABCCCCBAACCABBBBBBACCCACCAACBBCCCABBBAACBABBCAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4636

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
1⤵
- Executes dropped EXE
PID:220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 60566e72773f9d88d1a794a0765947c8f4e31a2a319e1759698ae4ca13618d37
MD5 d7421797d8a7ed2c3cd179d34cea417a
SHA1 bd7b0fb6f040dfe5252585068f1b168928c2759b
SHA512 4c45990ea1ba14572182e18160fbfd2e7b5ac6b2da303a3865f794d9629d94e5ad96cfd55d76953951e1ebe1b09571e3b38bc53c7bd25f9313c7a03bf3866a44
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bceca6f7eb478e2bf412a152cec8df997b9c2a4514b21fc89f877cb4943bf3d5
MD5 9b05bd7c19b579e1b7fe4cea3329d9ce
SHA1 6ebc9655f07f7c7d542fc6c8a8085d48c30d1898
SHA512 2bb7ad922557bd5268e68fad301865c832a3527453948c1b8d28718549bca363a732d6ed8088f278701832995fe2060981da8a55bbec3aa53f8fd01e39464eb4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 461501310e7e8f950d25e6ea006c9a73988ee29189d600a61a64159c304745f8
MD5 4726f8f9c8af0ca0c13b0ae40236f44b
SHA1 c33bcab24db2ddf4ac01531971d95b5aba6e4677
SHA512 49d2ebc57c43b13b69f91994381272f94197e06e105abf6c8dcf79faf34ad036c7af59382b520d5085a01d8ed4825af717bf5d0a66c9ba14450567499a79b9b2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 051f1073f0a68105957ca21b0d808d7616344300d29d6ed9c188615fea8df4ff
MD5 a325ca086ca3c569a8a0946283a1afa7
SHA1 9a42867adb3ce10bcba0ebc9933bc4d3f2d609c1
SHA512 dc7439d9289b2522860de36e733352b0316c2374e5a5f76be4ce43ae2a9f7d789b4c670d76c1a731e235418f84a4707919d85a1c322af960f7ef593079439090
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a9e2dcd464e63be934d106154e5f22104353b5df157f140a262c58e7db6de394
MD5 b7d5496b01d5333fc020f94f1ead0251
SHA1 7dac5aa65d092579e97bd607f8647f2cf7e6e64e
SHA512 c44e0cf3c217ca925a1dac5beb64b9bd4a0bb64b37c7333d75c76dfa1d2173c41ea82d6c0af454c5a15b1138ea5e4fe37821bd55e776ee4a030da955783e94e0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3c2591a0212565bb963398ed7e9688d073b08caa9f412bdf5d7674ae20554f52
MD5 3428cb648693a40efa1abc9b73aa2823
SHA1 b198dffab2032f0c6b8d8fe9dcb6c018d471e739
SHA512 8946e8dcdfc04b564b5e7b25ba6e2816616c7312de60ae34738add288026c87ec761cf1e65459d9e75c59c0ffc02c23753ef2d2eb950097bb1a0e354b15eafb3
MD5 SHA1 SHA512

Submit Download

svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAACACAAAAAACCABABBACBACAABABAABCAACCAABCABBCBBABBBBACC.exe
Size 8.6MB
SHA256 4f780a9a78988f6732c73e0421086e7e89c4bacf7c60e1b8acc380449fddc46e
MD5 771089fae18a597c1fac7b7618877d96
SHA1 3120121b4a26a66e8796c5a16f431a5f01597845
SHA512 23e12e3441f2fcf7ac2bf7e3a0f1c098e2c9afd070cf52be590ebcbf42ca0bc6f314a99af01a9b7f0aaef4aafa1484dbb811a20356aca5493c1daacd0abb6ee5
SSDEEP 49152:U+Ef+EPiw25+EjozMlTzQ/7YGsTjfg+Ef+EPiw25+Ef+EPiw25+EjozMlTzQ/7YD:J1MbQS1MbQS1MbQS1MbQS1MbQY
TLSH
T14C965B09B7ED40A4E5B7E17489AAC636E7B17811473197DF8691C62F2F33AD0AC38B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 02f5d95d568b489bf58de6b7e8119d124a428972ca980a54ca93744ee05e4658
MD5 828c45d78790d1e3403329e805d8e37d
SHA1 f0813349cb6a545df7cfe1e27f70a73a04c13268
SHA512 33180cfb7a82ed55bffe1244fb5521180ee37873900c9eac6dfd9c23a50093e08defc2f3e412ff769fcc68972eb71e2055eb04e428af314e80b7c97878d027a2
TLSH
T1FE119460F065D8A3F13178DB6E2DCA971CE93B9F691DAF2C13094218A716C364E194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/220-89-0x0000000000130000-0x0000000000151000-memory.dmp

Download

memory/2948-36-0x0000000000130000-0x0000000000151000-memory.dmp

Download

memory/2948-26-0x0000000000130000-0x0000000000151000-memory.dmp

Download

memory/4636-87-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/4740-60-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/5228-0-0x0000000000370000-0x0000000000391000-memory.dmp

Download

memory/5228-7-0x0000000000370000-0x0000000000391000-memory.dmp

Download