f092bd33e08765dbdf959f385345d7466cfd96ea61cb47140f4a44180240c9d7

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/09/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
Size 16.8MB
Sample260908-ft2frsdb37
SHA256 f092bd33e08765dbdf959f385345d7466cfd96ea61cb47140f4a44180240c9d7
MD5 d1fea3b14775126491e7ca396b2346bf
SHA1 1c51060fb7bc814e7250323f60fa86f8d79588d8
SHA512 8449908122ee130c2e21031bc32bf258df2c4c7f96b980f885bc6cbc94e029caa1ccf600dfae0fdb804d062866d7ebf3dad872c8af425b516d2e328be949a91d
SSDEEP 49152:U+ESHP+ESHP+ESHP+ESHP+ESH9++ESHP+ESHP+ESHP+ESHP+ESHP+ESHP+ESH9+J:
TLSH
T199073A0CE6DE00B4D96AA0B08987C67ED5F17421472249EFE695CB3E1F33AE5B538B44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3760	svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
2152	svchost_CBAACBBBAAACABCBCCBBABBCACCCCAABCCBBAACABCACACAABABAAAB.exe
3736	svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CAACCBACBCBABBAACCBAACAABBBBCAAACCCABCBABACBAABCACBCABCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe"	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CCCCBAABBCBABAACCABBCCAABBCABBCCCAACBCCCCBBCBABCACBBACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAACBBBAAACABCBCCBBABBCACCCCAABCCBBAACABCACACAABABAAAB.exe"	svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1828	sc.exe
3876	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2656	cmd.exe
4788	cmd.exe
5056	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACBBBAAACABCBCCBBABBCACCCCAABCCBBAACABCACACAABABAAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4360	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3720	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
3720	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
3720	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
3720	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
3760	svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
3760	svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
3760	svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
3760	svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
2152	svchost_CBAACBBBAAACABCBCCBBABBCACCCCAABCCBBAACABCACACAABABAAAB.exe
2152	svchost_CBAACBBBAAACABCBCCBBABBCACCCCAABCCBBAACABCACACAABABAAAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3720	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3760	svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
Token: SeDebugPrivilege	2152	svchost_CBAACBBBAAACABCBCCBBABBCACCCCAABCCBBAACABCACACAABABAAAB.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3372	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3720 wrote to memory of 4788	3720	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe	97
PID 4788 wrote to memory of 4360	4788	cmd.exe	99
PID 3760 wrote to memory of 3536	3760	svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe	100
PID 3536 wrote to memory of 2052	3536	notepad.exe	101
PID 3720 wrote to memory of 5056	3720	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe	105
PID 5056 wrote to memory of 1828	5056	cmd.exe	107
PID 3720 wrote to memory of 2656	3720	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe	108
PID 2656 wrote to memory of 3876	2656	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBACCCCCBCBABBCCACBBAAABBCBBCBACCBCBCBCBBAAACCABCACACCBBBCAAAABBCCBBBBABCACAACBCAAAACCCCCABCCBAAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABBACCCCCBCBABBCCACBBAAABBCBBCBACCBCBCBCBBAAACCABCACACCBBBCAAAABBCCBBBBABCACAACBCAAAACCCCCABCCBAAACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4360
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBBCCBCBACCBACAACACBAACCCBBCBCBBAAABBBAACCBCBABBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe" start= auto displayName= "UserDataSvc_CBBCCBCBACCBACAACACBAACCCBBCBCBBAAABBBAACCBCBABBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBBCCBCBACCBACAACACBAACCCBBCBCBBAAABBBAACCBCBABBACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe" start= auto displayName= "UserDataSvc_CBBCCBCBACCBACAACACBAACCCBBCBCBBAAABBBAACCBCBABBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBBCCBCBACCBACAACACBAACCCBBCBCBBAAABBBAACCBCBABBACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2656
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBBCCBCBACCBACAACACBAACCCBBCBCBBAAABBBAACCBCBABBACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3536
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:2052

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3372

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBAAACABCBCCBBABBCACCCCAABCCBBAACABCACACAABABAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACBBBAAACABCBCCBBABBCACCCCAABCCBBAACABCACACAABABAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2152

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
1⤵
- Executes dropped EXE
PID:3736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99105f22abb128c6133d8f8134bc7354dace5a2880aad70ff442ef90ef97ddbc
MD5 2990c4ee05516347c415ac635f30e674
SHA1 b8c588e2a804d44c0ebea78724851906c6994115
SHA512 0917b9ad3a1326a32b9967162250f184cc4f04910b23dfa7f7f6b8137607edc75b861fde5bcc7af5a99b55ee184ef142c7b450e246b1da3c163d3e76270516b1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62d57fafb1b53e64d5dff2d767313af74ee6bee6d0f1bf40c0b24d9f08da4813
MD5 5da9c290302e4c6990e66387594ebabb
SHA1 4e28556f524435ef30a94f66e949e080d22c35b9
SHA512 d175a917d3a3c4c4a3c3f02e061028f30da8276652a402c948785bac067151b194c76676b167e746503b3e2ac6818c88fa06e49c80e6ea35fb538aec31dbdb16
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a46d3e0d00257eec4e47fef4331419dbff3631c460da13dcc72fe15f01bc5a5d
MD5 ecc5fceb7faef1b20d0a4b86535a524b
SHA1 155c5e9fb7fa2818c2c83be1f2a9555ae71fd1a2
SHA512 7d754506971351f4ad117b5a5854ac8edafdce4edd7fab43791df2ccfb324d03efd42b47f609b930d6657cc4dfd3ec1feadf409e0176ab5f392b72f0d43a9f3c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 e22e451ffaed8e788f99e2fd39f6e2133b2b611c327bf5d9cea541dc75fdeaf3
MD5 ba52985c63768428cd285545914cff42
SHA1 77569d3c8be04906c2948256cb4ca2d2dd0b7800
SHA512 090ba8735c6893836d97b9630f71454fbe7d60efff6ee95c1747c0883c2310033f5fb4c44b53a47af7d03719c631004366ad4f6a825ab217804426fc7d518917
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 55a229c678cf91e8eeae6874ffe90517c7c149d2f83ec744e7e4bb08af114d98
MD5 d02facae121ae007d1073f67600a040e
SHA1 0009050ff8ef827874e16c9572f6f5d9f00047f5
SHA512 07340c8287ae2793e1817a02e50adf11d2db606cc75e315f4e2ae0ba71d1016f4474cf19406de97c5584f595b265d979ac4b9429b3e08f35c57ea246b9b5f5de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 29bb2b1027db0db17834fd16f468cf527e60f1a1e05fbedaaae45c86db61ed16
MD5 8f750bb33e4bf4cff0e97f176dc26e0e
SHA1 0fa395a31f54c6cc748d91c0cdccf8009d0e7f66
SHA512 cd2149fb09e9c5c07257dadc85cde40d68c4c35e34a6860ca82f865e381eea851fabd63306a67abe61b3d89f38a72786770b56805fe9f544751f43100c190014
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4a1ddb8375bdaa3d1990b0aa3d99e75a542fb952350a0e887b192f08383cd4bb
MD5 b4fed8f41124ea3998ad58595ace97ff
SHA1 9e2683780068cc964b2393486c4005f61bb20459
SHA512 b2b6d40c094c6fd25cd3fedeb8d81038925c07d987faa963f08341bb41a253ea69915c93de1a0db606366618c9c3d9b14e15c05a0a00db5a913b6c3106e5c862
MD5 SHA1 SHA512

Submit Download

svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACCAACACCAACCBBCAABCCCCBACACBACBBCBBBBABAAACCBACCBCA.exe
Size 16.8MB
SHA256 f092bd33e08765dbdf959f385345d7466cfd96ea61cb47140f4a44180240c9d7
MD5 d1fea3b14775126491e7ca396b2346bf
SHA1 1c51060fb7bc814e7250323f60fa86f8d79588d8
SHA512 8449908122ee130c2e21031bc32bf258df2c4c7f96b980f885bc6cbc94e029caa1ccf600dfae0fdb804d062866d7ebf3dad872c8af425b516d2e328be949a91d
SSDEEP 49152:U+ESHP+ESHP+ESHP+ESHP+ESH9++ESHP+ESHP+ESHP+ESHP+ESHP+ESHP+ESH9+J:
TLSH
T199073A0CE6DE00B4D96AA0B08987C67ED5F17421472249EFE695CB3E1F33AE5B538B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 930B
SHA256 f882a6711f258c13426f445f5649718d797abbedd6b924dd4b0c47bc218a1750
MD5 87c81193b73b2f666decc185c40ee4ef
SHA1 e497e6f70a82443982b5d56548ecf6457b8ed5fe
SHA512 c9ccfb4a96326fbeb9d5e11e3801611c2948c65ae9269f118521aa7000138244ac6933f2e69538a44ba1078e248263f71d4af44e49a8a8cd6b59e17d613ad880
TLSH
T15611C860F067DC23F1722CCA96259B974CE43B9BDC6CAB546305021AB745C3DDF1A8B2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2152-72-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/2152-90-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/3536-59-0x0000000005830000-0x0000000005831000-memory.dmp

Download

memory/3720-0-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/3720-7-0x0000000000280000-0x00000000002A1000-memory.dmp

Download

memory/3736-92-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download

memory/3760-36-0x00000000001D0000-0x00000000001F1000-memory.dmp

Download