f092bd33e08765dbdf959f385345d7466cfd96ea61cb47140f4a44180240c9d7

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
Size 16.8MB
Sample260908-ft2frsdb37
SHA256 f092bd33e08765dbdf959f385345d7466cfd96ea61cb47140f4a44180240c9d7
MD5 d1fea3b14775126491e7ca396b2346bf
SHA1 1c51060fb7bc814e7250323f60fa86f8d79588d8
SHA512 8449908122ee130c2e21031bc32bf258df2c4c7f96b980f885bc6cbc94e029caa1ccf600dfae0fdb804d062866d7ebf3dad872c8af425b516d2e328be949a91d
SSDEEP 49152:U+ESHP+ESHP+ESHP+ESHP+ESH9++ESHP+ESHP+ESHP+ESHP+ESHP+ESHP+ESH9+J:
TLSH
T199073A0CE6DE00B4D96AA0B08987C67ED5F17421472249EFE695CB3E1F33AE5B538B44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3276	svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
5916	svchost_CBAACCBBABCBBBCCCABBBCCAACCBCBBCABAACBCBBAACABACAACCCAC.exe
3448	svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBBCBBACCACACBAABACAAAAABACCBCBABAAABBCCACBABBBBAACABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe"	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCCCBCACABCACABCAAACCCBACBCAACAACCBBBACABABACBBCAABCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBAACCBBABCBBBCCCABBBCCAACCBCBBCABAACBCBBAACABACAACCCAC.exe"	svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5688	sc.exe
4620	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4984	cmd.exe
720	cmd.exe
1540	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBAACCBBABCBBBCCCABBBCCAACCBCBBCABAACBCBBAACABACAACCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5792	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
5792	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
5792	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
5792	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
3276	svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
3276	svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
3276	svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
3276	svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
5916	svchost_CBAACCBBABCBBBCCCABBBCCAACCBCBBCABAACBCBBAACABACAACCCAC.exe
5916	svchost_CBAACCBBABCBBBCCCABBBCCAACCBCBBCABAACBCBBAACABACAACCCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5792	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3276	svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
Token: SeDebugPrivilege	5916	svchost_CBAACCBBABCBBBCCCABBBCCAACCBCBBCABAACBCBBAACABACAACCCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5792 wrote to memory of 4984	5792	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe	92
PID 4984 wrote to memory of 3664	4984	cmd.exe	94
PID 3276 wrote to memory of 5768	3276	svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe	95
PID 5792 wrote to memory of 720	5792	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe	98
PID 720 wrote to memory of 5688	720	cmd.exe	100
PID 5792 wrote to memory of 1540	5792	2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe	101
PID 1540 wrote to memory of 4620	1540	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_d1fea3b14775126491e7ca396b2346bf_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABABBAACCCCBABCACAACBABBABAACCBCBBCBBAACBBBBBBBACACCBAAABACBAACAACACCABBABAACAAABCCACCACBACCABCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCABABBAACCCCBABCACAACBABBABAACCBCBBCBBAACBBBBBBBACACCBAAABACBAACAACACCABBABAACAAABCCACCACBACCABCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACACCCBBBBABBBBBCABCABBCACBBBACCACCAABCBBCAACCACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe" start= auto displayName= "UserDataSvc_ACACCCBBBBABBBBBCABCABBCACBBBACCACCAABCBBCAACCACCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:720
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACACCCBBBBABBBBBCABCABBCACBBBACCACCAABCBBCAACCACCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe" start= auto displayName= "UserDataSvc_ACACCCBBBBABBBBBCABCABBCACBBBACCACCAABCBBCAACCACCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACACCCBBBBABBBBBCABCABBCACBBBACCACCAABCBBCAACCACCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1540
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACACCCBBBBABBBBBCABCABBCACBBBACCACCAABCBBCAACCACCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4620

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5768

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCBBABCBBBCCCABBBCCAACCBCBBCABAACBCBBAACABACAACCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBAACCBBABCBBBCCCABBBCCAACCBCBBCABAACBCBBAACABACAACCCAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5916

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
1⤵
- Executes dropped EXE
PID:3448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0a670bc663fc5c6dc73049efa65be32da748c38452623cee9d246e9019237993
MD5 89d518c2b3d036436df998809e93038b
SHA1 95aafbffab5c4aeb81efdedc3d1790b93d186c82
SHA512 3d08e4447bf0dfb30e4494a07baaaee4c4ddf2fae54ec16d605e8d1a894805077eed8d69596311f896fd2cca35464a29db74f8f2861ba99a01a29628a25495ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ab1b193321562967bfc981c5ea99fea320b57ae73d592dfb2888995426bb0ed0
MD5 e4c5060e6f64fb2f5a21fd3e03b27b6a
SHA1 a60babcda3f7d281bde66573fe34043b232511da
SHA512 9cc86501c4ca8e8b7f61bb9b2f64b9608fe620b466f74f4fdbc1471e39585c3c543a14b0af90eb64810f5da41236e817edb9ebc41bb12b6433b1c2fd58d5ee1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b37ca0afed232b0009d5052d3feed050d239bff8b0224f19a5f06fe375e59a76
MD5 1ec32426eeb0377f296991d7dd64f471
SHA1 623065e90d984001667a0b40fc85e2cc80b351c4
SHA512 3c4f3deb97bb045b91f57a8e4533c569fa78fb1286ee54c5da772a770683554097d787133abbf489f4f979d4007ea26c7c1ff207372dbb4d476c573b202e4a6f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a99b32aa3ae1cec0edd5c2037e27b99e27c6a10f162e26eaebba6334873549dd
MD5 3946d16d66d26d3615f7a8fa60159d93
SHA1 eb781ccff4e674d95ddd69a9165b148ab64dbdc0
SHA512 162d0c096ced6ad5d69f55fdad181594cf78c9052c101552a8a7b01134cad59de4f2d8edde6f87b56f908c31e97d937c5345e8e54a66117e30e7d3c4a5462186
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1e4e03bce9126cde39c1a81f53dbbecde04e1e5ede3e77af0e69cd3a8f7aeb2b
MD5 bb3b6cfab352c56cc4703f83fd926b78
SHA1 56ba35ac79fc27ad6f235d20b4b9142d6efd9630
SHA512 5b43c886050639b7723ec77c170682f2ad92daf897a15ec1222ac7908a003bfc34014422a5be3733751582bcee15c3a367841a3e25af8c83997721b57a16f92a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4797eb076439802eba380ab797eb0e2cf3dc4193a7461880f9ea6284ca4aa036
MD5 585f6e0c7eaa7e31c46fb657c7e49371
SHA1 f009cfdbc88a17fe59d395ae08ec10fc2791eb12
SHA512 fe8f2f3767b43e1cbe0090bcab5603aa5f78e88451745f299c651c4bb4c601ac93b2a0f79041876261e7dc098335e06761054d93d506b33530a33a47bfd0396d
MD5 SHA1 SHA512

Submit Download

svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBAAABBACBCCBAAAABCABCACABCABACAACBACBBAACACCABCBBAACC.exe
Size 16.8MB
SHA256 f092bd33e08765dbdf959f385345d7466cfd96ea61cb47140f4a44180240c9d7
MD5 d1fea3b14775126491e7ca396b2346bf
SHA1 1c51060fb7bc814e7250323f60fa86f8d79588d8
SHA512 8449908122ee130c2e21031bc32bf258df2c4c7f96b980f885bc6cbc94e029caa1ccf600dfae0fdb804d062866d7ebf3dad872c8af425b516d2e328be949a91d
SSDEEP 49152:U+ESHP+ESHP+ESHP+ESHP+ESH9++ESHP+ESHP+ESHP+ESHP+ESHP+ESHP+ESH9+J:
TLSH
T199073A0CE6DE00B4D96AA0B08987C67ED5F17421472249EFE695CB3E1F33AE5B538B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 27c5d0d6e56de6fb7637e634c0b969fd626fa5188be39d577c618eb1ff539726
MD5 dcb812a43a6d3fa0e8ff97dd7da5e67d
SHA1 c3d35e1d851d0c5a1975a47156aa75ff061b7426
SHA512 4228fc80d17ddda8f7407559c9125b819ebf4a2200e8cf976aca498265dbccca5decbfece5c7e347a734d977fb00044f15c00bff83ee7df32ecfaa33996ca03c
TLSH
T1B411E751F0A79423F1716CDB563ADBC748A43B8F5CA8AB185208821A7761C399F168E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3276-24-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/3276-34-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/3448-80-0x0000000000050000-0x0000000000071000-memory.dmp

Download

memory/5792-7-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/5792-0-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/5916-70-0x0000000000950000-0x0000000000971000-memory.dmp

Download