8ef3b12508c85e14702d8a92c75017bbb8a994182fffe12ad2ebe609c3dea4dc

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe
Size 14.5MB
Sample260909-am3glazelb
SHA256 8ef3b12508c85e14702d8a92c75017bbb8a994182fffe12ad2ebe609c3dea4dc
MD5 631e71af4b5a5736f7f5e98e223a6c73
SHA1 b9e61ed6499071aa153ae0a02e9292bb08c60cbc
SHA512 362a1c132f0333e0caf560378a20f3788b7640558254cd0777a66cbfc2b3abb3a78252f9c0667a21b8e651dbe211763ea5ffd4834625287fb88e25de75a40444
SSDEEP 49152:U+Es+ES+EzD+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+El5+Es+ES+EzD+Es+ES+H:n
TLSH
T193E62B09F98740B1E83B51B04DDBD3BF8A30BB2186128DFBE64DC75BA933B915838655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
256	svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
4240	svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
928	svchost_ABBBCAACACBBCCCCCAAABCCACBACABABAAABABAAACCAAAABBBCCBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCCBCAABABCBBACAABBBBACACCCBBCBCBBAAACCAACCBCACCBBABACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe"	2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBCABCBAACACCCBCCBCACAAACACBBBBBACACCABCBAABCCCBCBBACCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBBCAACACBBCCCCCAAABCCACBACABABAAABABAAACCAAAABBBCCBCB.exe"	svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5652	sc.exe
5100	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5360	cmd.exe
5640	cmd.exe
5936	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBBCAACACBBCCCCCAAABCCACBACABABAAABABAAACCAAAABBBCCBCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3548	2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe
3548	2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe
3548	2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe
3548	2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe
256	svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
256	svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
256	svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
256	svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
928	svchost_ABBBCAACACBBCCCCCAAABCCACBACABABAAABABAAACCAAAABBBCCBCB.exe
928	svchost_ABBBCAACACBBCCCCCAAABCCACBACABABAAABABAAACCAAAABBBCCBCB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	256	svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
Token: SeDebugPrivilege	928	svchost_ABBBCAACACBBCCCCCAAABCCACBACABABAAABABAAACCAAAABBBCCBCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 5640	3548	2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe	91
PID 5640 wrote to memory of 6096	5640	cmd.exe	93
PID 3548 wrote to memory of 5936	3548	2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe	94
PID 5936 wrote to memory of 5652	5936	cmd.exe	96
PID 3548 wrote to memory of 5360	3548	2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe	97
PID 5360 wrote to memory of 5100	5360	cmd.exe	99
PID 256 wrote to memory of 3912	256	svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_631e71af4b5a5736f7f5e98e223a6c73_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBABBBACABABABAABBBBCABACBCACBBCCABACAABBBCACBCABCABABBBCBBABABCCBABABAABBCCBABBCCCCCCBBCCBBCAACBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5640
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBBABBBACABABABAABBBBCABACBCACBBCCABACAABBBCACBCABCABABBBCBBABABCCBABABAABBCCBABBCCCCCCBBCCBBCAACBBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAACCBBBABCBBCABAAAAABBBCBACCACBBAABBCABABCCBBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe" start= auto displayName= "UserDataSvc_BAAACCBBBABCBBCABAAAAABBBCBACCACBBAABBCABABCCBBCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5936
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAACCBBBABCBBCABAAAAABBBCBACCACBBAABBCABABCCBBCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe" start= auto displayName= "UserDataSvc_BAAACCBBBABCBBCABAAAAABBBCBACCACBBAABBCABABCCBBCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAACCBBBABCBBCABAAAAABBBCBACCACBBAABBCABABCCBBCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5360
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAACCBBBABCBBCABAAAAABBBCBACCACBBAABBCABABCCBBCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5100

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
1⤵
- Executes dropped EXE
PID:4240

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCAACACBBCCCCCAAABCCACBACABABAAABABAAACCAAAABBBCCBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBBCAACACBBCCCCCAAABCCACBACABABAAABABAAACCAAAABBBCCBCB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 cbd80a460fb85c4e342d270270cd4e6c1fbc74580f0b9f412c1c3ae5513bd3dd
MD5 6ca49f11524f0f8f66370cbf482384c3
SHA1 ff82aabbe774713f00f2415220d23e90b8807ec8
SHA512 aa7decfcf99fb5f3c7eba317c7a886ce1fa70791079ce87e11b1be0a35ee0bb3838170c0eb0f8aec98370643249ffa6248516a1a3d245bb6e739ff659a9e0319
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 10099cc4f5e88ad4692e65028ffe1c5676c6782f2ebd846092ea34ece3ab94d5
MD5 7e0a8dd7539f325fe377beab51707ccf
SHA1 f9c93407d1bb7f5f7a32d6f582cf36e174806c60
SHA512 51449453dc9e8e579d48b610b22a3f1452da5ec168f1f2b4e5e42ad7ac70b6e601350f728728ed7938183cc166830b80c93ae0a79d0fbc5a5541ac836b448504
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3770bc3adb8bdc3ec3f4f64fca83b79ccbaee98c10ac5d90681684a80ff684a0
MD5 1f27dda8a9325ffd3417b551e26d59bd
SHA1 452ad2251f8bb17ec49efa2c9a7acb0587f241c9
SHA512 ada67e3770b1d9309b38ce0c1fbb9e0ab987037f7e5088b69d5b7b90c2db4481e26a50b210d5bfb71b16a48b5a71a1e5a41afc578c227162b0ae47b40b8fca56
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2b80c4a2bad35fb20c51537920c09e79a600701ff4c5973b8d9d2cedc73ee09d
MD5 1a62e38650fa882c046b431efe1ed4d3
SHA1 9d0f37f036ad5effaf47418b9cb5d698494fbcb1
SHA512 a1ef5757362eceddd21224001b8fd1080ad51bd9088a2bd0f75dfc43a3e49de34db2085839235f527ef8dceb22ecbe9add4ebe5b4dcd4762868619680ac44fc2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 18786234df1d9694e6b5e7990c8d26b2f72f1699b71520af3ec350df6e367749
MD5 c25aad03d85f71848dbb05cc33cfd798
SHA1 1b23a95ba3d93812cf541f0e0efbb9532a4768c8
SHA512 cc39574a40debd40a61edbc90a9baaa26fc7d96d5042190ceb8e56094ea2eaec59b69fd82ecf882eb9ca5758a65536c541f3f4e53451c51562f90e945fb0dfdd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a0d8ae8daec0fc62318bd2c5dbfc60077805cdc7b90b43fe0e9c8564b143d029
MD5 e741b4c42068da962766a5c76ebb4232
SHA1 415a5533a1ec7d9a85c74652ae204e8e88716ae9
SHA512 186d702f04019f155bb9720fad3f55071a360e4a0d8bce75ab238c43b2ff426b24ee31ca3fc8ccf944799ebf031f92a91a656e2e17cb598bb1b62cc2cca259a6
MD5 SHA1 SHA512

Submit Download

svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBACABCBCAAAAABAABBBBABABABCCBABACAABABBABACBCABCCAC.exe
Size 14.5MB
SHA256 8ef3b12508c85e14702d8a92c75017bbb8a994182fffe12ad2ebe609c3dea4dc
MD5 631e71af4b5a5736f7f5e98e223a6c73
SHA1 b9e61ed6499071aa153ae0a02e9292bb08c60cbc
SHA512 362a1c132f0333e0caf560378a20f3788b7640558254cd0777a66cbfc2b3abb3a78252f9c0667a21b8e651dbe211763ea5ffd4834625287fb88e25de75a40444
SSDEEP 49152:U+Es+ES+EzD+Es+ES+EN+Es+ES+Es+ES+EzD+Es+ES+El5+Es+ES+EzD+Es+ES+H:n
TLSH
T193E62B09F98740B1E83B51B04DDBD3BF8A30BB2186128DFBE64DC75BA933B915838655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 770c9c8e2a963d9c46d7acdbc8009c3caff4dd3350b772ef65f0a85f0b753a09
MD5 0576f76363508af2d56922df0413d1ea
SHA1 28a35607e5e837babc1065b22505ab3d89a6e633
SHA512 4144ec5a7770955f823f759e5606987c59393897257902f606cea9779decfb758d8f0bd9b1ef74adeffe1ca5d3d17983bfcf3b89856a73058425321041157214
TLSH
T1B111A762E0A6E847F132E89BE11DAB4B0CE03F5B9C58AB951309421D7B89CB5CD158F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-35-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/256-22-0x0000000000450000-0x0000000000471000-memory.dmp

Download

memory/928-72-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/3548-6-0x00000000006C0000-0x00000000006E1000-memory.dmp

Download

memory/4240-66-0x0000000000450000-0x0000000000471000-memory.dmp

Download