fcce0fbb97e314cd921eedfe37c96393fdc5b0662d32dbd88571e1e8e5c2adf1

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/09/2026, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe
Size 9.2MB
Sample260909-bj2assae44
SHA256 fcce0fbb97e314cd921eedfe37c96393fdc5b0662d32dbd88571e1e8e5c2adf1
MD5 58d47b230ccdb7fe389c5b20f195611e
SHA1 4a4764658a046077f911f827b50dba84054bbf38
SHA512 c4fe3a6593e92afc7f800452044a2d42e9ab393d7e6ae91a7b59d7e1ee6fa0d9a6e4c36676f337d91f5b72c7f8813d266d25286c97376443afe234e62e969ab4
SSDEEP 49152:U+E7+ELgy6i1zuajsauZjaG+E7+ELgy6i1zuajsauZjaG+E7+ELgy6i1zuajsauE:/tItItItItItItItd
TLSH
T1DDA67D1E73EC00E9E5778174C6A68166D671B8322721DADF6390C63D2F37AE0A939F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1992	svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
1256	svchost_AACCAABBACCBBAABBCABACABCCCCBBCBBBCCBAAAACBAABBABCACCAB.exe
3968	svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAAABAAACAABBABCABAABACCACACBBCABCBABBCACBAABBBABCBACCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe"	2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABBCBAAABABACBBCBCCCCACACAACBBAAACACBBACCBBCBACBCABBCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACCAABBACCBBAABBCABACABCCCCBBCBBBCCBAAAACBAABBABCACCAB.exe"	svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4440	sc.exe
1460	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1548	cmd.exe
1576	cmd.exe
5272	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACCAABBACCBBAABBCABACABCCCCBBCBBBCCBAAAACBAABBABCACCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5412	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1860	2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe
1860	2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe
1860	2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe
1860	2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe
1992	svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
1992	svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
1992	svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
1992	svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
1256	svchost_AACCAABBACCBBAABBCABACABCCCCBBCBBBCCBAAAACBAABBABCACCAB.exe
1256	svchost_AACCAABBACCBBAABBCABACABCCCCBBCBBBCCBAAAACBAABBABCACCAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1860	2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1992	svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
Token: SeDebugPrivilege	1256	svchost_AACCAABBACCBBAABBCABACABCCCCBBCBBBCCBAAAACBAABBABCACCAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1860 wrote to memory of 1548	1860	2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe	92
PID 1548 wrote to memory of 5412	1548	cmd.exe	94
PID 1992 wrote to memory of 5528	1992	svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe	95
PID 1860 wrote to memory of 1576	1860	2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe	98
PID 1576 wrote to memory of 4440	1576	cmd.exe	100
PID 1860 wrote to memory of 5272	1860	2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe	101
PID 5272 wrote to memory of 1460	5272	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_58d47b230ccdb7fe389c5b20f195611e_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1860
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBACBBCBABCCCABACCCBCABCCACBACCCCCCCBACABBBCBCCABAAAAACCCBCBCCCABBCBAABBBABCBBBBBBABCCBCAACBCBBCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1548
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCBACBBCBABCCCABACCCBCABCCACBACCCCCCCBACABBBCBCCABAAAAACCCBCBCCCABBCBAABBBABCBBBBBBABCCBCAACBCBBCCCBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5412
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBCCCCAABBBCABBAAAAABCBCAACABCCCBACCBBCCCABBCACCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe" start= auto displayName= "UserDataSvc_CBCCCCAABBBCABBAAAAABCBCAACABCCCBACCBBCCCABBCACCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBCCCCAABBBCABBAAAAABCBCAACABCCCBACCBBCCCABBCACCCBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe" start= auto displayName= "UserDataSvc_CBCCCCAABBBCABBAAAAABCBCAACABCCCBACCBBCCCABBCACCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBCCCCAABBBCABBAAAAABCBCAACABCCCBACCBBCCCABBCACCCBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5272
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBCCCCAABBBCABBAAAAABCBCAACABCCCBACCBBCCCABBCACCCBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1460

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5528

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBACCBBAABBCABACABCCCCBBCBBBCCBAAAACBAABBABCACCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACCAABBACCBBAABBCABACABCCCCBBCBBBCCBAAAACBAABBABCACCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1256

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
1⤵
- Executes dropped EXE
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 93c78579d5a8e074944c1d04a45449fc22b328ab4cc33d5cb2fd5536fe34c626
MD5 ce0dd4bb32b5d05954a4cb680f31e342
SHA1 a31d41504a56a6383091aabda02520d1c7d4aa8a
SHA512 a65592082a5bca46d7507674d374296f5e00171f4eebfd5cde4ee8a7ba2a360ea3030289b14013fd827deff1501220e453b22cd13ab7c894768c07e9ec9c465a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5a1f4aa542ad3d51336c57c60f085ec44e069c5ee8dfdf2bbd26fb9c28702a7f
MD5 afd21bb92da32f2ffee110d6d419c0fe
SHA1 1ee483b71ac2683ee05a7351dcf8bfa989c90a57
SHA512 25b562aa28dc7b1d1263ba63f2d6fadc18e99b4ae547647a07206ae01d04d69cb93866079265719b36945a6a9924de18ab449676d73f0fab773bd333986e9b20
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a5d619ad584b8b846051fd49b3c22efff25015f79d46f9ff1e0e2360b4f8e293
MD5 8e0b45db28b38637fd2b18ea397719bd
SHA1 f31dcd6f20fc6b8467f64d12bec00c0ad44bbe19
SHA512 831350ab8e429b3391c0c700217803d16eebd543754408046f6f11a313e222146a4da2fbf27f7d80b46a9232765f3c49c537440190309e361db8ca09dca47770
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 81c4a35028ec8d20897605cb89bbe9fe37b7bcb3bf23d5096257ff307a56eed2
MD5 c29833a8f284632a2834001353ec2218
SHA1 eb8b8e6f2ef931442b18d2fb4d4f02adb62d8a11
SHA512 16585da0191bfa11d2084bfc8e6ff7b5270fec3ee52f6474a9f2564d8377944a1cd3b42808ff0a21439f824d06e9c43d4afe213cb39f2adaf69b425d15d22bae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c01d2e9671d283e05f077635dc36715db37afcbbdf3ef626492e3c8258a99d23
MD5 e9babc56d8c37e4340517695628c5779
SHA1 8df320b5db23626ec64e4fcbb51cc262578dd597
SHA512 709322b781d6d497d21f403c0a09eab98ffeaef15a2a6896d20217e2faa1255475a60e6a5a5adcf6324b7e69362dcd58f435230793296e538fbc95cd9d21df61
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dd1c33c0372c000495f5f2199967660a3502c3f804c555db11220ab7e94d34f3
MD5 2b82b488f7a97a0074070d441b5b32e4
SHA1 3293ce67e2c8b91ebe3f457dcc7c2fbcbf3b36bb
SHA512 c09c985497b78f6cf860068770476fe1b88a7e3627f3bb3bfc42743a32d19a5368f3324a3b64ff807599276dafa636eff45e37b446cf8831b6d89f5d0b24231c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 169d5046ac470ff750eaf57a3e7dc62ba726754e6be460f08040c194cdb1988b
MD5 466a7d5ddf7e57beac3e7fa7bd4bc70e
SHA1 35d7b63e88254ac62a3e31562555e2dd958db35d
SHA512 ffa566f315ec1ba385933b141e45dabe6b58137c1c5488c66c14bff8776039371cc15facd8ba0165b6510af5bd1d7cd2a23fd12f2c24fcba6d47835ff3bdeb69
MD5 SHA1 SHA512

Submit Download

svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCAABAAACBCCCBACCBBABCCBCAAACACABCCBAACBBCCABAABACBB.exe
Size 9.2MB
SHA256 fcce0fbb97e314cd921eedfe37c96393fdc5b0662d32dbd88571e1e8e5c2adf1
MD5 58d47b230ccdb7fe389c5b20f195611e
SHA1 4a4764658a046077f911f827b50dba84054bbf38
SHA512 c4fe3a6593e92afc7f800452044a2d42e9ab393d7e6ae91a7b59d7e1ee6fa0d9a6e4c36676f337d91f5b72c7f8813d266d25286c97376443afe234e62e969ab4
SSDEEP 49152:U+E7+ELgy6i1zuajsauZjaG+E7+ELgy6i1zuajsauZjaG+E7+ELgy6i1zuajsauE:/tItItItItItItItd
TLSH
T1DDA67D1E73EC00E9E5778174C6A68166D671B8322721DADF6390C63D2F37AE0A939F11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 b968586425c0b86114a6a8b2725cacf3caf35617a0e94508f0094b38a45e3205
MD5 cef5340c474e6df3cb1277e7f7af6390
SHA1 8bbd2dc6980773877fe151e4b52996e08a2f820d
SHA512 5d71b23e45e6d50235227b51dd8ef375fbc8e7b6785baea791f0b297c7ac61566fb4138ff0a7349c03d4c5ed36efc9117d1c3eec1db1491704274a8eb2956577
TLSH
T1AA11C461F065D813E132E8CE533D9B9B4CA43F9B5828AB18524E5218A7A1C768F154F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1256-64-0x0000000000A40000-0x0000000000A61000-memory.dmp

Download

memory/1860-0-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/1860-8-0x0000000000660000-0x0000000000681000-memory.dmp

Download

memory/1992-34-0x00000000006D0000-0x00000000006F1000-memory.dmp

Download