d1eb913e19ccee340004e9da760a85c5bb5ca3976bc171a497b277e636e21fce

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe
Size 7.5MB
Sample260910-a73m4avxfs
SHA256 d1eb913e19ccee340004e9da760a85c5bb5ca3976bc171a497b277e636e21fce
MD5 059a64cfc63ec18d4926f59b42f68357
SHA1 a801ac672da1f7372a5d9f7e3dfd176166aaf03c
SHA512 47d1e4b9307773b8a1dab7c71574a4a28b49a241997dd5a3456983ea65b43853af223a0f5b8c64bb46aef895e4a2df4195cfed175fde63dcb209562f9750ecc4
SSDEEP 49152:U+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2eZ:tp7V
TLSH
T1ED862A09B6DE44A4E5B7617449E7C67ACAB2B8518732C6DF9244C73E1E33BE0AC34712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2596	svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe
4344	svchost_ACACCABCBCCAACBAABBCACBCAABABABCBCAACBBBAABBCCBAAAABBBA.exe
4168	svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABABACBBBBCBCCBBCBCCBAACCBBCACCCABBBCACAACABAACCCAAAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe"	2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBACCCBBBCACBBBCCBAAACBACCABACCBACBACCBCABCACBCBBCABACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACACCABCBCCAACBAABBCACBCAABABABCBCAACBBBAABBCCBAAAABBBA.exe"	svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4864	sc.exe
5656	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1868	cmd.exe
2164	cmd.exe
2112	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACACCABCBCCAACBAABBCACBCAABABABCBCAACBBBAABBCCBAAAABBBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3720	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2908	2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe
2908	2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe
2908	2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe
2908	2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe
2596	svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe
2596	svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe
2596	svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe
2596	svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2908	2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe
Token: SeDebugPrivilege	2596	svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 1868	2908	2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe	91
PID 1868 wrote to memory of 3720	1868	cmd.exe	93
PID 2596 wrote to memory of 2984	2596	svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe	94
PID 2908 wrote to memory of 2164	2908	2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe	97
PID 2164 wrote to memory of 4864	2164	cmd.exe	99
PID 2908 wrote to memory of 2112	2908	2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe	100
PID 2112 wrote to memory of 5656	2112	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-09_059a64cfc63ec18d4926f59b42f68357_elex_stop_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCAACBCCCBABACBCACAABCCBBBCBACCABCCCCCCBCAACBCCABCAABBCABBBBABBCACBBCBCACBAABBBBCBBCBABBBBCCACACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCBCAACBCCCBABACBCACAABCCBBBCBACCABCCCCCCBCAACBCCABCAABBCABBBBABBCACBBCBCACBAABBBBCBBCBABBBBCCACACBAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CABCAABBABCCCBBACCCAAABCBAAAACBABAAACCCABBCACABBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe" start= auto displayName= "UserDataSvc_CABCAABBABCCCBBACCCAAABCBAAAACBABAAACCCABBCACABBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CABCAABBABCCCBBACCCAAABCBAAAACBABAAACCCABBCACABBBAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe" start= auto displayName= "UserDataSvc_CABCAABBABCCCBBACCCAAABCBAAAACBABAAACCCABBCACABBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CABCAABBABCCCBBACCCAAABCBAAAACBABAAACCCABBCACABBBAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2112
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CABCAABBABCCCBBACCCAAABCBAAAACBABAAACCCABBCACABBBAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2984

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABCBCCAACBAABBCACBCAABABABCBCAACBBBAABBCCBAAAABBBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACACCABCBCCAACBAABBCACBCAABABABCBCAACBBBAABBCCBAAAABBBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4344

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe
1⤵
- Executes dropped EXE
PID:4168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 fb12014f96a74e787f887b2f63b2a0d01605ed3ee10a1e6c769931fd0f3d94c4
MD5 1ad27ac980bb985e9c1c42a0eb1c9f07
SHA1 a25ae0950dbfca4c4a77d3309cbe5ce245bf89c9
SHA512 96d58959cee091a0d36848ae793484ad18af4a9db37739e56d5ee192f99889f9a2f6034dad81fb70f686c8b76adea9553a2211030e669dc968100b496f1c50b6
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d54150cbe651fdee9914edc5995e90d68a67592b8a4b8f097daf611db74cc8d
MD5 06db79fe95aa569e1b2eff94c5bab28a
SHA1 fbdb015c8b056d9a9a04e17283328fd643185c87
SHA512 f4f90716132238cc37985e9c774ae38aa152302519d8067ae6a59a1ea56abfdfc0e415458f0b5455e4b2506d824df6d3eb49084f0ebd3fc00f6dac7fc70233a4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 993f4b36d56ad2d1b1eb7f32fb277eba7eed2b53142c36bd5c0a959698fded75
MD5 bba0a62be30e5ce4491d454fa70aa8e3
SHA1 ad5393ca0f9ab4cef21ad00b76316a4954762c9d
SHA512 0c5124a7a4ccf09f18f9606f9d03ecbada2e360e2f60b688a3f4f97e6aa18b2b6d766a81dfbd035fbb4150d8c656c39fc0c49240235e0f0c77ea7d371ed8fa35
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 319fe89bb7832247d02710ef56c32fb33242d02a54d73ede4e5523cdc12cb0cc
MD5 f5414bd64c71c14b532afff905675e92
SHA1 6216d7f61c553b7a22cc5415b8f5639e7aa5a97a
SHA512 bbcd13f006c8bbb3ef5b8dfc9d067a08d4066f283603aaa44dab2cc06ea73df7e8986fc95e539e300a8d60c52a3b55f258d123eec7f857b2ad82d7e17a153f69
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c6faa376ee92c1a67d20a63ecc81d3c13081357a39e58d5f2e61433b1c9c2fa2
MD5 43b1e352a44fdad9004313061a3072a0
SHA1 c284b9373e82bf5fd2f78d6c7a7d88d88555da4f
SHA512 40b0cf83e0fbe7e11a3e764e7cb5ca35361a5ccf7b3dee950994aae55264b79826f60d0a35ff7949d54f1e1f053170e30b89e6209311ec145681f62da179724e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f6f6283700640dfdad1b336f68ead492035dc719739bc19b8b2f53a8ff431d77
MD5 80a9fcb5dbbe38f810e1451e601fa0b0
SHA1 31f9478915ddacd3b7bd11ebef6c42547812316c
SHA512 1bd40602b4547e5903546c2da16f902d434542ebba3adc941cc8df1ac3d13e27c3f96415358dde46bbc0296783c9a616a6ce02c4bc6bb3ab4463c15ffdfe2c68
MD5 SHA1 SHA512

Submit Download

svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAABACBACBBABCCCCBBACACBCCBCBACBACAAACAACBACAAAACACABCB.exe
Size 7.5MB
SHA256 d1eb913e19ccee340004e9da760a85c5bb5ca3976bc171a497b277e636e21fce
MD5 059a64cfc63ec18d4926f59b42f68357
SHA1 a801ac672da1f7372a5d9f7e3dfd176166aaf03c
SHA512 47d1e4b9307773b8a1dab7c71574a4a28b49a241997dd5a3456983ea65b43853af223a0f5b8c64bb46aef895e4a2df4195cfed175fde63dcb209562f9750ecc4
SSDEEP 49152:U+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2e+EG+EG+Ebiw2eZ:tp7V
TLSH
T1ED862A09B6DE44A4E5B7617449E7C67ACAB2B8518732C6DF9244C73E1E33BE0AC34712
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2596-34-0x00000000000C0000-0x00000000000E1000-memory.dmp

Download

memory/2908-0-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/2908-8-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/4344-65-0x0000000000BF0000-0x0000000000C11000-memory.dmp

Download