7c9f7430ee3cb4fd729a87de785f1e53e0e908e811423ec4e9aea1a9010403d5

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
Size 13.3MB
Sample260910-cw2mrsef87
SHA256 7c9f7430ee3cb4fd729a87de785f1e53e0e908e811423ec4e9aea1a9010403d5
MD5 d6b547cb01b2afe4b111807585b6fd94
SHA1 6064d259bcb3654e27e1b431b66fdbc4ff18a81e
SHA512 560b41354016b20ca6ee542cf9fd9451fca9edac33c322ffd9772a974ed8936f422efb2837b815448630306998c0df84ecc20f95fab56c55ca17d0b01e2ab5aa
SSDEEP 49152:U+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EO:s
TLSH
T1C7E66C09F98750F1D92B50B00DDBD2BF8671BA2186218EFBF78DC61B6D23B906938715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5000	svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
436	svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
924	svchost_CABCACBCABBCAACCCCCBBBACACBBABBACABBCAAABACBACABABAAAAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_CACCCBBCAAABCACCCBBCCCAABBBCABACCBBACCBCABCCBBABCBACCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe"	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Update_ABAACAACBAACABABACBBAABACCACCABBBAACBCCBBAABABBCBAAABCCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCACBCABBCAACCCCCBBBACACBBABBACABBCAAABACBACABABAAAAC.exe"	svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1488	sc.exe
2308	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3756	cmd.exe
5076	cmd.exe
1148	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCACBCABBCAACCCCCBBBACACBBABBACABBCAAABACBACABABAAAAC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3712	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3604	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
3604	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
3604	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
3604	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
5000	svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
5000	svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
5000	svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
5000	svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3604	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5000	svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
868	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 3756	3604	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe	95
PID 3756 wrote to memory of 3712	3756	cmd.exe	97
PID 5000 wrote to memory of 2840	5000	svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe	98
PID 2840 wrote to memory of 1216	2840	notepad.exe	99
PID 3604 wrote to memory of 5076	3604	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe	101
PID 5076 wrote to memory of 1488	5076	cmd.exe	103
PID 3604 wrote to memory of 1148	3604	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe	104
PID 1148 wrote to memory of 2308	1148	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCBCABBCBBCCCCAACBCBBBBCCBAABABACAABCCABACCABBBCCABACBBAACCCACBCCABCCCACABACCACCCABBCABCBACBBBCCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBCBCABBCBBCCCCAACBCBBBBCCBAABABACAABCCABACCABBBCCABACBBAACCCACBCCABCCCACABACCACCCABBCABCBACBBBCCAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACABBACACACCBCBBBCBBCBBCCCCBBACAACABBCCACBABABCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe" start= auto displayName= "UserDataSvc_BACABBACACACCBCBBBCBBCBBCCCCBBACAACABBCCACBABABCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACABBACACACCBCBBBCBBCBBCCCCBBACAACABBCCACBABABCABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe" start= auto displayName= "UserDataSvc_BACABBACACACCBCBBBCBBCBBCCCCBBACAACABBCCACBABABCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1488
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACABBACACACCBCBBBCBBCBBCCCCBBACAACABBCCACBABABCABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACABBACACACCBCBBBCBBCBBCCCCBBACAACABBCCACBABABCABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1216

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:868

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
1⤵
- Executes dropped EXE
PID:436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACBCABBCAACCCCCBBBACACBBABBACABBCAAABACBACABABAAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCACBCABBCAACCCCCBBBACACBBABBACABBCAAABACBACABABAAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:924

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ba68d93dea6574478d022410695fd65b7a1472d336649c6743b58d74db139ce
MD5 6b3f457aed9218673676ef47cdc1953d
SHA1 b5fb3882ba0301e434ec18661e9d1983eccf7be6
SHA512 489e6c1d23c94a9288170bedb60cb1b2b17bd765dde1542598486477aad824cec27257a8a1688f425a523fb0473035fbb63ed6bc28f0abd12353b03449002c84
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e8eaae2fa3a7e848da558665322e20c1a47b82fb6e6d087489cfcb3448f00dfb
MD5 aa33434c53f5fa5c6874e4c36183b637
SHA1 70dfc96ee3d205680c7b4eb7194f9869ed90ef0e
SHA512 af383efac8c6c7c02deb1c812c619f335c3656db211289cb85ed76298a75ec929b64bb7f46b7e5d54f0a67f47e297553f664e0ece4e0a5b3df7a67eb12105a3f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c5beacf71c340e2d780392df144c8e4ba2d3c373163819cb7201c41bd50ed853
MD5 25444c279972647ba0314d8c0a671cdb
SHA1 56e355aa6559292c6f8f85c07843ba02226939cb
SHA512 97a893cbd41c150900b71222f4c9eefed03b14796f586f69f0deb35d731b53163afbf44fcab21c3a09d35794d2aeaaeb4731884aab037ba3dfda2808d3450f70
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8521eec7db885c9de58dc22b46d0aa2ef89d913fbcc3e83115f09a8bd2613d3d
MD5 7c22b4cb25be6e8eaed7c9529aace3c5
SHA1 cf294f4f78ad4c0d8fa4256f1719975eeb212dd5
SHA512 d08e96bff9e01e5848e0085b791bde315828e3abe852f28b48ab67f6445edf70358437cb29458127ed42c73b80c5cc8d3f34b6ee6b1c0e2d6c99af0c139295bb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 44f874f5af4a689097492dcf9c6db742eac75f9b97696cb6c71d73259c531e16
MD5 c6f2ff9de4ee643b4357de7e47d735a3
SHA1 a22ec0c7b26b9ff48da458383e64c7a4f0713ae1
SHA512 68047b4e59d29db2645ce3c5453725b76d2b99d2f3fdbfb3805475217a845f294fd3fa9766485bf548ffea48f32288deb562891c0155dd2ae37d8ba0a24cd694
MD5 SHA1 SHA512

Submit Download

svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCCAACBCCBACACCAAACACAABCBACBAAABABACBABCAABAACABABCAC.exe
Size 13.3MB
SHA256 7c9f7430ee3cb4fd729a87de785f1e53e0e908e811423ec4e9aea1a9010403d5
MD5 d6b547cb01b2afe4b111807585b6fd94
SHA1 6064d259bcb3654e27e1b431b66fdbc4ff18a81e
SHA512 560b41354016b20ca6ee542cf9fd9451fca9edac33c322ffd9772a974ed8936f422efb2837b815448630306998c0df84ecc20f95fab56c55ca17d0b01e2ab5aa
SSDEEP 49152:U+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EO:s
TLSH
T1C7E66C09F98750F1D92B50B00DDBD2BF8671BA2186218EFBF78DC61B6D23B906938715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/436-75-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/924-80-0x0000000000FD0000-0x0000000000FF1000-memory.dmp

Download

memory/2840-60-0x0000000005350000-0x0000000005351000-memory.dmp

Download

memory/3604-0-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/3604-7-0x00000000008B0000-0x00000000008D1000-memory.dmp

Download

memory/5000-39-0x0000000000910000-0x0000000000931000-memory.dmp

Download

memory/5000-26-0x0000000000910000-0x0000000000931000-memory.dmp

Download