7c9f7430ee3cb4fd729a87de785f1e53e0e908e811423ec4e9aea1a9010403d5

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
Size 13.3MB
Sample260910-cw2mrsef87
SHA256 7c9f7430ee3cb4fd729a87de785f1e53e0e908e811423ec4e9aea1a9010403d5
MD5 d6b547cb01b2afe4b111807585b6fd94
SHA1 6064d259bcb3654e27e1b431b66fdbc4ff18a81e
SHA512 560b41354016b20ca6ee542cf9fd9451fca9edac33c322ffd9772a974ed8936f422efb2837b815448630306998c0df84ecc20f95fab56c55ca17d0b01e2ab5aa
SSDEEP 49152:U+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EO:s
TLSH
T1C7E66C09F98750F1D92B50B00DDBD2BF8671BA2186218EFBF78DC61B6D23B906938715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1744	svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe
4776	svchost_CBBCCCCABACAACCCCBAACBBAAABACCAACBCCBAACACCCBCBABCCCBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AACBCCBBCCAAACBAABBABACBACCBCACAACCCACAACACABBCBAAAACBBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe"	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAABAACBCCABAACCBCBAAACBBBABBABABAAAAAABABCBBABCABBABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBCCCCABACAACCCCBAACBBAAABACCAACBCCBAACACCCBCBABCCCBBC.exe"	svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3840	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBCCCCABACAACCCCBAACBBAAABACCAACBCCBAACACCCBCBABCCCBBC.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5656	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5504	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
5504	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
5504	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
5504	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
1744	svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe
1744	svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe
1744	svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe
1744	svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5504	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	1744	svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5504 wrote to memory of 3840	5504	2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe	91
PID 3840 wrote to memory of 5656	3840	cmd.exe	93
PID 1744 wrote to memory of 5476	1744	svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe	94

C:\Users\Admin\AppData\Local\Temp\2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_d6b547cb01b2afe4b111807585b6fd94_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABACACCBBACCBBABCABACABBBACAABCBAABCAAAABBCCACCAAACAAAACBBAABBCACACCBCBCBABBBBCABBCBCACBAACBAACCBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3840
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABACACCBBACCBBABCABACABBBACAABCBAABCAAAABBCCACCAAACAAAACBBAABBCACACCBCBCBABBBBCABBCBCACBAACBAACCBAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5476

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCABACAACCCCBAACBBAAABACCAACBCCBAACACCCBCBABCCCBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBCCCCABACAACCCCBAACBBAAABACCAACBCCBAACACCCBCBABCCCBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b47c8490bf13dc6cc0973d28162e666f0dc3c3f7a5bad4d2d38fcac9fa57c3a0
MD5 505e7523d0a3e08bc4901f5c8251be70
SHA1 647e07c996cd2b367e5b3040951e194596310078
SHA512 305773106111afc4ffcd6b969ed477f5a4db07583105956f9a8a7d4a3790b65cd0a32ddddf6e7786c2af33a09cc3f4231cf1eb2d82c866595842a53e915af101
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c767cdfd23fde9cc354f6ad22207f2278101b946641b11aba7d2923b54664b8a
MD5 f94e55a8d3457abd53ece2350781f8f5
SHA1 fdd84825a6220affeed01e82b836e4b08a83c51b
SHA512 e3b1ca73827827ee28dee9f08772a6c2bf429691fed238c10bfb1bce4b047569b17203cc261fb232b045000c9257eac8fffe5b09ea90fcaa471ed649f7b959f2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 de50cfa364fcbccd41508aa8ddfcbfa87963b666f288e206bba6f0383d76ffbd
MD5 f65cca32803ddb3d15e46e4ad3c4dc77
SHA1 db71ff7319dc080940b25075db1e0b9c688c5ad3
SHA512 754fd4b409c21cbb77ec865bc6ee5ad21a79f23c588d2a90f4e7ed6ee81e9c12b8d514722098693851fe37187b0d86bd7b2871e7beccd39a596433efef7fdb87
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 81f126d07b7c730587f6a519d957b7b367122d3fbcde029f7d64ebf8695a3772
MD5 19d243c18bf3eb9514688c80ed2c6041
SHA1 035a7654ac45559861d53a029c745353f56b2ab6
SHA512 af07cd024a208071598df88dc3f36bb9c6c4b41f5af7946233f6692008a3658a38a3e856d15110e1c711ac5db8ef55cfd0631354e437e022e89bfcfc410ba8ac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9727df785b04a2565eb4b199a8d6f2cb4525f6b8b28b9a8cea02d5771733ab68
MD5 efdcd06ee0b1748271c91f61a4da60d2
SHA1 a52aca9fb81b6b9cc426bc96fbb5aa236c9f73dd
SHA512 f2924db2fbee8bc761d191292663fe2adcd93454c6391fca8a44d32d3058d86594d481504eced7b66de93da4ab9f09a5e503beda6ea9b1eee0622e3c27036a71
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1af6dccc96ca0f2fc22cd715b0721bcc82b85aa8e63dbebc2db04a21dab994c6
MD5 4f7c23be0aff0dce8508368a08172575
SHA1 abbbc0ffd6ddd7292ef15cd1c3bed6d46a0fc3d9
SHA512 2787a4b9e70297ea9c02e7a1af3939e7e9fb5da47ef62dff4f931f137f6e4741e947c3e5ec97e6f44fc16bc9b5b6f9a15acfa13653a9a12036bd73e6dfd31691
MD5 SHA1 SHA512

Submit Download

svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBACBCBACCABBBBCBBAACACABBCBCAACBBABAACABBBACACAACCAA.exe
Size 13.3MB
SHA256 7c9f7430ee3cb4fd729a87de785f1e53e0e908e811423ec4e9aea1a9010403d5
MD5 d6b547cb01b2afe4b111807585b6fd94
SHA1 6064d259bcb3654e27e1b431b66fdbc4ff18a81e
SHA512 560b41354016b20ca6ee542cf9fd9451fca9edac33c322ffd9772a974ed8936f422efb2837b815448630306998c0df84ecc20f95fab56c55ca17d0b01e2ab5aa
SSDEEP 49152:U+E2+ES+ES+Eqk+ES+Ee+EH+E2+ES+ES+EqK+ES+ES+E2+ES+ES+Eqk+ES+Ee+EO:s
TLSH
T1C7E66C09F98750F1D92B50B00DDBD2BF8671BA2186218EFBF78DC61B6D23B906938715
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1744-35-0x00000000004B0000-0x00000000004D1000-memory.dmp

Download

memory/5504-0-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download

memory/5504-8-0x0000000000D60000-0x0000000000D81000-memory.dmp

Download