c92c7bda52b1f2bb10847545fca716ecb9283126ae6fc0c874cba8a66068d1f9

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe
Size 13.8MB
Sample260910-jdmjfszelb
SHA256 c92c7bda52b1f2bb10847545fca716ecb9283126ae6fc0c874cba8a66068d1f9
MD5 0f0b5099358b99a4e120b1f16d7cc731
SHA1 8cc473525607a4bcfddfe2ebc4a99a848ee74637
SHA512 07175bc3365d9fc8832b8670cf41940a807cf2d1c8a54331f999fa1e70c494ca091816fab8829d28b6cd890ed99f4b0309cbbc18cb61d596d6bb44360ab5451c
SSDEEP 49152:U+ES+ESuaF+ESq+ES+ES+ESuaF+ESq+ES+ES+ESua/q+ES+ESuaF+ESq+ES+ES+u:h
TLSH
T13FE64A05FA8740B1E87B51B04DDBD2BF8A30BE2587128DFBF64D870B6933B919834656
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4456	svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
924	svchost_ABACAAABCBACABABBCABAACACCBBAACCABCCBAAAAABACACBCCCCBAC.exe
5056	svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABACBCACCACCCBABCACABAACBCBCABACCBAAABBCACCBBBBBBAACABBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACAAABCBACABABBCABAACACCBBAACCABCCBAAAAABACACBCCCCBAC.exe"	svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BCCBBCCABBBBCAABCABBCCCABABBBABCCBAAABAABAAAACACBCCBBBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe"	2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4660	sc.exe
432	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3364	cmd.exe
3708	cmd.exe
3276	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACAAABCBACABABBCABAACACCBBAACCABCCBAAAAABACACBCCCCBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3224	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3864	2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe
3864	2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe
3864	2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe
3864	2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe
4456	svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
4456	svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
4456	svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
4456	svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
924	svchost_ABACAAABCBACABABBCABAACACCBBAACCABCCBAAAAABACACBCCCCBAC.exe
924	svchost_ABACAAABCBACABABBCABAACACCBBAACCABCCBAAAAABACACBCCCCBAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3864	2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	4456	svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
Token: SeDebugPrivilege	924	svchost_ABACAAABCBACABABBCABAACACCBBAACCABCCBAAAAABACACBCCCCBAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4092	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 3364	3864	2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe	99
PID 3364 wrote to memory of 3224	3364	cmd.exe	101
PID 4456 wrote to memory of 928	4456	svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe	104
PID 928 wrote to memory of 4884	928	notepad.exe	105
PID 3864 wrote to memory of 3708	3864	2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe	109
PID 3708 wrote to memory of 4660	3708	cmd.exe	111
PID 3864 wrote to memory of 3276	3864	2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe	112
PID 3276 wrote to memory of 432	3276	cmd.exe	114

C:\Users\Admin\AppData\Local\Temp\2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_0f0b5099358b99a4e120b1f16d7cc731_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBACBABBCCBCBAACBCBBBCABAAABAABBCCBACBACCCABAABABCCBCBACBBBAABABACBCABBACABCCAAACBAACCBBCBCBBBCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBBBBACBABBCCBCBAACBCBBBCABAAABAABBCCBACBACCCABAABABCCBCBACBBBAABABACBCABBACABCCAAACBAACCBBCBCBBBCAAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABACACBACBBCAABABBBBBBAACBBBBCBBCCBCCBBBACCCCACCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe" start= auto displayName= "UserDataSvc_ABACACBACBBCAABABBBBBBAACBBBBCBBCCBCCBBBACCCCACCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABACACBACBBCAABABBBBBBAACBBBBCBBCCBCCBBBACCCCACCCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe" start= auto displayName= "UserDataSvc_ABACACBACBBCAABABBBBBBAACBBBBCBBCCBCCBBBACCCCACCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4660
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABACACBACBBCAABABBBBBBAACBBBBCBBCCBCCBBBACCCCACCCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABACACBACBBCAABABBBBBBAACBBBBCBBCCBCCBBBACCCCACCCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:928
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4884

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACAAABCBACABABBCABAACACCBBAACCABCCBAAAAABACACBCCCCBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACAAABCBACABABBCABAACACCBBAACCABCCBAAAAABACACBCCCCBAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
1⤵
- Executes dropped EXE
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 59cb5205d3f000105c9033b1cf198de8831814a3efd1c34c98967047e7c6ab8a
MD5 e30a08b713afbea0ca36f2e1934de154
SHA1 ff6bdcf0950ecc456eb65978f45a1bb53803d608
SHA512 55975ee5099bc9a17519e8b893f1db3d95cc952f305640c6d05f44eb4db3ab49969637311544a5f89dc2d8da696c97fcad69587a10f9d5810b5d899f8b6ffcfe
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8ffac8c2e1717e0025ac4ca7c75f6a0de82e7e831ddf32af2af577cb9e60fe0a
MD5 58bebe286cc2b8e6038c83c9868e14e7
SHA1 59800d6990d4451567e0a07b079f5d6fffd15d87
SHA512 4a509d7e71b264cb1b45a5dc82699e9078b931d4e2f38602ed965a9cbbc129198189035b37a4cbd7548a862b4fbbb7fe510dc5c535eb9195a76b5d68a4edeb5d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1bb6d20d1260df02418f76d06c6996691e34af0ee2deb583717fb634f48440d7
MD5 a965164034620c69f64d3dc447e1faf0
SHA1 f9d520c3c29f8e5ada04826bf1eb492b7645c430
SHA512 814a1ccf4b3cdb4f903e0a05059cc6681a89b275f9c2f34b6a84d215e16b99b216fba3641dc429f8eb46aedbc1e3e971bd1ec6d2652f9bb1df136bc7fff955f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38bcc9f79fa9ecdeef9fb2766ad87ddf63dd09022a083796f7c53346d4a821f6
MD5 b5036fa7d1bd56d8b29975d6223bb209
SHA1 533ba13a1e87435e11a5c50170d2663120fc8ec1
SHA512 c0b418dd96abff30aeeed4762bcd3d3b216d31bf54e05cb77f6f1bbedb7fe5b80fc8077e051687971947e37728b528abd9f94c6d0606a0ae069719e3c3d67209
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 df997076fa351d632ec40ff690511f65f4f8b721acd817a088b8c0519d3a0e61
MD5 765bad296344591f9212514a59a51aa5
SHA1 1f5f99ef2d055e56d142bab9e19e709a89dbf436
SHA512 f73b623d1309e85cfe29f75a49ab4f18a295d6b00bfefef4e89394bb1a5cb263f5badce8946832c8a6d92ce5065b603ffd5297777f27f1ad2df0f0de8a38d49b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 1d029ba4597faee2f1a2e9d4b83a7ea0b146ea11233db2dcdf258d5610cf4cb7
MD5 c68e751265bdb27f1d6285e365b839ae
SHA1 009b7e7b8bda0acf74ce2fc27b878a0c7ad0285c
SHA512 b3cf3caec1e02be989a912413e982c06e30a43fc6f74cb5aa3450e61ec1323963c49685d0222bad64d11d44708528653f5285322bdd02113f1937cb5c26d709c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 810b77f8c0f43c100e340cd72f135769800057a665db089f61d1c7de6677d355
MD5 35668b69de61b4ff30dca332a1c0ec9f
SHA1 6a852585ab35eb45cb37924c27291bf1e017b4d2
SHA512 3b09de94d9a00e901abeb3e30d8b554efb909d35f3e06be7393a4c9735992a3d2553bee0e1399c1964b63bd2c0a4c5f3f7a78392d49584d8a21a281e488a4b30
MD5 SHA1 SHA512

Submit Download

svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABACABCAAABBBBAAAACBAACCACBACAABBACCABBAAACCAACCCCBA.exe
Size 13.8MB
SHA256 c92c7bda52b1f2bb10847545fca716ecb9283126ae6fc0c874cba8a66068d1f9
MD5 0f0b5099358b99a4e120b1f16d7cc731
SHA1 8cc473525607a4bcfddfe2ebc4a99a848ee74637
SHA512 07175bc3365d9fc8832b8670cf41940a807cf2d1c8a54331f999fa1e70c494ca091816fab8829d28b6cd890ed99f4b0309cbbc18cb61d596d6bb44360ab5451c
SSDEEP 49152:U+ES+ESuaF+ESq+ES+ES+ESuaF+ESq+ES+ES+ESua/q+ES+ESuaF+ESq+ES+ES+u:h
TLSH
T13FE64A05FA8740B1E87B51B04DDBD2BF8A30BE2587128DFBF64D870B6933B919834656
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 b4c3e62f868c46c32088c4a75be9b6e6a203b1ddcce3ea7e99c3c76f4bf68c04
MD5 3c36ba780f75726148e6cc203cdd6eec
SHA1 2259908ddfccca73deb40d13a732674f74dea5bc
SHA512 64b7558c6da0be031036b095741ff15f46dfe5ea064b8ebabc7135553d76a3b2e1c5f9364d6c2ed7e7004e50542972d9c41230da777ab36504d4c668f5910a9f
TLSH
T1B011E361F0A5E467B12238DBD526AF4B1CE4379FB958EB04230C8218BF95C75DE258E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/924-109-0x0000000000010000-0x0000000000031000-memory.dmp

Download

memory/928-78-0x0000000004F50000-0x0000000004F51000-memory.dmp

Download

memory/3864-0-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/3864-75-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/3864-51-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/3864-25-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/3864-12-0x0000000000FC0000-0x0000000000FE1000-memory.dmp

Download

memory/4456-76-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/4456-52-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download

memory/4456-37-0x0000000000FA0000-0x0000000000FC1000-memory.dmp

Download