479cd522785347d44c5b089884e777862777c290f08ceca3552e838e4ee1829c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe
Size 11.5MB
Sample260910-pdvsqasgja
SHA256 479cd522785347d44c5b089884e777862777c290f08ceca3552e838e4ee1829c
MD5 ac91c9bd32da85a3b3b41a66b298533f
SHA1 32f535963d4b9b6e92d71d200af334a16aabf821
SHA512 571e155387a7c7113058500afea0b748767a10a76204a4b6966604e0884103ac8aed17ff448d57ecfc91fcb4050cc1bfa2c363677468e426cb4f4fc1f249e601
SSDEEP 49152:U+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+EF:G7pL
TLSH
T1A4C64B09FA9610F1D977417049DBD27A8630BE3187218EFFE689D63E9D33B906838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1360	svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
2352	svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
1380	svchost_CABCAABBCBBBCBBBAAACCCACBABBCBBCCBBABCBCCBCBBBBBBAAACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ABABBBBAAACBABAACCCCCBBBCCCACACCBBABABCBBAAABCAABABCCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe"	2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BACBCCCCBACACACBBABCAAAAACACACCCBBABBAAACACBBCBAABACBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABCAABBCBBBCBBBAAACCCACBABBCBBCCBBABCBCCBCBBBBBBAAACCC.exe"	svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3368	sc.exe
3508	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3984	cmd.exe
4232	cmd.exe
3932	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABCAABBCBBBCBBBAAACCCACBABBCBBCCBBABCBCCBCBBBBBBAAACCC.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2828	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2852	2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe
2852	2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe
2852	2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe
2852	2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe
1360	svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
1360	svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
1360	svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
1360	svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
1380	svchost_CABCAABBCBBBCBBBAAACCCACBABBCBBCCBBABCBCCBCBBBBBBAAACCC.exe
1380	svchost_CABCAABBCBBBCBBBAAACCCACBABBCBBCCBBABCBCCBCBBBBBBAAACCC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2852	2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe
Token: SeDebugPrivilege	1360	svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
Token: SeDebugPrivilege	1380	svchost_CABCAABBCBBBCBBBAAACCCACBABBCBBCCBBABCBCCBCBBBBBBAAACCC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2844	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 3984	2852	2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe	100
PID 3984 wrote to memory of 2828	3984	cmd.exe	102
PID 1360 wrote to memory of 4900	1360	svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe	103
PID 4900 wrote to memory of 3276	4900	notepad.exe	104
PID 2852 wrote to memory of 4232	2852	2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe	105
PID 4232 wrote to memory of 3368	4232	cmd.exe	108
PID 2852 wrote to memory of 3932	2852	2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe	109
PID 3932 wrote to memory of 3508	3932	cmd.exe	111

C:\Users\Admin\AppData\Local\Temp\2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_ac91c9bd32da85a3b3b41a66b298533f_elex_hawkeye_remcos_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABBBBBACBABABACCACBCBCBABAAAABBCACBCABCCACBBCCCABCACAACBCCBBACBACABCBACBCAAABCBBBCCCBBBCCACAACABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBABBBBBACBABABACCACBCBCBABAAAABBCACBCABCCACBBCCCABCACAACBCCBBACBACABCBACBCAAABCBBBCCCBBBCCACAACABCAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2828
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCCBBCBAACCBBACCBBBBBBCCCCCBBBCABBACBCAAAACBCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe" start= auto displayName= "UserDataSvc_ABCBCCBBCBAACCBBACCBBBBBBCCCCCBBBCABBACBCAAAACBCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCCBBCBAACCBBACCBBBBBBCCCCCBBBCABBACBCAAAACBCBAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe" start= auto displayName= "UserDataSvc_ABCBCCBBCBAACCBBACCBBBBBBCCCCCBBBCABBACBCAAAACBCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3368
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCCBBCBAACCBBACCBBBBBBCCCCCBBBCABBACBCAAAACBCBAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABCBCCBBCBAACCBBACCBBBBBBCCCCCBBBCABBACBCAAAACBCBAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4900
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3276

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2844

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
1⤵
- Executes dropped EXE
PID:2352

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABBCBBBCBBBAAACCCACBABBCBBCCBBABCBCCBCBBBBBBAAACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABCAABBCBBBCBBBAAACCCACBABBCBBCCBBABCBCCBCBBBBBBAAACCC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 848753324346b786bc166bcf3bcd2522ede17d6a53d1a1225f362bc6f26940cd
MD5 b9bed360994c4f7657f71bc79622d2bf
SHA1 6f5de65e7b064b1199495459ce04d6f32841640c
SHA512 e8d5c7aa567edb3ade17ba85a741c977b06c66986eac98e19c3c2475fd16bbbe02a54657443b44171f94871ac6c6969c2401058858c4fc517a02588ee163942f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ed4609e0faea6d4e0a96f76c7f372174466ed2867c20c37fd5007a21694d4b0
MD5 21b40a9f2906bc544ad687019ce5f7e2
SHA1 cd54e8fa51ffc3f6d128c5f78d58edc338785524
SHA512 0d623beb561928b1a3e0587e34a736d598f382f9b396740d155b3cecc2c556b9ba21e4f3b9475972bec631c24ec8721eb60a64403fd8fe1225e28899664e3ed8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f40cfc0147ff037e1aa73c9743ab1a131132f85aeed900c643f6aed71199ddbc
MD5 8b52de522257947dd0dafbaaef86228a
SHA1 925ede6577bc353c5d26c819692c68aff028b4ea
SHA512 9236dc1de7de2bc30fafb3b9b1c4e9eb152b75314e7eaf7e68a6a2fc2d4d5c43cbd288a4348d40cf0000015db24d5915769b217c32ece5c9efadf99651defbc3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 4b4cb990a1c59fffa0c5305dec3628f978e88f37ae3efc30fbae105989dc0e81
MD5 0caa57ecd4182a60d514908363b6847b
SHA1 acc25d29756d0ca49c391502ca79ecb57b72c32a
SHA512 35457f9d16c674f7e5069689cd77037317adb074ce696aa4423264d62cc8694fcb6be1fd5957b3b24b59759262840c4baf083efd3875a1167f070f4b60876c1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 a5ec517840bf1927eb49646569f7f547fe28f059e1c4798be214d7e81f7198aa
MD5 d6d80774ba22c37f31f331bb6c3dd0dc
SHA1 b6267586c4be6e6a3cb5acbae9fe48679b9d59fa
SHA512 b3891f124bb1527f22a726d32d99ed5e1f9f141eb78a14862ad591fb10838b6ff26c2a322b3bf3bcaa8adf8aeaa7f04f0193e3ea9264831031b053c49492dfe4
MD5 SHA1 SHA512

Submit Download

svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCACAACAAACBCBCCBCACACBABACBACCCCAACCBACBCACBBCCBCAACAC.exe
Size 11.5MB
SHA256 479cd522785347d44c5b089884e777862777c290f08ceca3552e838e4ee1829c
MD5 ac91c9bd32da85a3b3b41a66b298533f
SHA1 32f535963d4b9b6e92d71d200af334a16aabf821
SHA512 571e155387a7c7113058500afea0b748767a10a76204a4b6966604e0884103ac8aed17ff448d57ecfc91fcb4050cc1bfa2c363677468e426cb4f4fc1f249e601
SSDEEP 49152:U+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+ES+E2+ES+ES+ElyR+ES+ES+Emq+ES+EF:G7pL
TLSH
T1A4C64B09FA9610F1D977417049DBD27A8630BE3187218EFFE689D63E9D33B906838B15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 784B
SHA256 566079094f7366cca8dd9ad2c76ecf27fc43570e884087f64a28d8da77e355c4
MD5 ee4e4a3b743404221376a166e5fb9fa4
SHA1 7f062ede46d646619dd0dd2a4b69ae15cbd7afb9
SHA512 495056981a24f13d98db12ec1204221d6a0d08dcc3037fcda9320ea0c4c4c41f2b2d5fd7346edef2c798a6e97ce220d20835da7aef8c6b9666a8df726ffb395f
TLSH
T159018C50A0B5DC97F57278D79315CBCA18AC37EBAC68EF4422095269A728A354F1A0A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1360-27-0x0000000000130000-0x0000000000151000-memory.dmp

Download

memory/1360-40-0x0000000000130000-0x0000000000151000-memory.dmp

Download

memory/2852-0-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/2852-7-0x0000000000970000-0x0000000000991000-memory.dmp

Download

memory/4900-60-0x0000000004F00000-0x0000000004F01000-memory.dmp

Download