ba9addfd20ecf2b665087dd498abdf8372ce7a4f752d4395f211a101f91dcecb

Analysis

max time kernel
149s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 14:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe
Size 6.4MB
Sample260910-rg7b2avbrb
SHA256 ba9addfd20ecf2b665087dd498abdf8372ce7a4f752d4395f211a101f91dcecb
MD5 886e55020714ea98f9ee6da3cdbb7afe
SHA1 b91010a0f318877af41e05335c4ef58d510bc353
SHA512 e39cb9f994001a674c7c807986cfe9e4456918162d4b88ba4d2bcb22c922eedb17559ba9c1b09f7739f5595db29faf32989774816be701d973552ffb6f59c8d5
SSDEEP 49152:U+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+ES:x
TLSH
T171666D06F5D610E4E476617049BB827A8A72FD6187318EEFE6CC852F5E23BC09D34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2556	svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
4948	svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
5612	svchost_AAAACACABBCAACACBBACCAACBACBBCCCBACBBCBBBCAACCCCCACBBCB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACCCACCCBBBCBABBBBACBBCCCBCACBCBBAACACCACAAACABCACBAAACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AAAACACABBCAACACBBACCAACBACBBCCCBACBBCBBBCAACCCCCACBBCB.exe"	svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABCBCACBBAABBABACBBACACBCBACBABAAACBCCABBBCCABCCACBAAACC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe"	2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5372	sc.exe
3076	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5480	cmd.exe
2008	cmd.exe
3240	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
704	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4148	2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe
4148	2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe
4148	2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe
4148	2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe
2556	svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
2556	svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
2556	svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
2556	svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2556	svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 5480	4148	2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe	92
PID 5480 wrote to memory of 704	5480	cmd.exe	94
PID 2556 wrote to memory of 1936	2556	svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe	95
PID 4148 wrote to memory of 2008	4148	2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe	96
PID 2008 wrote to memory of 5372	2008	cmd.exe	98
PID 4148 wrote to memory of 3240	4148	2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe	99
PID 3240 wrote to memory of 3076	3240	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_886e55020714ea98f9ee6da3cdbb7afe_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBAAAACBBCCACACBBCBACABABBBCACCABCBACABBBAAABBAAAACCCAACAACCBCACBBBACCBBABCCACBABACBCABABCCBBAAAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5480
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CACBAAAACBBCCACACBBCBACABABBBCACCABCBACABBBAAABBAAAACCCAACAACCBCACBBBACCBBABCCACBABACBCABABCCBBAAAABCCA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:704
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCBCCACBACACBBACBCACBACBBCABCBAABBACABABBCBBBCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe" start= auto displayName= "UserDataSvc_BBCBCCACBACACBBACBCACBACBBCABCBAABBACABABBCBBBCCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCBCCACBACACBBACBCACBACBBCABCBAABBACABABBCBBBCCAAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe" start= auto displayName= "UserDataSvc_BBCBCCACBACACBBACBCACBACBBCABCBAABBACABABBCBBBCCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5372
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCBCCACBACACBBACBCACBACBBCABCBAABBACABABBCBBBCCAAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCBCCACBACACBBACBCACBACBBCABCBAABBACABABBCBBBCCAAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3076

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1936

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
1⤵
- Executes dropped EXE
PID:4948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACABBCAACACBBACCAACBACBBCCCBACBBCBBBCAACCCCCACBBCB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACABBCAACACBBACCAACBACBBCCCBACBBCBBBCAACCCCCACBBCB.exe
1⤵
- Executes dropped EXE
PID:5612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 54a99e5e7bc92ba620690a65b72e7c470c2945a5ac149503c37d67a13810d956
MD5 190aa1bf965a83840b7cd49a23d83fb9
SHA1 087fe28b521f8d892082a074f74d28abf31ab6c6
SHA512 2362b111aa6efd883ebaa53eb19cfa57d4f6418b3656b9cdb2b3ebbf9c591e4ff2aec64fea50906e2d2e63dac79f25eef6d5d86a68cabcb5e366abb0be39cb8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c3c5c4907a31e60b85a2f5c64825007754db16b77c51ca276c4958b806626d4
MD5 3b4e99429fc1b11b85542674800fd5f6
SHA1 2dacd70a409d3d0555bb83020c1b2a33a09c1e9a
SHA512 31e17de7b890de9f8ca0b5f0ead24ba529bb163e9dc739d079b1e03b2d5f4dab85433dbf1f802c8830799084008880294a0bfd0e03b32d02904be71c896a48f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0ab5d04a8c53afceda035f70d48ee3b27d400050976b0e210a5ebc8c4bae88b7
MD5 ee3404ba287adda2f45ab47bb2f55558
SHA1 7488974bb2e94f35a6cd225418889f8622f1af7f
SHA512 9aedebbc9bde1e943c4650ae961c74f70ba0422abd26bc4b2e3e16bc25fffad88154624b1d92fdc737e39dd7d6ea0664a06fc6e4738bfe4b4cd1657296a08e9c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5dccbaed41a632d78d2652c26a07b0b6dc158349ecea093309b3344b9ed7cf90
MD5 84a4cfc66e86fb92ba77ac92b91a0b49
SHA1 24b5984796a929fdc38837c8b16a105030969f5d
SHA512 ba4d6e695fbf0e8df61b198c167b341285ffc063957428d703f266a5ada75568eb754735eb7b8baa5989176d631e104aac5a522b8285ea950d32575d05b484b9
MD5 SHA1 SHA512

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 20.0MB
SHA256 762e13fa6a154c60a9223bcb17fed6338fffce998d3ff4e2cc8bfc567a41ea8b
MD5 88dac0764efd3fe945c5c73a64d2315b
SHA1 324d45237ef4f708c5b97b0a49719e6250315dc2
SHA512 33ca191103432705325599d63b750042e1ab54d9728a82be879c7ad41012297fd9f41e58c2c20d9344f2db94051d172cbe7e63ce0a6a6a4b21a055f6f03cfc6d
SSDEEP 49152:U+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+ES:HYwUyPzJyjmJBgqVjP
TLSH
T194276D06F5D610E4E476617049BB827A8A72FD6187318EEFE6CC852F5E23BC09D34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 39.2MB
SHA256 8ca7790a01335263dad34da596e605f245fe2c6256a6798fbed5ea54333b0d81
MD5 06c34c4a9819e0ade03d1c39a975f0b1
SHA1 29051d1df0ada3c6616321ebc4c8c6011b675756
SHA512 b6424f8bbd7c2979145ab09eb2cb579647080be2a280205e1d8c6834fbcf89fb3ed1acea18359346338f0b79350925ad1727d3d7fc902cc650df3e23270eb94a
SSDEEP 49152:U+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+Eo:VYwUyPzJyjmJBgqVjH
TLSH
T1AD976D06F5D610E4E476617049BB827A8A72FD6187318EEFE6CC852F5E23BC09D34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 45.7MB
SHA256 e95948b03e35ead7cbac210a88114f1ec9f92c010cb81b0ca9a1057115f01bd4
MD5 46b0d1d7d7a105ee0c54c9b0049162e4
SHA1 aab2ecee771b5d3adda47a0ce45b7eee0b7927cb
SHA512 3005de3bb282b6e9e03999ad388ac7c76cb05ae91d34306e888ab3f7124bca1b332bd0eeebd34e845c9fdf3c1c135f6230617e43d5872918e1d8efc653935651
SSDEEP 49152:U+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EE:/YwUyPzJyjmJBgqVjd
TLSH
T178A76D06F5D610E4E476617049BB827A8A72FD6187318EEFE6CC852F5E23BC09D34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 2.0MB
SHA256 d892e060b4113d2e4e35382e0ab46207215519fca98ca37a4529d265c17a42c1
MD5 65a286ae9a08b06d5c96520b35bf3b02
SHA1 27ff88c1ea5c7baf150af529fb7907c844ff5e05
SHA512 37a085b351ed5d1de8203ce8bf5d74b0cfd8be433df8003bb7e67c5afa213b0226f3ea5f6ef0eca605db483ae835fbb51f9b3d6b49027f8523030454b39aed39
SSDEEP 49152:U+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQQ:E
TLSH
T10BA55D06F5D610E4E476517049BBC27A8A72FD6187318EEFE68C862F5E23F809D34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_AAAACACABBCAACACBBACCAACBACBBCCCBACBBCBBBCAACCCCCACBBCB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AAAACACABBCAACACBBACCAACBACBBCCCBACBBCBBBCAACCCCCACBBCB.exe
Size 6.1MB
SHA256 949ea7e383841eb46d57d1fa8d527c3ed370edc111cf79a49485d425de55831c
MD5 606ea2bab84f83bea6d75e5eb5b0ce39
SHA1 3054d4bbb23c5e3391ccbb58edd753f64d00d395
SHA512 0896fe8254543bc1268452113f4846fac068eb3c565443e719c05ad9a715b642683af4123ccd2e480d611532541cf55971f8ba4e876de1c0afac8ed9875865ed
SSDEEP 49152:U+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+E0:t
TLSH
T1F3565D06F5D610E4E476517049BBC27A8A72FD6187318EEFE68C862F5E23F809D34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBABAACAAACCCACBACABBBCBCBABBAACBABACABBCCCBCCABCBACCCC.exe
Size 6.4MB
SHA256 ba9addfd20ecf2b665087dd498abdf8372ce7a4f752d4395f211a101f91dcecb
MD5 886e55020714ea98f9ee6da3cdbb7afe
SHA1 b91010a0f318877af41e05335c4ef58d510bc353
SHA512 e39cb9f994001a674c7c807986cfe9e4456918162d4b88ba4d2bcb22c922eedb17559ba9c1b09f7739f5595db29faf32989774816be701d973552ffb6f59c8d5
SSDEEP 49152:U+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+EQj+ES+EQrW+ES:x
TLSH
T171666D06F5D610E4E476617049BB827A8A72FD6187318EEFE6CC852F5E23BC09D34B52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2556-52-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/2556-34-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/2556-73-0x0000000000520000-0x0000000000541000-memory.dmp

Download

memory/4148-35-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/4148-61-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/4148-0-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/4148-23-0x0000000000240000-0x0000000000261000-memory.dmp

Download

memory/4148-12-0x0000000000240000-0x0000000000261000-memory.dmp

Download