329f5d268f233627a1c51b0d088642ead7d8f9af44c98d9ae5423975ed3c51f4

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 15:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe
Size 20.6MB
Sample260910-sw9alsdm6w
SHA256 329f5d268f233627a1c51b0d088642ead7d8f9af44c98d9ae5423975ed3c51f4
MD5 708a24c9767c992cf97d279433b101a5
SHA1 2559f093b200ac8f1a6437dfd8e9e30c48a03919
SHA512 9e6dc04366b4923e18089cf7c3620b9ca396f48a47f2fa96147e42b2a4c39b05527daef52968ebe71632b66a885265d5fb9beebe90f25262ebb2c3c947ec4062
SSDEEP 49152:U+EoI3+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+j:HW1PszZ
TLSH
T1E0274C09F94340B1D92B51B04DCFD2BF8A20BB2587128DFBFB4DCB5B6923BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3056	svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
2440	svchost_CCBCCAAAAACCCAACCAACBABACACBBACACACCCBBCCACBACBACCAAAAA.exe
5864	svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBCACACBACBBBAACCBBBCCBBCCCABBBACABABBBABBABCBABCBCAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe"	2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCAABCCBACCABBCBBACCBCACBBCABCAAABACBBBBCCACBCAABBBABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCBCCAAAAACCCAACCAACBABACACBBACACACCCBBCCACBACBACCAAAAA.exe"	svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1108	sc.exe
5444	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4316	cmd.exe
4336	cmd.exe
4764	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCBCCAAAAACCCAACCAACBABACACBBACACACCCBBCCACBACBACCAAAAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4896	2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe
4896	2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe
4896	2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe
4896	2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe
3056	svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
3056	svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
3056	svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
3056	svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
2440	svchost_CCBCCAAAAACCCAACCAACBABACACBBACACACCCBBCCACBACBACCAAAAA.exe
2440	svchost_CCBCCAAAAACCCAACCAACBABACACBBACACACCCBBCCACBACBACCAAAAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4896	2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	3056	svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
Token: SeDebugPrivilege	2440	svchost_CCBCCAAAAACCCAACCAACBABACACBBACACACCCBBCCACBACBACCAAAAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4316	4896	2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe	92
PID 4316 wrote to memory of 2676	4316	cmd.exe	94
PID 3056 wrote to memory of 1552	3056	svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe	95
PID 4896 wrote to memory of 4336	4896	2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe	98
PID 4336 wrote to memory of 1108	4336	cmd.exe	100
PID 4896 wrote to memory of 4764	4896	2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe	101
PID 4764 wrote to memory of 5444	4764	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_708a24c9767c992cf97d279433b101a5_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCACCBBBCCACCBABABABCABCBBACBCABABCACCAABBCCCBBBBCBACBAABACACBCBACABBCBBBCCABAACCCBCACCCAACACBCACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCBBCACCBBBCCACCBABABABCABCBBACBCABABCACCAABBCCCBBBBCBACBAABACACBCBACABBCBBBCCABAACCCBCACCCAACACBCACABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAAABACBACBABCAACBCCCCCCACCBBCCBBABACAAABBCACBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe" start= auto displayName= "UserDataSvc_ABAAABACBACBABCAACBCCCCCCACCBBCCBBABACAAABBCACBCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAAABACBACBABCAACBCCCCCCACCBBCCBBABACAAABBCACBCABB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe" start= auto displayName= "UserDataSvc_ABAAABACBACBABCAACBCCCCCCACCBBCCBBABACAAABBCACBCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1108
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAAABACBACBABCAACBCCCCCCACCBBCCBBABACAAABBCACBCABB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAAABACBACBABCAACBCCCCCCACCBBCCBBABACAAABBCACBCABB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5444

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAAAACCCAACCAACBABACACBBACACACCCBBCCACBACBACCAAAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCBCCAAAAACCCAACCAACBABACACBBACACACCCBBCCACBACBACCAAAAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2440

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
1⤵
- Executes dropped EXE
PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 02207bfb5fbde2c05c0b0c35358259a3e6ecff62f18e3f005c37ce5549da1198
MD5 25a17fd9e6875a207ab7804cf6254569
SHA1 aa1c2bc8e4c423325a36b78652e1db3565a73f14
SHA512 822174a6a0889583095ea2ea45aa18672f430fd84fdf03143762fa3f0b48bc085d9ae2abcc5072a2ab7fc20d04edeaef732f9906bfb6d7156a9985fffad7dc6d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 57ca64e50ca550410420660581d91b97628cf52e0176ef9b026273f2a3b6110b
MD5 5543626a1016fe672140bde597ef9fd1
SHA1 6acfa21bd422b9ef9d602615756a351d2d44e291
SHA512 9e0ac48920cf0d39d2aa19e50265dfd8b192de120bc5560fc25dbc9282d98ab3494d1fd4eccc141dc4a4c89ffdee883130cbb73b0b7f7efac75e85cc206e714d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7802d9f3e751b5effd69f0345cfb6aeed68e19da9984011bcd6867b67fc5b038
MD5 8e07bf5dff456ccc15edf33d03b99d5c
SHA1 0c490367d164271b56d99e4f4f39da4aca5be349
SHA512 7521b12ddc8a8adf31cad0e702699daa1e21002926ed00fc9dec199db34c725e87ee2475a31692ccdbe6a62c4ef96d0ea305f26977676e90dc10c4f566004cd9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b5db38e5e7b28a803c0ff446c9df6f761f6173c29236b6085ad1a2e13bc4b4f7
MD5 e6b13721b9a1510e57d3a56d24a6bf23
SHA1 c33192f52398d36a50fb248519b6240c55c9243a
SHA512 085ee1cd131f43829744503bdcee1eaf2f78cfe04c850949d77e4f16b06ef54a91befc25cfdb93cebb33874c943fd30fea100ae3fa78e6cd7a7ce888f593b8cd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 93e068ff459b4b35539371846f64d403d012870a0e8e89e373e4791070c2293f
MD5 17f52e0eae94e1260a3849505f9e634f
SHA1 3efe5238ceaaa37ba2e961a52a1ff7def6172f80
SHA512 53dc7653429cb991933be4930b108408c561fd6102d706d10e8c45e33ee8ee16bfcc9f85483acd84dfcfde3e0b060df46f18526b3e37f6c6f42f249e052f2971
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2856a9288b7f798bd537132aa937355c83c21a739ab9cb46534284221f71cb35
MD5 ddb584776e7631794c80efd59c7f5c42
SHA1 0894c3420469ff6023de9550567d5ab9bc769363
SHA512 df653cec65e78cb72c9b30a92f4a13b78c06d9e2ecf84604e7fa87f113247adb3acc591223c28b49a4863f38ae3ab575f6bb9ad3952b6209f7797757932c0a71
MD5 SHA1 SHA512

Submit Download

svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABCCBACAABACAAACBCACCCAABCCCCBBBBAABACACCABCABABACBAA.exe
Size 20.6MB
SHA256 329f5d268f233627a1c51b0d088642ead7d8f9af44c98d9ae5423975ed3c51f4
MD5 708a24c9767c992cf97d279433b101a5
SHA1 2559f093b200ac8f1a6437dfd8e9e30c48a03919
SHA512 9e6dc04366b4923e18089cf7c3620b9ca396f48a47f2fa96147e42b2a4c39b05527daef52968ebe71632b66a885265d5fb9beebe90f25262ebb2c3c947ec4062
SSDEEP 49152:U+EoI3+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+Ee+Ee+Ee+Eo+Ee+Ee+Ee+Ee+Eo4+j:HW1PszZ
TLSH
T1E0274C09F94340B1D92B51B04DCFD2BF8A20BB2587128DFBFB4DCB5B6923BA16438655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 e5c6a9761104545fb13681264fbc66fef06530869f4f71e9e1ff6f48d44dae62
MD5 5f587c6543ab3100865d5bd1314dd664
SHA1 fabbcf5fa32e1ad2b55193688cad9b47526449ab
SHA512 70e3d659e0bbcf388e7faaf6c1f925bd7128ce9f2b851e14267ec7ef2ae044bbf64e0f09e0a5f48b253eeb02c118a09ae06bfbf0040b0f3e8a40752b4e3898c0
TLSH
T190118C64E0D69933F1722CCB9129EB070D9437AF9E58DF1423089329BB1D93A9D5A8D1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2440-70-0x0000000000170000-0x0000000000191000-memory.dmp

Download

memory/3056-32-0x00000000004D0000-0x00000000004F1000-memory.dmp

Download

memory/4896-0-0x00000000003E0000-0x0000000000401000-memory.dmp

Download

memory/4896-8-0x00000000003E0000-0x0000000000401000-memory.dmp

Download