3211d30ebe0429f16d210cf8dff84a9db1436f059ed226082494cffeb5bb1401

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 17:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe
Size 21.9MB
Sample260910-wezavstbqd
SHA256 3211d30ebe0429f16d210cf8dff84a9db1436f059ed226082494cffeb5bb1401
MD5 3df22b77b818e7193252cb1d45a0e1a3
SHA1 7c5f9e6f929cc6d94b78d267c03517e0fd4a20a0
SHA512 3a1d3cf50d43bc3baf08bc1d7e27f920d660d15055217ec31afac8d004d979272796c4043c60c2c314f5c3b5c35e16668037a211e4f5ace90724fd9d445396ec
SSDEEP 49152:U+ES+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+Y:P
TLSH
T123372B09F94340B1D92B50F04DCBE3BF8A60BB2586128EF7FB4DCB5BA933BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2360	svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
2136	svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
1428	svchost_ACCABCCBBBACCCCACBBACCAACBACABBBBACBCCBCBAACAABCCACACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACBBACBACCCCAABCACCBACACCBCAACCBBBAACBABCBBCCAAACACCCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCABCCBBBACCCCACBBACCAACBACABBBBACBCCBCBAACAABCCACACAB.exe"	svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABACACBCCAABBBAAACBABBCCCCAAAACABBCAACCBACBBBAAAABCCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe"	2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5376	sc.exe
940	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5832	cmd.exe
3012	cmd.exe
3376	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCABCCBBBACCCCACBBACCAACBACABBBBACBCCBCBAACAABCCACACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4840	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3696	2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe
3696	2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe
3696	2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe
3696	2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe
2360	svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
2360	svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
2360	svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
2360	svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
1428	svchost_ACCABCCBBBACCCCACBBACCAACBACABBBBACBCCBCBAACAABCCACACAB.exe
1428	svchost_ACCABCCBBBACCCCACBBACCAACBACABBBBACBCCBCBAACAABCCACACAB.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3696	2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	2360	svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
Token: SeDebugPrivilege	1428	svchost_ACCABCCBBBACCCCACBBACCAACBACABBBBACBCCBCBAACAABCCACACAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 5832	3696	2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe	92
PID 5832 wrote to memory of 4840	5832	cmd.exe	94
PID 3696 wrote to memory of 3012	3696	2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe	95
PID 3012 wrote to memory of 5376	3012	cmd.exe	97
PID 3696 wrote to memory of 3376	3696	2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe	98
PID 3376 wrote to memory of 940	3376	cmd.exe	100
PID 2360 wrote to memory of 5876	2360	svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_3df22b77b818e7193252cb1d45a0e1a3_amadey_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBCCACCCBBCABAABABABBCBBBAACBAAACCAABBAACCBABBBCABABBCBBABCACCACCABAABABCACACBCBBCABBBABCBCBAABCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5832
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABCBBCCACCCBBCABAABABABBCBBBAACBAAACCAABBAACCBABBBCABABBCBBABCACCACCABAABABCACACBCBBCABBBABCBCBAABCBAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAABACBBCCBBABBBCBCBCCBCBACCCCACABCBBCCCAAABCACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe" start= auto displayName= "UserDataSvc_ABAABACBBCCBBABBBCBCBCCBCBACCCCACABCBBCCCAAABCACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3012
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAABACBBCCBBABBBCBCBCCBCBACCCCACABCBBCCCAAABCACACA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe" start= auto displayName= "UserDataSvc_ABAABACBBCCBBABBBCBCBCCBCBACCCCACABCBBCCCAAABCACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAABACBBCCBBABBBCBCBCCBCBACCCCACABCBBCCCAAABCACACA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3376
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAABACBBCCBBABBBCBCBCCBCBACCCCACABCBBCCCAAABCACACA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:940

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5876

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
1⤵
- Executes dropped EXE
PID:2136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBBBACCCCACBBACCAACBACABBBBACBCCBCBAACAABCCACACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCABCCBBBACCCCACBBACCAACBACABBBBACBCCBCBAACAABCCACACAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d9115c70ac6b348222d978614ed8e0303b242b8bb045197884aabe1671d3b48f
MD5 eb895397e7f073be4b02dac5de34ab25
SHA1 a72dddd92e44fc3dab4faad09cd805362560d87e
SHA512 cc049bb06ef983cfddef242939cd6e55e52284bb2be9ee429e0de8da1515c16816ecc0879ac475d49d71390502598cf837375e85d1c2fbe0774b807cd7ea0f93
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 00da81de2077b853ea5c12a326ec081d6de6bb22b3359a949d54d8dba4ab6f4b
MD5 f30aba5072b786a68a5960fb0e944f6d
SHA1 4eff9cfa325d36a654605702997af3dc36cbc9e7
SHA512 539ff1ac8025d584737addf0876308dfbf1ba067050fe357b91f0b17d0dbc44cee574b72e3f0763b03dd940a721a79b9bfb439438edfc7ed8ea2733787a18e6e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d5e7433dde5e7ca39f86e0697986a75a355420f3c3f6635f4694b9ae4f1f6a7b
MD5 085580e3290aed46312bc72d59efca50
SHA1 95e2119d2e6e11d3788d0da1b20647c061fb54cd
SHA512 e3c41ceda7c81d987b3a95861ef47a650f0bfce83f7a69e5648cdaddd51043ccacca5801b480983435c38369a43e6d774811b351b21ffd96b1c81ada4ace9725
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d3cce5c6149ea133e23d10a6f811b3a6e29c0baac220297f1f07a9346c0d0d30
MD5 2b3c116b2f6f54ec1187e22cf21ca49e
SHA1 387d6a1fbc032676da4829374c0de4a2abc17358
SHA512 924fe772b08effabb80649bd4255f88dce17235dc08a2d844c1716e880eb9366bc2dd650495bd86bf90e83726c041c6a31f5a98acd7296714a336a7ad06a9a5d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6d85186153a1490230e64a8e958c629a3e185ae95f91ac862fdba2e762c9280
MD5 dea05ea50c514614cc6ada9a4cf3321e
SHA1 21741fc7858b41dce1ec654e3dad3c7be1d8da9e
SHA512 dc52a0db6754617fdb50dab301ed9c0ff9522a11a0ac2844c9fd78bc81ffb398ed7d1febfa7ecfea245191d70ce91b1eae88956cec11694ec2b9a806d550f3be
MD5 SHA1 SHA512

Submit Download

MoveConvertTo.exe

Path C:\Users\Admin\Downloads\MoveConvertTo.exe
Size 66.5MB
SHA256 d427ec012d00a23e7d5593db0876eed6a9b3517a784b93fe03bdfe2fec3bf8d4
MD5 d0d5c068fa4b22e966ff10a75d3b0d95
SHA1 90b990138f46b7789a343a629c1a3730b7a500d1
SHA512 0d7dc6ab35f73529ec59bd3ce84c64faccba420cff2beb2ff21968377e32b465cf75205eec828e9784e54d749881fcdf57f6b7a91d00c9ad519016e9a9094484
SSDEEP 49152:U+ES+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+g:hYwUyPzJyjmJBgqVjN
TLSH
T1FEE72B09F94340B1D92B50F04DCBE3BF8A60BB25C6128EF7FB4DCB5BA932BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 5197baaae185c08947267e8cb186d69bbca2ca417d2dd1d738abbdce1bf0b56c
MD5 9191c66ca605e0c6a8703403e76b02e1
SHA1 f532a1f312745a660a1a6f8ab81a15754f1e3244
SHA512 84617e6896267501cf07e8ce778da50c198e108699fe696521978d18bdea04ff4653b2b54d4155c27623d7145da03d58cee2c5d3fe1550fa69dc58d8c2b3f94c
MD5 SHA1 SHA512

Submit Download

svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAABCACBACBBABABBBCACCCBBCACBBAACBBAAABBCCACABACCABAACA.exe
Size 21.9MB
SHA256 3211d30ebe0429f16d210cf8dff84a9db1436f059ed226082494cffeb5bb1401
MD5 3df22b77b818e7193252cb1d45a0e1a3
SHA1 7c5f9e6f929cc6d94b78d267c03517e0fd4a20a0
SHA512 3a1d3cf50d43bc3baf08bc1d7e27f920d660d15055217ec31afac8d004d979272796c4043c60c2c314f5c3b5c35e16668037a211e4f5ace90724fd9d445396ec
SSDEEP 49152:U+ES+ESm+ES+ESm+ES+ESgX+Ex+ES+ESm+ES+ESm+ES+ESgq+ESm+ES+ESm+ES+Y:P
TLSH
T123372B09F94340B1D92B50F04DCBE3BF8A60BB2586128EF7FB4DCB5BA933BA15428555
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 99b3582dbbbdc8540c62f7d850db48f3ca988aaa9027f95a6a6dc71a47983f42
MD5 277b2304219c2f0dd1924ffc42f133aa
SHA1 0df6d130eb985924337de260381044bf69bde75e
SHA512 495ac2c814bae2025a0f24e4076074e2bf309a2a48b5a5002a434370f3494501b55e4d03f09470ca3c3c5a5621e3bd4c2e657e4cd9b106b270c043589c420818
TLSH
T164110A52F0A59823F47124975A29EB4B18F477BFDC98AB1C2308422DF759D39CD194E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1428-95-0x0000000000550000-0x0000000000571000-memory.dmp

Download

memory/2136-86-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/2360-71-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/2360-32-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/2360-50-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/2360-111-0x0000000000470000-0x0000000000491000-memory.dmp

Download

memory/3696-59-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/3696-21-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/3696-83-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/3696-10-0x0000000000330000-0x0000000000351000-memory.dmp

Download

memory/3696-33-0x0000000000330000-0x0000000000351000-memory.dmp

Download