904cb3642226b663294f03c40d28e580fa95a1742486b03e8ae1bfb75c70fb69

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 07:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe
Size 21.1MB
Sample260912-jsxyqsff89
SHA256 904cb3642226b663294f03c40d28e580fa95a1742486b03e8ae1bfb75c70fb69
MD5 892d6bfa4462de6fcdb519d6be447cf0
SHA1 2dec31b0e07591a0490c5c9328bd54423f7429b7
SHA512 163788d66253aad230a215765b264b216109558a4207b72ebf57c8b2cfbe0b6fb97ebb03fa4b56224cad1c1df4d90e441c6ba39171a71193647dfab8f7b63034
SSDEEP 393216:k58585T58585T58585T58585T58585T58585T58585T58585T58585D:k58585T58585T58585T58585T58585Tn
TLSH
T170274C1CB7DA1490E97395B08896C2F69D7179304731CBEFA684E63E5E23AD0E83DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5060	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
2060	svchost_CACCBACBCCABAABCAABBBABAACCCACABACCBCBBBBBBBCBBCCBCABAA.exe
4548	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBCCABBBCCABAAABBBBCCCAAAACABACBCCBCBAACCCAACACACACABCAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe"	2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4154726816-2055034831-2297277433-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CABCBABBCCBCBBACCCCABBACCAACBAAACCABBBAAACBACAACACBABCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCBACBCCABAABCAABBBABAACCCACABACCBCBBBBBBBCBBCCBCABAA.exe"	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6060	sc.exe
4764	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2576	cmd.exe
2260	cmd.exe
6088	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCBACBCCABAABCAABBBABAACCCACABACCBCBBBBBBBCBBCCBCABAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
916	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3920	2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe
3920	2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe
3920	2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe
3920	2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe
5060	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
5060	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
5060	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
5060	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
2060	svchost_CACCBACBCCABAABCAABBBABAACCCACABACCBCBBBBBBBCBBCCBCABAA.exe
2060	svchost_CACCBACBCCABAABCAABBBABAACCCACABACCBCBBBBBBBCBBCCBCABAA.exe
4548	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
4548	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3920	2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	5060	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
Token: SeDebugPrivilege	2060	svchost_CACCBACBCCABAABCAABBBABAACCCACABACCBCBBBBBBBCBBCCBCABAA.exe
Token: SeDebugPrivilege	4548	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3920 wrote to memory of 2260	3920	2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe	89
PID 2260 wrote to memory of 916	2260	cmd.exe	91
PID 5060 wrote to memory of 1600	5060	svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe	92
PID 3920 wrote to memory of 6088	3920	2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe	95
PID 6088 wrote to memory of 4764	6088	cmd.exe	97
PID 3920 wrote to memory of 2576	3920	2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe	98
PID 2576 wrote to memory of 6060	2576	cmd.exe	100

C:\Users\Admin\AppData\Local\Temp\2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_892d6bfa4462de6fcdb519d6be447cf0_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3920
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCACCACABBBAAAACBAABCCCAAAACBACAABCAABBCAACCBABABABBBCCACBABCCCBAABBAAABAACACAABBCABABBAAABBABCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CCBCBCACCACABBBAAAACBAABCCCAAAACBACAABCAABBCAACCBABABABBBCCACBABCCCBAABBAAABAACACAABBCABABBAAABBABCABAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCBCCCCBACCBAAACAACBCAABACCBCBCBACABAABBBBBACBBBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe" start= auto displayName= "UserDataSvc_CCBCCCCBACCBAAACAACBCAABACCBCBCBACABAABBBBBACBBBCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCBCCCCBACCBAAACAACBCAABACCBCBCBACABAABBBBBACBBBCAC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe" start= auto displayName= "UserDataSvc_CCBCCCCBACCBAAACAACBCAABACCBCBCBACABAABBBBBACBBBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4764
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCBCCCCBACCBAAACAACBCAABACCBCBCBACABAABBBBBACBBBCAC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCBCCCCBACCBAAACAACBCAABACCBCBCBACABAABBBBBACBBBCAC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1600

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBACBCCABAABCAABBBABAACCCACABACCBCBBBBBBBCBBCCBCABAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCBACBCCABAABCAABBBABAACCCACABACCBCBBBBBBBCBBCCBCABAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\PerfLogs\qap`g`v~dtlq
Size 10B
SHA256 baf29582609656f41fb21b0d6e77788001c8ba420a8757ccc5a7013865f45060
MD5 82d336be286a93eb6ae362c1ebe2deda
SHA1 fa0dd8a4231329cc210a7107ecb29a83bb1df8d6
SHA512 3b55eac9363e0357e0cf5d509903c4be03b89c54b59d9af149430c0f8feaeba54bba7ab2cc4120779d0625ff4318a4696006424ae09c0cfd59dcba8b3631bfa7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 73960538adf5b17b7d606fcaff097298898e772aa10ec8412e1555b8f18bf3c6
MD5 e4bfe6c9b31b25da5810a5268533ec4b
SHA1 a7e3ae387ded914900091b871152c789e7cccddd
SHA512 2d72c43f8ca0fae1a7aef990b3b801d2438495adc2f47d74128a1db683cd9f2faed614d62274ad97baca10a2150e9908d29bae669d2374076c1beead8fb5d931
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8f149902c72853e07bbac573e8000a3a97caaccef994a51392c360845053c6ce
MD5 ba977ad6b7d57fdd2ebb2703d191f5b5
SHA1 8460a5255492011ff2d014dff415264d625f29dd
SHA512 9c919504aad4bb5203df11113e95225c04c36a0670ea457f11650d530dff19f19a1028fbf6c346910d4c0ee403a3d1544a22cf179d5d76e1d4a5977e033a49ec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8efd936d496aa15432233b841c3cd1ab575b1138632c28ddb4954b2c44a78f1b
MD5 4bb6a5f3ec76a13cf9c88ac57b838abb
SHA1 5d4c2d9a02ee85c0570176c060b531ba2e91b958
SHA512 9e09f658316e589e6bf160d25a85406da748cd3a3a302cd07bfb565f8de242b45af2dde426e646857a8188202fb8441011935f05b83eb9e2c33adb1517ef9c5a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bd6832ba35556eac32db0c2b78f989edc06333f20c74769b375d438325156c30
MD5 326960de395a68e785c17f66ddde9604
SHA1 0c4988a14ad68684cd682bfa761d8c44fc96152f
SHA512 ffc11252b4f361301972337dc7c1692591a2ea44d213ba14cd8e1da433f77fe1b190ebe46e251da1557d36008b826656e19c8a8f9300f79d3b3a0e0afd39040f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3126270da89eaa8b75c87f9d02e5dfbd16cfa3971218e67cbd15cfbfd5cde10e
MD5 02247ebe949cd5152431df68f1f323e4
SHA1 e5735ab6a0fd908e18546c7d4f3f56de81e81f80
SHA512 9d84be20e15fe95d00c3b4214ed9a6a857c9408293f77f4197008b3ba19718460b7704f655a19f60c6fe9b501c7b80df52476aab7171d4b82a3293e9072f84f3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 d18fccabb3a046b005ac703c05879af29517b98767b0ab9ec3095d11f34acd46
MD5 dbd8ad2d3f1c995eb836bbba3b932cbb
SHA1 79a66e60d58f16186c13fe74f11e717bfd35aaa6
SHA512 ad28a3e9ac387a1d93f9082105968f8dcfede46e6d972566ff6dd0fef8366dfbd347b77b7dc88d933702085fbe7fb32f2d4670ce1d4485c5850ae64b77a23754
MD5 SHA1 SHA512

Submit Download

svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABABBCABCACAAAABACCCACBAACCBBBBACBBACBBCABAACBAAACABBAC.exe
Size 21.1MB
SHA256 904cb3642226b663294f03c40d28e580fa95a1742486b03e8ae1bfb75c70fb69
MD5 892d6bfa4462de6fcdb519d6be447cf0
SHA1 2dec31b0e07591a0490c5c9328bd54423f7429b7
SHA512 163788d66253aad230a215765b264b216109558a4207b72ebf57c8b2cfbe0b6fb97ebb03fa4b56224cad1c1df4d90e441c6ba39171a71193647dfab8f7b63034
SSDEEP 393216:k58585T58585T58585T58585T58585T58585T58585T58585T58585D:k58585T58585T58585T58585T58585Tn
TLSH
T170274C1CB7DA1490E97395B08896C2F69D7179304731CBEFA684E63E5E23AD0E83DB05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 58243b2253d6d47b1989dc03ce3bf4a518ee988637407aaeec1c8ea254e7bd72
MD5 268dd03c20da0825046c6bb0fec756be
SHA1 536cdb494e9fc1a66bdd456fdf3be720c3bf236b
SHA512 bd2b0d2732036c42c95a183dd9b87aa7808a2f405f2577ae279212097f8fbd9768d56f34d21aad9b565b95ac513183a28c037bde17cd7fa9faecdef2afb3ba1a
TLSH
T14411C162B0A5DC07F53269C2571AEBC60CAC778F9928FB2553CA0218E6C9C36CD150B6
MD5 SHA1 SHA512 TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 1KB
SHA256 296ebff35f361a5f7fda2a4ceacbfbc4208d931be81ff37b3255a5045982a214
MD5 151aa02080d14806d1157024ce82dea9
SHA1 ca17e2f8d979d91da4b626bf22566283882bd270
SHA512 8da53a6e9dcaa98508de642c8dc68ff27f175c2740f99f371f47ac165f489e69d7af998dff5565bc4b2f8e140a4484233704ae704f27b454ec80dc96f9b23302
TLSH
T15621D162B0A5CC07F53168C25715EBC60CAC778FD928BB2453CA0218E6C9C36CD150A6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2060-70-0x0000000000A90000-0x0000000000AB1000-memory.dmp

Download

memory/3920-0-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/3920-7-0x0000000000E90000-0x0000000000EB1000-memory.dmp

Download

memory/4548-72-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/5060-23-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/5060-33-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download