32ad726b4b1e4848434d3de6def1206ff540f99ef0db6996403b567048572e96

Analysis

max time kernel
150s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 09:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe
Size 26.4MB
Sample260912-lnzb4swtcy
SHA256 32ad726b4b1e4848434d3de6def1206ff540f99ef0db6996403b567048572e96
MD5 60c90d1db43bcf8cacb21dbfa0a68425
SHA1 d69080747f953e64d7c10fa14b34e9da0a228707
SHA512 78ef3ceddf8546794a6e240475e464b47ad9f010e70566058ebd1fc3e14c98976d3fabf83fb3c83bd10d3e085ca7da3c9a76dddb76fc13a467528511a6499dd2
SSDEEP 786432:Q5V5V5V5V5V5V5j5V5V5V5V5V5V5j5V5V5V5V5V5V5j5V5V5V5V5V5V5j5V5V5Vr:O
TLSH
T1A8571A6C7B9A2141DA7795B48856C2F6BE707D20032057FF6A80F6395E17AD0F83EB09
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
256	svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
4508	svchost_ACCBABBAABABABABCABABACABCACAABCABACBBABCACAACACBBBCCBA.exe
5952	svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABABCCAAAAACBCBCABABACCBCCCABBAACBCCAAABABCBBCACCCCCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe"	2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BBBCBABBBBACBCBACAAABCCABCAACABBCCAAABBBACAAACBCAAACBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBABBAABABABABCABABACABCACAABCABACBBABCACAACACBBBCCBA.exe"	svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3856	sc.exe
6004	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1552	cmd.exe
3952	cmd.exe
3332	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBABBAABABABABCABABACABCACAABCABACBBABCACAACACBBBCCBA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2760	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3740	2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe
3740	2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe
3740	2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe
3740	2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe
256	svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
256	svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
256	svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
256	svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
4508	svchost_ACCBABBAABABABABCABABACABCACAABCABACBBABCACAACACBBBCCBA.exe
4508	svchost_ACCBABBAABABABABCABABACABCACAABCABACBBABCACAACACBBBCCBA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3740	2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe
Token: SeDebugPrivilege	256	svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
Token: SeDebugPrivilege	4508	svchost_ACCBABBAABABABABCABABACABCACAABCABACBBABCACAACACBBBCCBA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 1552	3740	2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe	90
PID 1552 wrote to memory of 2760	1552	cmd.exe	92
PID 256 wrote to memory of 3744	256	svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe	93
PID 3740 wrote to memory of 3952	3740	2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe	96
PID 3952 wrote to memory of 6004	3952	cmd.exe	98
PID 3740 wrote to memory of 3332	3740	2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe	99
PID 3332 wrote to memory of 3856	3332	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_60c90d1db43bcf8cacb21dbfa0a68425_elex_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABBAABBBBABBACBCBAABBCCCCACCABCCACABBCBAAAAACABABABABBAABBCCBBAABAABACBCCABCACCAABCBACACCACABABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1552
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBBABBAABBBBABBACBCBAABBCCCCACCABCCACABBCBAAAAACABABABABBAABBCCBBAABAABACBCCABCACCAABCBACACCACABABABBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2760
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BBCABAAACCBCCCCBBAABAABACBABACAACABCBCAACBACBABBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe" start= auto displayName= "UserDataSvc_BBCABAAACCBCCCCBBAABAABACBABACAACABCBCAACBACBABBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BBCABAAACCBCCCCBBAABAABACBABACAACABCBCAACBACBABBAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe" start= auto displayName= "UserDataSvc_BBCABAAACCBCCCCBBAABAABACBABACAACABCBCAACBACBABBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6004
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BBCABAAACCBCCCCBBAABAABACBABACAACABCBCAACBACBABBAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3332
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BBCABAAACCBCCCCBBAABAABACBABACAACABCBCAACBACBABBAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3856

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:3744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAABABABABCABABACABCACAABCABACBBABCACAACACBBBCCBA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBABBAABABABABCABABACABCACAABCABACBBABCACAACACBBBCCBA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4508

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
1⤵
- Executes dropped EXE
PID:5952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7c577392afc5266f40fe5563364c4a361b74e2bfe20aed80b88d12cf135a658c
MD5 fb5052c9237673e83db412a48e35a216
SHA1 512787a91c242c395e9c2bda3b573381f5b5aa5e
SHA512 124429f7676e80b0f79fb41f8296329c3ce8ed9b5d4161cc84bd0de298bc463082816665d95c0280abd16af5e6ae03b78483f08327f41555c879f02e0c12b94c
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 28eb566e625fdbd06cb11dbb874310a1a965520e66fdf45e863ef19ec216ce08
MD5 714aba36a697e07114c5ddb7dd4576f5
SHA1 03e5951d75fd7aa224ad8f5592924ffc49b2dabd
SHA512 c419184f597384e98f31c770bb14f6430095a87fb4d3766c4ff3c4cd8a527c5247460e763187e797b9290bc59e541aa9330aad1b5e0082017f9d6d0ba59511f7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d4c71009a6369d686be3486956b474024c5995e541322fc81377fb504916fa9
MD5 802550a2bb67137f799da69d741b9f3d
SHA1 1b6c8988d869db965895cd3ac854c403a1772f50
SHA512 d656d214016de5cbd26544289ca33c0c8ef9784dfc18ce95d85c45ea919a13806a7d208aaab19495b8c743041ca6a5c293974d86e3eb12d3e4b2b1b1d9fa34f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 dfc085a23d6b0912758591bd3cbdd53c6a933c19ebdd4d418fe08515c993ff81
MD5 4f3c728a0d04d28a2cbfbfc8901c65e3
SHA1 3aa7174d3f960298ebe9633e54bafbbfb8a81484
SHA512 9131dec71c90583c93d3e9e5049deb2d70270a113009b53454b283803d414729ad5e97b6b1628382673bd78b5a4955eeb3bdd7150117ab3bea3d61d0422b741e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 88d37e0bc94d94a7065faf042b1eac2ada57a139ff31c99bfb982550494de397
MD5 cf4f43041e73720e3fada5078502e6f6
SHA1 00f55efb25a0beaf5e77d0c5d58fcb1aeb193aad
SHA512 966dc9c24b2093c5c5504cb609e682348f3bcf5d48b0f9312c1065f32197b4201b83eb3a9f62107778a955162b998027c7baac778ec1c12fa109f6bd28f72a71
MD5 SHA1 SHA512

Submit Download

svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBABABABACBBBABBAACACACCABAAACCCCABBACABABBBBABCCCAACB.exe
Size 26.4MB
SHA256 32ad726b4b1e4848434d3de6def1206ff540f99ef0db6996403b567048572e96
MD5 60c90d1db43bcf8cacb21dbfa0a68425
SHA1 d69080747f953e64d7c10fa14b34e9da0a228707
SHA512 78ef3ceddf8546794a6e240475e464b47ad9f010e70566058ebd1fc3e14c98976d3fabf83fb3c83bd10d3e085ca7da3c9a76dddb76fc13a467528511a6499dd2
SSDEEP 786432:Q5V5V5V5V5V5V5j5V5V5V5V5V5V5j5V5V5V5V5V5V5j5V5V5V5V5V5V5j5V5V5Vr:O
TLSH
T1A8571A6C7B9A2141DA7795B48856C2F6BE707D20032057FF6A80F6395E17AD0F83EB09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 77f3380768bfa1ad4e13aeaea2e67704e57978ea54b5fb26c868d596c019bdb5
MD5 c9203c48db1331aa5c3c53c357e0d6d6
SHA1 88d5cf6682d3707f60356a7252fc55aa09b3b56f
SHA512 496dde0384736b583d2b61a175fefae98229f1529eda08641a5d6be88a18b398b8ce1d30d30f5da4983dfc077af866c755efc5c7032b428988bddfc8f447851c
TLSH
T1BD112721B0A5DC13F27128E3E655DB8A0CB833A758ACAF04A28B0A18A69CC35CD110E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/256-49-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/256-34-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/256-71-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download

memory/3740-35-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3740-61-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3740-0-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3740-23-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download

memory/3740-12-0x0000000000CF0000-0x0000000000D11000-memory.dmp

Download