juko | 35f888f37cb385696362818b2d4ac2783525944eac256cb5753a6ded92fe81a9

General

Target
2026-05-16_2b89108e5f01d91a9fad061c64d001e9_elex_glassworm_wannacry.exe
Size 211KB
Sample260516-d3pr8aaw6v
SHA256 35f888f37cb385696362818b2d4ac2783525944eac256cb5753a6ded92fe81a9
MD5 2b89108e5f01d91a9fad061c64d001e9
SHA1 51d26f5a203fe31f5734293560bd21f7644152bb
SHA512 8449a4b5ea938a3da94df41d9387ec13752cef31262b19167ab42ae8a7fd083f98f9c05b2f567b3878ab2f62a4dad143ee605e3c126f67c8bf59e9870dcb8958
SSDEEP 6144:jLy2Kwc64YIK628wzQocJje7RsUmWi5F1hLPBp6qoj:jkwcEO28wzmJje7Rsei5dhoj
TLSH
T154246B5AF7A220E5C55A82348ABB4731C634FC2414637B3E1780F6291DB6CA59F1AFDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery juko persistence trojan

Malware Config

Signatures

Family: Juko
Juko is a trojan written in C++.
trojan juko

Detects Juko 7 IoCs

resource	yara_rule
behavioral2/memory/900-0-0x0000000000400000-0x000000000044A000-memory.dmp	family_juko
behavioral2/files/0x001e00000002b132-5.dat	family_juko
behavioral2/memory/900-12-0x0000000000400000-0x000000000044A000-memory.dmp	family_juko
behavioral2/memory/2052-14-0x0000000000400000-0x000000000044A000-memory.dmp	family_juko
behavioral2/files/0x002100000002b2c2-15.dat	family_juko
behavioral2/memory/668-17-0x0000000000400000-0x000000000044A000-memory.dmp	family_juko
behavioral2/memory/668-18-0x0000000000400000-0x000000000044A000-memory.dmp	family_juko

Executes dropped EXE 2 IoCs

pid	Process
2052	WINWORD.exe
668	WINWORD.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\WINWORD = "C:\\Users\\Admin\\AppData\\Roaming\\Mozilla\\WINWORD.exe -r"	WINWORD.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_2b89108e5f01d91a9fad061c64d001e9_elex_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3024	cmd.exe
3052	PING.EXE
2100	PING.EXE
2480	PING.EXE

Runs ping.exe 1 TTPs 3 IoCs

Remote System Discovery

T1018

pid	Process
3052	PING.EXE
2100	PING.EXE
2480	PING.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2052	900	2026-05-16_2b89108e5f01d91a9fad061c64d001e9_elex_glassworm_wannacry.exe	80
PID 2052 wrote to memory of 3024	2052	WINWORD.exe	81
PID 3024 wrote to memory of 3052	3024	cmd.exe	83
PID 3024 wrote to memory of 2100	3024	cmd.exe	84
PID 3024 wrote to memory of 2480	3024	cmd.exe	85
PID 3024 wrote to memory of 668	3024	cmd.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-05-16_2b89108e5f01d91a9fad061c64d001e9_elex_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_2b89108e5f01d91a9fad061c64d001e9_elex_glassworm_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe
  "C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe" -r
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 -n 2&del "C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe"&ping 127.0.0.1 -n 2&rename "C:\Users\Admin\AppData\Roaming\Mozilla\000053F3" WINWORD.exe&ping 127.0.0.1 -n 2&"C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe" \r
    3⤵
    - System Location Discovery: System Language Discovery
    - System Network Configuration Discovery: Internet Connection Discovery
    - Suspicious use of WriteProcessMemory
    PID:3024
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3052
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2100
  - - C:\Windows\SysWOW64\PING.EXE
      ping 127.0.0.1 -n 2
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2480
  - - C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe
      "C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe" \r
      4⤵
      Executes dropped EXE
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Remote System Discovery

1

T1018

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

System Network Configuration Discovery

1

T1016

Internet Connection Discovery

1

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

000053F3

Path C:\Users\Admin\AppData\Roaming\Mozilla\000053F3
Size 211KB
SHA256 f91e6ce5a054d677b3ab2549372b18b02261657d3c0be0cf037edbd6b8a3741d
MD5 6b395c521a179e08b498d3b749710502
SHA1 a550b6fb79868eb6844628a079e952a9c7f01b45
SHA512 1e434882c459db5f88e76d85b83bdbef50168d2540ac8614a10ab83398b070700dcca64598b852aaffda08b8cb0b4758fb3e1ccf75668a895265b39fc810b9c4
SSDEEP 6144:jLy2Kwc64YIK628wzQocJje7RsUmWi5F1hLPBp6qo5:jkwcEO28wzmJje7Rsei5dho5
TLSH
T14F246B5AF7A220E5C55A82348ABB4731C634FC2414637B3E1780F6291DB6CA59F1AFDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WINWORD.exe

Path C:\Users\Admin\AppData\Roaming\Mozilla\WINWORD.exe
Size 211KB
SHA256 35f888f37cb385696362818b2d4ac2783525944eac256cb5753a6ded92fe81a9
MD5 2b89108e5f01d91a9fad061c64d001e9
SHA1 51d26f5a203fe31f5734293560bd21f7644152bb
SHA512 8449a4b5ea938a3da94df41d9387ec13752cef31262b19167ab42ae8a7fd083f98f9c05b2f567b3878ab2f62a4dad143ee605e3c126f67c8bf59e9870dcb8958
SSDEEP 6144:jLy2Kwc64YIK628wzQocJje7RsUmWi5F1hLPBp6qoj:jkwcEO28wzmJje7Rsei5dhoj
TLSH
T154246B5AF7A220E5C55A82348ABB4731C634FC2414637B3E1780F6291DB6CA59F1AFDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/668-17-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/668-18-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/900-0-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/900-12-0x0000000000400000-0x000000000044A000-memory.dmp

Download

memory/2052-14-0x0000000000400000-0x000000000044A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads