344aa6a591f4932deb9a2654f0da0ff93d250e6dd985d20ea55f5949e5ff837e

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/05/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-24_19a53ebd23cd603d6d6633df23be34d3_amadey_elex_glassworm_vidar_wannacry.exe
Size 1.5MB
Sample260524-rrk7jsft5j
SHA256 344aa6a591f4932deb9a2654f0da0ff93d250e6dd985d20ea55f5949e5ff837e
MD5 19a53ebd23cd603d6d6633df23be34d3
SHA1 60d85abbe112d94db401186531a50e36877c2165
SHA512 0d87301ea180c2f1d61a04d39a8fc6a64db6059dabb3918a95bbc0dcf9d322095dbdb219338df3583f54d80afe3149c556445b00e1f8633976d9a01528acdb3b
SSDEEP 24576:Zwc2ROf1IegqutJQ5FeQzcuC4r6HQiLfUEmIh7CH:r2RAR5FeA6wiLfUKhOH
TLSH
T118755C16A6B854E5E1BB5A748A719532DB727C201B30D7CF4290F2AE5F337C09D36B22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-24_19a53ebd23cd603d6d6633df23be34d3_amadey_elex_glassworm_vidar_wannacry.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	2026-05-24_19a53ebd23cd603d6d6633df23be34d3_amadey_elex_glassworm_vidar_wannacry.exe

C:\Users\Admin\AppData\Local\Temp\2026-05-24_19a53ebd23cd603d6d6633df23be34d3_amadey_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-24_19a53ebd23cd603d6d6633df23be34d3_amadey_elex_glassworm_vidar_wannacry.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6140

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads