Analysis
- max time kernel
150s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
20/07/2026, 07:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
General
- Target 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe
- Size 91KB
- Sample260720-jc985acy6x
- SHA256 852ed4e50ae7ce8ca7020ce87ba27f12913de0c2e5cde065b0052e99a69e9149
- MD5 c2dbc242878c7b622491f770ec5f7c46
- SHA1 22782017ce0a3db385432ab7c81e8c6a6d8acabb
- SHA512 7f472c7d81c6234a2a29fc8edf7c5187d7823259ef0d86e89f67c4a14c910d4698b377caf565215b172eb4bc0f85ee2b0f90305a2f370aad841de73c5d4042fc
- SSDEEP 1536:qkOvQZfMpRKIcqDnYhye0SKBi2eQcL5mAJYoOx:zGoSK8eQcL5mAJYoOx
- TLSH T122934CAF75999CF9F4101EB0146A1BB187276960033A8BCF3790DE255B3F1A75E38287
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 5716 rundll32.exe - Modifies system executable filetype association 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe - Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\¢«.exe 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\¢«.exe 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe File opened for modification C:\Windows\SysWOW64\notepad¢¬.exe 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe File created C:\Windows\SysWOW64\notepad¢¬.exe 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system\rundll32.exe 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe File created C:\Windows\system\rundll32.exe 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe - Modifies registry class 15 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainSetup = "1784532763" rundll32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainVer = "506" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad.exe %1" 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "¢« \"%1\" %*" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" rundll32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"%1\" %*" 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "notepad¢¬ %1" 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\MSipv\MainUp = "1784532763" rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\txtfile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command rundll32.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Key created \REGISTRY\MACHINE\Software\Classes\exefile\shell\open\command 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe Key created \REGISTRY\MACHINE\Software\Classes\MSipv rundll32.exe - Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5716 rundll32.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 5716 rundll32.exe 5716 rundll32.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 5000 wrote to memory of 5716 5000 2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_c2dbc242878c7b622491f770ec5f7c46_elex_glassworm_wannacry.exe"1⤵
- Modifies system executable filetype association
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5000 -
C:\Windows\system\rundll32.exeC:\Windows\system\rundll32.exe2⤵
- Executes dropped EXE
- Modifies system executable filetype association
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5716
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\notepad¢¬.exe
- Size 85KB
- SHA256 135b4df472cfa8da21b82a8ec265537248a1b50b4c0104eba1a29c292e4199e7
- MD5 26cfd29c980ca21b5e11a22e92de57b2
- SHA1 0bec9700deee1a3b14fb6b11e35dcba8fffee608
- SHA512 e4439b991f3a4554926085934350b8c5d918239e0c41f653d301149c9556465fc5176228dd2bbe3421cb0dfaef933216247a46a81fd0c33aa2be8e3d6adfdb06
- SSDEEP 768:JgUkmKY2i/0BQZfMEQRKIbaauqnDnb49vhye+1iUSc76JZgyldX7aXKynF0vQcYb:qkOvQZfMpRKIcqDnYhye0SKBi2eQcLvM
- TLSH T1E7835D9F75D588FDF4102DB0146A17B1877B9950133A9BCB3B90CD29893B1AB5E38283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System\rundll32.exe
- Size 96KB
- SHA256 507805c7b05b30bda068e04cde29cd94d2e6a1a90646d6f1820cdaeb9606c240
- MD5 747afbec36402d5624700ab60acbf55b
- SHA1 d253937fb897f166fddde2b1dcbe2978fe588bbb
- SHA512 c5ad6c9aa14c821703b5f3cf4521b2e5ef577093025a3ae81d366cb8dd7590ba7127dd5c23feb3ccfc9455407971ffa9866ae8c8ac45485bfe2a0e340efda1e3
- SSDEEP 1536:qkOvQZfMpRKIcqDnYhye0SKBi2eQcL4ZOIlMvKFAuIwS:zGoSK8eQcL4ZOIlMvKFAuIwS
- TLSH T117A318AF75999CB8F0101EB4146A1BB287276520073E8BCB3791DE256F3F5675E38283
- MD5 SHA1 SHA512 SSDEEP TLSH