26c1b222194b4bfb8fb90d729de12f0100bd3c4b96c33971727d757ff32b2fcb

Analysis

max time kernel
11s
max time network
13s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

Reason

Machine shutdown

General

Target
2026-07-20_ab941ef951ee0190dfe77c8c8c8aafac_coinminer_elex_glassworm_wannacry.exe
Size 1.6MB
Sample260720-xpcehsdz5s
SHA256 26c1b222194b4bfb8fb90d729de12f0100bd3c4b96c33971727d757ff32b2fcb
MD5 ab941ef951ee0190dfe77c8c8c8aafac
SHA1 703ff4af3e14b46ed53314be1e53e9cf169c8233
SHA512 98ca793880ead0ef048419fe5d2765b9bdfe668d6e24723892b00f5754bbd3a9f5caed8cab8766b80ea556047d555268d037ef0e6962c4321646b81fab8ef166
SSDEEP 49152:h5+hFUVFFRwMz3d+iI6+apY5O1zeDHo4NAjG:h5aFUVX3J+QYUzeDIDjG
TLSH
T13075239237F284F9D5B232304989B3A959F8EEBC1B5129C7A30439473E749E1663D7C2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	2026-07-20_ab941ef951ee0190dfe77c8c8c8aafac_coinminer_elex_glassworm_wannacry.exe

Executes dropped EXE 1 IoCs

pid	Process
3820	Power.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_ab941ef951ee0190dfe77c8c8c8aafac_coinminer_elex_glassworm_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Power.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "201"	LogonUI.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3972	shutdown.exe
Token: SeRemoteShutdownPrivilege	3972	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2648	LogonUI.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 3820	1940	2026-07-20_ab941ef951ee0190dfe77c8c8c8aafac_coinminer_elex_glassworm_wannacry.exe	85
PID 3820 wrote to memory of 3972	3820	Power.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-20_ab941ef951ee0190dfe77c8c8c8aafac_coinminer_elex_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_ab941ef951ee0190dfe77c8c8c8aafac_coinminer_elex_glassworm_wannacry.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\Power\Power.exe
  "C:\Users\Admin\AppData\Local\Temp\Power\Power.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3820
- - C:\Windows\SYSTEM32\shutdown.exe
    "shutdown" /f /r /t 00
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:3972

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b2855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:2648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DontSleep.exe

Path C:\Users\Admin\AppData\Local\Temp\Power\DontSleep.exe
Size 405KB
SHA256 ec294b06a3836ac9ff3c08b49b385034615de8552c54d8bbaa3478dc15fbf62f
MD5 e24f88a1fa789ffdb4ed4d9769d78a26
SHA1 143c86b562c36d1031d12f465be674888ba1fc31
SHA512 a3fa425c3fe219c5aaf84b6aef07a4c97d5319f6a41cc0b4fbdbe219a89d5896a286d07b9bf1346030e517b1ccaa96cbe4c72d64bb8917aafc93e36ecb1597fd
SSDEEP 12288:R5393whFOBbjSUdOBYaKb/wxAZca1uR4c:R53uhFWko/wxYcr4c
TLSH
T1E594F16176E280FED4E326300E54737655BAFE742B4185C7A7603712BE316E2EA3E247
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Hibernate.ico

Path C:\Users\Admin\AppData\Local\Temp\Power\Hibernate.ico
Size 161KB
SHA256 96f877b23285d6e5db252d436dc78abe7060060c77e1b33bceec0c9f0e78f283
MD5 0f3bc5fbb62b7b75dba4a2e330c364e8
SHA1 74950280ee83e1980a10d828bd24304ab6cfdcbe
SHA512 190509aa502394b5efdc3445794e061027613d94c03f15e5a6ac8a54d5f8681916e1764a8a177ef8209e03190f1b990e999d37311188eb59fea1fec8372caa70
SSDEEP 192:7i55d9YaxUyflq7cg9LxyH72/u+ka5kaC6oMySyVI5CxFdBGrzGFN5Q:e55Iax5QQkyH7Dw6aCFMySyVcCxkrP
TLSH
T1FCF3CC643420E509D7D87A789FA0D9B503607CACAE2549723AF8BFCF37FD267A111225
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Logoff.ico

Path C:\Users\Admin\AppData\Local\Temp\Power\Logoff.ico
Size 64KB
SHA256 f7a12491d1bd63b33d9c181459d12274a2312f927bde22d8d5abfd1e22fe751c
MD5 b355c3dad55d636a10d346bddfd39b90
SHA1 94ca47b50257f7d8dfe78647636f26e1b4d37af0
SHA512 bfcb2aa221610f9cf0e81bc1621ff275a62bb2571449b4745094714e867fcbe1b97fd2ce11c467f0652682f37d309f0a730d5d2ab4f3dd7b0b6dd7fd26bbd5de
SSDEEP 1536:msyO+nQu2uvoG2bll6tz4S7uVlMTQe2Jg8IsDAT:msVtu2uv7ruVllyIAT
TLSH
T1B853AED683D95456C7FF2E7492298A286B2BCDD79281F0179461BCB2BF32483583B14B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Power.exe

Path C:\Users\Admin\AppData\Local\Temp\Power\Power.exe
Size 93KB
SHA256 72c885c0d127713c0728b985f98a3fed309c61a5a7cd05ec939ee6fc2f0ac80d
MD5 2f9b499157ff186635a9dac9a7d710e9
SHA1 f483fa955ee34752ac2b167456e034ed65f90ed0
SHA512 8331586c51e2135b5d96ac92711c8599bb78571977bff280907bb3e5f196a85d7d8699af45d36de40a047785bcead369a03de2836c051a318f84a58e99c10a19
SSDEEP 1536:LcYDkG2HjMsRyfc6Xq+auiZu/IJ0LVNCfQtzLG8AhA/oMtIBs8OC:LvYDBCHq6mGHCM3GjhAtIW
TLSH
T10E936D62B2D055F5F5D60035095B29BADB34FB384B388CF7F7684A1F5B214D2AE39222
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Power.ini

Path C:\Users\Admin\AppData\Local\Temp\Power\Power.ini
Size 1KB
SHA256 aec091e7e6d8bf0d20777ae65eb8b59a71cd72fef95cba4a988dd5dc5827c657
MD5 6fe8ccdc90557b6f4e69fa458fe903cb
SHA1 64a2c9817b6e32bf1e1732a686df5b153fb280b4
SHA512 c0c4dfd56710afe6b6f462904bd97502b4f1722d78423129aa36639bdff385a94ddeb418eb67dee1f09d8a9318e09d390cc598d63e0af703038cd2310a24ee01
TLSH
T1C231B0E8A41B054FCB0BB55BC7362568F49F54D9D8D072003287F98E593282E0B38FAC
MD5 SHA1 SHA512 TLSH

Submit Download

RE.ico

Path C:\Users\Admin\AppData\Local\Temp\Power\RE.ico
Size 43KB
SHA256 db4762bf7ff8376bb66229889548efbeb2c129e5c0081805a6843d7b87f9a476
MD5 a0c86943edc658dcf6d10e6c93c65f5f
SHA1 c3272114ffe0b2a108a85a0273394dda28ea3fb4
SHA512 80d59fe673bf728cd55a49985fbf39122d5e841dd156896e23ab4369e35e95c9f68069547f2b5dc1d5406b6da0a50dbe21eda506e6fe7818284dc73c2a7f1dd7
SSDEEP 768:AJqdvo/gVPAZAEe6OZj0iiDjq45qAeDksI/zGBoMQ6hE:Zvo/jjRv5q7o/zwG6E
TLSH
T18C137CF389A80FE1E48A37B56671670123433C6592B65B2AC453FC8A7C731B25269B0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Restart.ico

Path C:\Users\Admin\AppData\Local\Temp\Power\Restart.ico
Size 26KB
SHA256 334ae3c213c61014d99aa4f4f5d615849efadce3d68c456d69e897ca29c9a84a
MD5 479356c358402744567c1d9047d44731
SHA1 169951c592c54e5287756a94c77aad1b1cccd62e
SHA512 2b544cc30a07eb31897a65c7e9dbfaf567e468c10470e939fd011739cd3d7db6a7a501f954c2b2d547080c2e0b651bc4b417aa9446a6acede4d94598ff459e40
SSDEEP 384:CDAnk8VipEYX1wKxRxoxK8iwFgOFOOBrB0hy/xhe8n8Ze8z6LDgdcQmmvsULT3WP:C8Q6f9oZTUzEbpO+Zu
TLSH
T1A3C23C087F095CA1E6765DF254638A4C2326815B1F148B379FBCB7A1E4F71823D0BA5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RestartOneTimeF8Menu.exe

Path C:\Users\Admin\AppData\Local\Temp\Power\RestartOneTimeF8Menu.exe
Size 217KB
SHA256 00518676466baaf1e2e8e5c6b717cf2332a04b3411d7d9e33c6ce31647559363
MD5 0d0c9f4dc6953fc036d39fc3de66c9e9
SHA1 49ae29a15e0a35417f58e6b3d0baa426364f4d03
SHA512 321a148780b96394cf4395bedfa9a2fdc7778881bfd2ba7d7c4a22efaa954058cbb1cca4116f34126f0699db53159f1fe35306c9b55c3b664c35e2c4b3042c99
SSDEEP 6144:s5VP9Ge3+hoAvdeJBbLncZ9Eaq7FbVCCUhyf9u+:s5393whFOBboEaq7FbbVu+
TLSH
T1DC24D0123ADE4CF6C5D335310A16776A26FAE3220B16C7CB67E006076D266D6CF3D686
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SafeMode.exe

Path C:\Users\Admin\AppData\Local\Temp\Power\SafeMode.exe
Size 763KB
SHA256 320960d75fab8bfe6fb4224b4ba926a8731ddc3ab6ac8e6ec4e3e8b6db1a008d
MD5 6937237dbe7fcceda39e03b10ea413c4
SHA1 735cf28c6ff9cf353dce865f28fbd00b99dcf3cd
SHA512 a70cc2ed088bc2dd7cc684289cf13241aa157c147f5699d9d4be2013eae14d0ddae8a37b3bac937bc9aa1d12898c43bf0efa0a9c9fcd6a7bd39669529299104f
SSDEEP 12288:UaWzgMg7v3qnCiMErQohh0F4eCJ8lnykQYy55EJZvNz7jcAyL:LaHMv6CUrjanykQV+XjyL
TLSH
T1C9F4BF12F7D680B6D99339B5297BE727EB3579194323C487A7E03E728E311405B3A361
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Shutdown.ico

Path C:\Users\Admin\AppData\Local\Temp\Power\Shutdown.ico
Size 69KB
SHA256 beaf15ef3a8baa2b414501dde165382cae9a27ad6cfc84cbb570d3b7da9aaaa6
MD5 e4d857d180549171af0f5eb017ef74a6
SHA1 2e99c2d52e1cf98deb8e491a3c88c23ad57a3966
SHA512 23c02a07a5c1a37898f23905b4e56fb3361d06321088b27f74a8f1a7aaa086f1ec7aa4d6e55c7bf37c6ed86b242f1dab4a5488950c2d58ca991810a487fb4b44
SSDEEP 1536:YhqoNXGbnyNiIJ3C779hl5AxQbqGEvSBfz:YhYK3CJAxQbCEL
TLSH
T16163F16952C6A56AE9460B70E7AB43540377FE609F80D60847873DB7B07A313386CFE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Standby.ico

Path C:\Users\Admin\AppData\Local\Temp\Power\Standby.ico
Size 67KB
SHA256 bd8d040f7cbc9389338c352d973546fd1442b521543639185c92d6dae0aa590c
MD5 deb88639e6140f83ccdc58b56ad3e708
SHA1 70d6cc992cb014321a7376cc8e09f23d2a9dddc0
SHA512 1490753c6b0cc1a9e52cddcd38a0fb048a26364c18964326f3ac5af667d9ceb714389baaa48538b9694aa2d30b9dc1602b6baf6ab91b0b851730531a47bc9b22
SSDEEP 768:ayOtFGIHFW5uwKXVLxpvPdBwB1e75tTj+W/z9ecSu7x+VWSqKE0:IY7K7TW+TqWBecSu7UWSK0
TLSH
T14A631A00B780D952FE8C567486A7E7F8333BBD441A86978320B4B37A6E733E31E55199
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bios.ico

Path C:\Users\Admin\AppData\Local\Temp\Power\bios.ico
Size 66KB
SHA256 47bd4895cbe119aafd2cfdb5352d488098f587b01e36c6167de373954ed43d0d
MD5 51bbd8bf1bb601465f05061f39e8beb0
SHA1 fa4c36c0815813d77cc68c5177a95aa825c360c3
SHA512 37125b2edbb567473ba0513c2e105e5b6ecb641da087aca37fc66c90cc9f4ba32206d1f11f845cda9609455121d01a476a47d3174d4993255b1680bed44fcfac
SSDEEP 192:N5nzptSjjjjjjjjjjjjjjjlQh7WrOh3D1UG0ibFS/degvquCo1lF7jjjjjjjjjjd:Ndnhq6hz1UG0ixcWupbyI
TLSH
T19A63C597B685C622D5151E348CB1ABBC917BEF85BD0AB24F7808736FFF726D61800684
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

oter.ico

Path C:\Users\Admin\AppData\Local\Temp\Power\oter.ico
Size 22KB
SHA256 d0d6413392c00b18f4cd2dbd54a509d11af92017de1ee235dca9808665d26d0c
MD5 7014bbdd96e4947687aa205c39eeec76
SHA1 9c37b436a97e11ada6ccc859a6438dba44359c14
SHA512 698b1ed1ba99b7c47d2c16ba1e78fa6c2ed19d53de96163c1238a3d012c053a6dc10439441e3a0c09cdb5cb9de552f4270f89c26e0500a8e8105d648da979c14
SSDEEP 192:yTyYESkDHQWcWn80+Qr+3cZB/jGN9OlHaJWwiyApWNBchRPMvIss:ymYSDPrY3eB/qN9OlHGP8MPs
TLSH
T116A24E4B5F086E68C81B00BAFA7281915353A86628F61725CA1F4C5FFBFE97B4375350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

poweroff.exe

Path C:\Users\Admin\AppData\Local\Temp\Power\poweroff.exe
Size 168KB
SHA256 62c1c52c54359730f8787c1e241097fd0714f2abde47adecaca32c42be366c33
MD5 d7c961725dbb24010e4549c98acb7b42
SHA1 56e2762629c0f79d6f5aafddd2a03573e735fa11
SHA512 7a74ca24273d82a6f20ceda2df96d107f40b640f47f74afb9e7546957db17c3d3917a782e9575ebbc4a9e3ef110f6611ecd4db18a2a6374d8422bcf3d72e7f0f
SSDEEP 3072:4WY7YvkomkGkIzSoBuN4+Ugt1qg9oAHSVYvpau:4Z7ifckWEN4+Ugh+Vu
TLSH
T1DEF34B5573D4C337E8A201394972ABF2EEB0ED382A159843DBB47B4E1C74ED19B29352
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1940-0-0x0000000000400000-0x000000000042C000-memory.dmp

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads