bc0ef4e3a947bbaf2a147454b9d88614aec440b290301c927478a66fdf5101db

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe
Size 2.3MB
Sample260802-wjmsmat1ds
SHA256 bc0ef4e3a947bbaf2a147454b9d88614aec440b290301c927478a66fdf5101db
MD5 7e4314ae69a3a210bcd57b2982d6f20d
SHA1 fa8bf25d12f7715f832c1275474dbc98ca649db6
SHA512 b30d0db5d7a6ff775b23f62778db96032a603bb8396b0be55e5569cab18dbb602d237cb8d0b294a6705f563a9d6df03a4b7944ca5428c440f5abc0b9a5abf126
SSDEEP 24576:mht44Ar/X5FNZmn4L1rtferaFqMz/5Zt9dPealLbLnIsk8:mht4Nr/X5FNZm4LmaF3xHfx
TLSH
T15AB54B07FCA005E6C4AE9372856695927B31BC490F3163EB2B50B6383FB67D85DB9B40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence privilege_escalation

Malware Config

Signatures

Creates a file in the Startup directory 1 TTPs 2 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdate.vbs	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdate.vbs	SysUpdate.exe

Executes dropped EXE 1 IoCs

pid	Process
5728	SysUpdate.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Update\\SysUpdate.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000\Software\Microsoft\Windows\CurrentVersion\Run\UpdateSvc = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Update\\SysUpdate.exe"	reg.exe

Discovers running processes 1 TTPs 26 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
4460	tasklist.exe
4840	tasklist.exe
3096	tasklist.exe
244	tasklist.exe
3104	tasklist.exe
5924	tasklist.exe
2764	tasklist.exe
5476	tasklist.exe
4704	tasklist.exe
5500	tasklist.exe
1760	tasklist.exe
5984	tasklist.exe
5132	tasklist.exe
1672	tasklist.exe
3444	tasklist.exe
4540	tasklist.exe
1900	tasklist.exe
544	tasklist.exe
3316	tasklist.exe
3708	tasklist.exe
872	tasklist.exe
5960	tasklist.exe
5680	tasklist.exe
4564	tasklist.exe
1580	tasklist.exe
3908	tasklist.exe

Modifies registry key 1 TTPs 2 IoCs

Modify Registry

T1112

pid	Process
2112	reg.exe
4284	reg.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3932	schtasks.exe
1936	schtasks.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

description	pid	Process
Token: SeDebugPrivilege	4460	tasklist.exe
Token: SeDebugPrivilege	3316	tasklist.exe
Token: SeDebugPrivilege	5132	tasklist.exe
Token: SeDebugPrivilege	4840	tasklist.exe
Token: SeDebugPrivilege	4704	tasklist.exe
Token: SeDebugPrivilege	1672	tasklist.exe
Token: SeDebugPrivilege	3708	tasklist.exe
Token: SeDebugPrivilege	3096	tasklist.exe
Token: SeDebugPrivilege	244	tasklist.exe
Token: SeDebugPrivilege	872	tasklist.exe
Token: SeDebugPrivilege	5960	tasklist.exe
Token: SeDebugPrivilege	3104	tasklist.exe
Token: SeDebugPrivilege	3444	tasklist.exe
Token: SeDebugPrivilege	5680	tasklist.exe
Token: SeDebugPrivilege	5924	tasklist.exe
Token: SeDebugPrivilege	2764	tasklist.exe
Token: SeDebugPrivilege	4564	tasklist.exe
Token: SeDebugPrivilege	5476	tasklist.exe
Token: SeDebugPrivilege	1580	tasklist.exe
Token: SeDebugPrivilege	3908	tasklist.exe
Token: SeDebugPrivilege	4540	tasklist.exe
Token: SeDebugPrivilege	5500	tasklist.exe
Token: SeDebugPrivilege	1760	tasklist.exe
Token: SeDebugPrivilege	1900	tasklist.exe
Token: SeDebugPrivilege	544	tasklist.exe
Token: SeDebugPrivilege	5984	tasklist.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 4460	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	89
PID 3372 wrote to memory of 3316	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	91
PID 3372 wrote to memory of 5132	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	92
PID 3372 wrote to memory of 4840	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	93
PID 3372 wrote to memory of 4704	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	94
PID 3372 wrote to memory of 1672	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	95
PID 3372 wrote to memory of 3708	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	96
PID 3372 wrote to memory of 3096	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	97
PID 3372 wrote to memory of 244	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	98
PID 3372 wrote to memory of 872	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	99
PID 3372 wrote to memory of 5960	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	100
PID 3372 wrote to memory of 3104	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	101
PID 3372 wrote to memory of 3444	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	102
PID 3372 wrote to memory of 2112	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	103
PID 3372 wrote to memory of 3932	3372	2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe	104
PID 5728 wrote to memory of 5680	5728	SysUpdate.exe	107
PID 5728 wrote to memory of 5924	5728	SysUpdate.exe	108
PID 5728 wrote to memory of 2764	5728	SysUpdate.exe	109
PID 5728 wrote to memory of 4564	5728	SysUpdate.exe	110
PID 5728 wrote to memory of 5476	5728	SysUpdate.exe	111
PID 5728 wrote to memory of 1580	5728	SysUpdate.exe	112
PID 5728 wrote to memory of 3908	5728	SysUpdate.exe	113
PID 5728 wrote to memory of 4540	5728	SysUpdate.exe	114
PID 5728 wrote to memory of 5500	5728	SysUpdate.exe	115
PID 5728 wrote to memory of 1760	5728	SysUpdate.exe	116
PID 5728 wrote to memory of 1900	5728	SysUpdate.exe	117
PID 5728 wrote to memory of 544	5728	SysUpdate.exe	118
PID 5728 wrote to memory of 5984	5728	SysUpdate.exe	119
PID 5728 wrote to memory of 4284	5728	SysUpdate.exe	120
PID 5728 wrote to memory of 1936	5728	SysUpdate.exe	121

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_7e4314ae69a3a210bcd57b2982d6f20d_glassworm_snatch.exe"
1⤵
- Creates a file in the Startup directory
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4460
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3316
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5132
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4840
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1672
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3708
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3096
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:244
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:872
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq tcpview.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5960
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sysinternal.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3104
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq explorer.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3444
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v UpdateSvc /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Update\SysUpdate.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:2112
- C:\Windows\system32\schtasks.exe
  schtasks /Create /TN \Microsoft\Windows\Update\SysUpd /TR C:\Users\Admin\AppData\Roaming\Microsoft\Update\SysUpdate.exe /SC ONLOGON /RL LIMITED /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:3932

C:\Users\Admin\AppData\Roaming\Microsoft\Update\SysUpdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Update\SysUpdate.exe
1⤵
- Creates a file in the Startup directory
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5728
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxservice.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5680
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vboxtray.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5924
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwaretray.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:2764
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq vmwareuser.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4564
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq procmon.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5476
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq wireshark.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1580
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ida64.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:3908
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq x64dbg.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:4540
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq ollydbg.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5500
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq fiddler.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1760
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq tcpview.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:1900
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq sysinternal.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\system32\tasklist.exe
  tasklist /FI "IMAGENAME eq explorer.exe"
  2⤵
  - Discovers running processes
  - Suspicious use of AdjustPrivilegeToken
  PID:5984
- C:\Windows\system32\reg.exe
  reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v UpdateSvc /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Update\SysUpdate.exe /f
  2⤵
  - Adds Run key to start application
  - Modifies registry key
  PID:4284
- C:\Windows\system32\schtasks.exe
  schtasks /Create /TN \Microsoft\Windows\Update\SysUpd /TR C:\Users\Admin\AppData\Roaming\Microsoft\Update\SysUpdate.exe /SC ONLOGON /RL LIMITED /F
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SysUpdate.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Update\SysUpdate.exe
Size 2.3MB
SHA256 bc0ef4e3a947bbaf2a147454b9d88614aec440b290301c927478a66fdf5101db
MD5 7e4314ae69a3a210bcd57b2982d6f20d
SHA1 fa8bf25d12f7715f832c1275474dbc98ca649db6
SHA512 b30d0db5d7a6ff775b23f62778db96032a603bb8396b0be55e5569cab18dbb602d237cb8d0b294a6705f563a9d6df03a4b7944ca5428c440f5abc0b9a5abf126
SSDEEP 24576:mht44Ar/X5FNZmn4L1rtferaFqMz/5Zt9dPealLbLnIsk8:mht4Nr/X5FNZm4LmaF3xHfx
TLSH
T15AB54B07FCA005E6C4AE9372856695927B31BC490F3163EB2B50B6383FB67D85DB9B40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WinUpdate.vbs

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WinUpdate.vbs
Size 116B
SHA256 5b9a165c2bdd6f3b2cc728b84f7dc41c398d5935abe6a02829328bb7746cfc2c
MD5 2e1ec68b6ef19d43b1b468bcc5d79c02
SHA1 5679b3063c45b515cf7e2b5b20a5d24e271bf84a
SHA512 ca69e8cd96c619339ee024b88f1045484250d665edc440b936a67dce792452a7a3a70feb505df646593b4ac67a1b7db9db623bfe578323b0b695e4bfe2ff5d9e
TLSH
T1BBB01218B68CD93BB31360FF4A33B58D80D0D5D32646BE048700C68D73C0965951F0D3
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads