2e3309fc02534913998fdac6425c93b8d7247a6d5bdbfc92da94b5e8283fd890

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe
Size 13.2MB
Sample260810-e5mw3sbj5v
SHA256 2e3309fc02534913998fdac6425c93b8d7247a6d5bdbfc92da94b5e8283fd890
MD5 8669198f536452f22dfdf2e089ddfe24
SHA1 bea0396e0ef2c945faa6a2504fece6fb947559eb
SHA512 ee4950a660617820a1d02fefd773320311b8da912da42195893247d68a3eb4fea7446f1443a8e6d26628239a1a2068dcbe7cbcca171af6b908ba5ec7f5742f15
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglY+ES+E2+ES+Eo:oY1Y1Y1Y1Y1Y1Y1Y6
TLSH
T1A8D64B45F94380B2D82B01B14CCBD3BF4B70BA158B129EEBF74D876EA933BD06625255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4612	svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
1584	svchost_CBCBCABAAAABBCBCACCCCACCACABCCBACBCCCBCCCBBACACBAABCCCA.exe
4544	svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACACABCCACBCBAAACBAABABBAABCCCCABAAACABABACCABCACABCAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe"	2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAAACBABBBCBCABBBCBCBBCABABCCCAACBCBBBABBCBAACBAAABAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCBCABAAAABBCBCACCCCACCACABCCBACBCCCBCCCBBACACBAABCCCA.exe"	svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5512	sc.exe
2912	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1156	cmd.exe
3620	cmd.exe
5448	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCBCABAAAABBCBCACCCCACCACABCCBACBCCCBCCCBBACACBAABCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6060	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4100	2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe
4100	2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe
4100	2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe
4100	2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe
4612	svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
4612	svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
4612	svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
4612	svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
1584	svchost_CBCBCABAAAABBCBCACCCCACCACABCCBACBCCCBCCCBBACACBAABCCCA.exe
1584	svchost_CBCBCABAAAABBCBCACCCCACCACABCCBACBCCCBCCCBBACACBAABCCCA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4100	2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	4612	svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
Token: SeDebugPrivilege	1584	svchost_CBCBCABAAAABBCBCACCCCACCACABCCBACBCCCBCCCBBACACBAABCCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 5448	4100	2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe	92
PID 5448 wrote to memory of 6060	5448	cmd.exe	94
PID 4612 wrote to memory of 1332	4612	svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe	95
PID 4100 wrote to memory of 1156	4100	2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe	98
PID 1156 wrote to memory of 5512	1156	cmd.exe	100
PID 4100 wrote to memory of 3620	4100	2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe	101
PID 3620 wrote to memory of 2912	3620	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_8669198f536452f22dfdf2e089ddfe24_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4100
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCACBBABABBCBABABABCCCAACBCCACCACBACBBBBCABCBACBBACACABCCABAACCBBBABACCCBCBBCAACABBBCAACCBAAABBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCACCACBBABABBCBABABABCCCAACBCCACCACBACBBBBCABCBACBBACACABCCABAACCBBBABACCCBCBBCAACABBBCAACCBAAABBCACC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAACCABCBBABBCAACAACABCBCCCCACBBBCACCABABBBAAACCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe" start= auto displayName= "UserDataSvc_BAACCABCBBABBCAACAACABCBCCCCACBBBCACCABABBBAAACCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAACCABCBBABBCAACAACABCBCCCCACBBBCACCABABBBAAACCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe" start= auto displayName= "UserDataSvc_BAACCABCBBABBCAACAACABCBCCCCACBBBCACCABABBBAAACCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAACCABCBBABBCAACAACABCBCCCCACBBBCACCABABBBAAACCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAACCABCBBABBCAACAACABCBCCCCACBBBCACCABABBBAAACCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2912

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1332

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCABAAAABBCBCACCCCACCACABCCBACBCCCBCCCBBACACBAABCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCBCABAAAABBCBCACCCCACCACABCCBACBCCCBCCCBBACACBAABCCCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
1⤵
- Executes dropped EXE
PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e8f44cde7a6335ddcd753d4bc71497f3f7ad1ebf4f3c06b1d3df5134bd7c64d5
MD5 c19ed4ce3f384485915a9c58a604d40a
SHA1 6ce8b53559a4ceb6ab8855f7f9581b2d5fb12f4c
SHA512 e542390ae7c8b2c3711345bed043f310dcf634efe2cb347fed4bd557cc74d838951395a6eea8b2298b8bf66f1d97ee20455079a3807485e1db55837eed5224fb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0d6746086ba7509c42d254b54f27725e0751352307285ef4f4204266ef1bf79c
MD5 08bfa66d490914e128cbfb92a0e02e34
SHA1 faa242de994496e550b64da5c5f0630d85a08e01
SHA512 b2151e4bdceb5d333ed17049c2868931628f7276a58f5b3e7db179fd7c2ef8baea54a0840627081f873b5a7534c398c533bbca8cb18f07edb4b60bf6a1e1bd59
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7e37180758a087d27cd315d8292d12c125ee806de158652f2a6692776b3db942
MD5 01b94940c6fe7e08bc68496be3b9d042
SHA1 fae7eff802540046cc69ec99a94cb08de9ea8b2e
SHA512 29ef887e63c562c3f0e85927c010807074e4bebab263aafe5276b41cde214cd348db857841d263e161cfd22d086cb2b4e6434adaf0187c7ac060bc604dcfafaa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 300012a5c5eec47c38319addf7f3b7734c41cca30d0ebc6ec0b6d9fedf2d44a9
MD5 28c111f4f5a9a5f14bdff9b08fd1f622
SHA1 53bf4e8b92be3009a0def6445a4438cb94ee549e
SHA512 7d7bdea7ed435d13162c9e6d0838ef67b05e403167cefd5d9f5b36467911cd8272794831e12b2f2f3f62276abcfdd8c92b49aa4093df89a91ff551e2c3d95cb0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5ce1444c029b32dd577a6f745addb30557755c17739a693e77967296b8e73f32
MD5 34a6f3ad47ce01a62390e7eb5e5bab42
SHA1 0e672c1b8e415c8f7b3d7852ab4c022cbd0fd739
SHA512 0bfacc1939b4d6996a0a0bcaeb46bad3a42b8e9827be189e8622ce3bfd41ae3c438f7ee95aba87264fe1535fe65aa415069388862e122683a5cff3f978be4a9e
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 75bb3c43c137a9719e4de27a0a77f831c03a9325f7252af1f62e74ecf83f9942
MD5 087149d05c18a783734b8b7921f8e888
SHA1 e94dc1d17bdd9987270dfbe774bbc77f83125245
SHA512 dd0092ae376417ed4962b9801e569b6834a015e35c1e01e36e71fb052f1de2fa6db18c7815fafa9a0ab2f8b0f02e0e9cf0c132679f1c61c32eaa71074368d094
MD5 SHA1 SHA512

Submit Download

svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCBACBABCAAAABACBCBBBCBCABBCCAABCBCCBCBABCABBBBAABABAB.exe
Size 13.2MB
SHA256 2e3309fc02534913998fdac6425c93b8d7247a6d5bdbfc92da94b5e8283fd890
MD5 8669198f536452f22dfdf2e089ddfe24
SHA1 bea0396e0ef2c945faa6a2504fece6fb947559eb
SHA512 ee4950a660617820a1d02fefd773320311b8da912da42195893247d68a3eb4fea7446f1443a8e6d26628239a1a2068dcbe7cbcca171af6b908ba5ec7f5742f15
SSDEEP 49152:U+ES+E2+ES+ES+E9qatglI+ES+Ek+ES+ES+E2+ES+ES+E9qatglY+ES+E2+ES+Eo:oY1Y1Y1Y1Y1Y1Y1Y6
TLSH
T1A8D64B45F94380B2D82B01B14CCBD3BF4B70BA158B129EEBF74D876EA933BD06625255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 9e5bc6ddecefeae34046c1fef3e3f881091e772522ce6adfe7ab65a538366a8d
MD5 a9ed88ce4d1b6fb69cd4891929d0fabf
SHA1 e5581a674d4a80dad110cd655abf2e4082a316fa
SHA512 17506940d4c6cfa1e3ac7b26e949521e43950d4d097cf1648f4899352ec3c4768cfe697675a795389bdf60cfff9d39fbac223f16ededc89284ac282af9b2271d
TLSH
T1D111C451E8E99C27E93324CF512FDAB30C943B9BBC9CAA941248411D6B85D32CD990E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1584-79-0x0000000000420000-0x0000000000441000-memory.dmp

Download

memory/4100-0-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/4100-8-0x0000000000A70000-0x0000000000A91000-memory.dmp

Download

memory/4612-32-0x0000000000E20000-0x0000000000E41000-memory.dmp

Download