6a25ec83f39c490fdbc8091266fb3c1d13891669fc3a3dee8a446bcf58a20feb

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 02:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
Size 18.8MB
Sample260813-dc448azfrd
SHA256 6a25ec83f39c490fdbc8091266fb3c1d13891669fc3a3dee8a446bcf58a20feb
MD5 f15ebd0e87302c320e5cb18e2a87e639
SHA1 3121cd871db395ed909662915136a4164ce792cf
SHA512 7c45e9f666deb0bea6fe58ba8c45756d334330a587ed8617839d91cf8190d833ab5e0408ae64be76c6b7bcace77d2d761da7b252aae31d33cf06f20e4c585bc8
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+Et:O++++++++b
TLSH
T105172A09F94340B2D92B11B14CCBD3BF8A60BB2587128EE7FB4DCB5F6933BA16429155
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
256	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
3012	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
896	svchost_ACABAABACCCBABBACCAABCBBACAACBABABCACBCBCABBABBABACCCAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCBAAABBCCCACCCBAAAAACACBBCBCCABCACBCABBBABCAACABBCABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe"	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CAACCCCCCCBBBBCACABCCACBBCCABCBBCAACBBCACCCABABBAABBCACA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABAABACCCBABBACCAABCBBACAACBABABCACBCBCABBABBABACCCAB.exe"	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4300	sc.exe
6036	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5396	cmd.exe
5900	cmd.exe
4120	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABAABACCCBABBACCAABCBBACAACBABABCACBCBCABBABBABACCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2380	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4564	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
4564	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
4564	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
4564	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
256	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
256	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
256	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
256	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
3012	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
3012	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4564	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	256	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
Token: SeDebugPrivilege	3012	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 5396	4564	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe	92
PID 5396 wrote to memory of 2380	5396	cmd.exe	94
PID 4564 wrote to memory of 5900	4564	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe	95
PID 5900 wrote to memory of 4300	5900	cmd.exe	97
PID 4564 wrote to memory of 4120	4564	2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe	98
PID 4120 wrote to memory of 6036	4120	cmd.exe	100
PID 256 wrote to memory of 2068	256	svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_f15ebd0e87302c320e5cb18e2a87e639_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCAACCBCACBBBBACAACCCACCCACACBAAABCBCBBBCCBCBBCAABACCCBBBCBCACABCCCBCACBCBBCBAABBAAABAACBCABCBABCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCAACCBCACBBBBACAACCCACCCACACBAAABCBCBBBCCBCBBCAABACCCBBBCBCACABCCCBCACBCBBCBAABBAAABAACBCABCBABCACBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2380
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABBCCBCAABABBAAABBAABCABACCBABABBCBBABCAABBCCBBCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe" start= auto displayName= "UserDataSvc_ABBCCBCAABABBAAABBAABCABACCBABABBCBBABCAABBCCBBCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5900
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABBCCBCAABABBAAABBAABCABACCBABABBCBBABCAABBCCBBCBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe" start= auto displayName= "UserDataSvc_ABBCCBCAABABBAAABBAABCABACCBABABBCBBABCAABBCCBBCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4300
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABBCCBCAABABBAAABBAABCABACCBABABBCBBABCAABBCCBBCBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4120
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABBCCBCAABABBAAABBAABCABACCBABABBCBBABCAABBCCBBCBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6036

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2068

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3012

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAABACCCBABBACCAABCBBACAACBABABCACBCBCABBABBABACCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABAABACCCBABBACCAABCBBACAACBABABCACBCBCABBABBABACCCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\ProgramData\Microsoft\Diagnosis\CustomTraceProfiles\qap`g`v~dtlq
Size 10B
SHA256 7352e078cf940e2edf736c24d8f4571ab84fc5d998ac90f513c9e1a7efb82a7f
MD5 c2badd899c812bbf212a91571cfbca11
SHA1 ccca6c0c900cfa64b5f52c796a8528fc1d7e0c24
SHA512 fb6664bbcffc38749c4de1a46d76997c719644c1dd264ba62b6dacd5666c4e99a6fd621aa02411df66b63154274d09f42609e72702c1ae7119efbcc0160e3c3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 47386e3a46e2c039f122876d9042b0f8d5acfa0c01a6c4a2087b9dfabd2a8a10
MD5 82921471657928a72f70475bb219fb3e
SHA1 8760bcf557d25b43f5ee313faab44ad479ee5738
SHA512 851ea08d315be73110ee298ac06d54a57a2b90681369a6c57100284eb7ec59503f915e72ee65f9030ed34395262bd36daa6374525fa0aec3ad7c5eddaa187d08
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62103498884b52b4b525b4df29150e3fb59328a634d57c7fe2348e2c005c7684
MD5 8312ddd10cdb3de8296a6032e49b81b3
SHA1 f501870275fff5cf47b0dd846327327e5667f41f
SHA512 9dd273bba6c487d06bb22e8f25180f79ad669ef17b0e57754f991c0e5d7c69ba9790061c4cd72a09f65965031b55e98f91113fa3522ee416ac8495b30906f8f4
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a01aef37e048cf5b9275916c1347ad2de9e40b6ef1475a5768fab8de3c626201
MD5 0686994866bd9ed95eef2d9822f2ec74
SHA1 ccf99850f0f34ab81fe3378bf206bf15dad1dd1d
SHA512 cc9cda15994f0ff295605cf1d26a89d3f13f39adbc99489bfbbbd61a5fa4261b301070d3f146327ea6c7cfb47f6b96b4a7265e88f23150e41e786c6549186513
MD5 SHA1 SHA512

Submit Download

UnprotectWait.exe

Path C:\Users\Admin\Downloads\UnprotectWait.exe
Size 56.8MB
SHA256 aac81f2077b98830314c4012e55e66cfb09cac9f399382a5b88d1e4db2a49777
MD5 93cc348a0a061caafcea330e6b5a0cda
SHA1 e1e7bc7808274192973a359fbcfd925575a3381f
SHA512 23a885232659b5fe46dbf3e39327849bdf5f8fd75a19e83683efcca071ae15c67a77a15bbc36cb7841a4b197a0cf9ccb1eca0c33ebde19b6fd8530b320958b5a
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+EJ:O++++++++C++++++++C++++++++C3fof
TLSH
T19AD72A09F94340B2D92B11B14CCBD3BF8A60BB2587128EE7FB4DCB5F6933BA16429155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3e69733f333fd1297e4e32780ea40e967a2a104ff58b7b87c110cff39d001ebf
MD5 6cc67939b7d155b54ce4cb1db62bad81
SHA1 c7c1ad8e79f08d16e0e22079055e2a64477b3a55
SHA512 23272bbf9ef51301bbd9d01e5f3d1597b3c23d228f49ee1014cf4006dfb3203bcda18b375a879c617f76262ac5d5204b26ce677ecd4a37230cd02de0c16d02cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 08804aed1347b8615b84267fbf046cb7ea165eadfaddde2067cb70bba25ee071
MD5 ead034d3c46536a52ca01295e5e9a1de
SHA1 dd8a4120d232be5edd8ce3506a99bac64e2c96dc
SHA512 738a431ba8e13705b733d9c62cf0a48fb5603c09171125c29ace6ba23d2767137bbe76ab980ff09d9de64f8b24fed4f2eb547c73e143e3caec7c6c03c7f86e6c
MD5 SHA1 SHA512

Submit Download

svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCABBABCAAABABCCABCBCCBBBBCCACBBCACBCCAAAABABBCCBCABCAC.exe
Size 18.8MB
SHA256 6a25ec83f39c490fdbc8091266fb3c1d13891669fc3a3dee8a446bcf58a20feb
MD5 f15ebd0e87302c320e5cb18e2a87e639
SHA1 3121cd871db395ed909662915136a4164ce792cf
SHA512 7c45e9f666deb0bea6fe58ba8c45756d334330a587ed8617839d91cf8190d833ab5e0408ae64be76c6b7bcace77d2d761da7b252aae31d33cf06f20e4c585bc8
SSDEEP 49152:U+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+ES+Et:O++++++++b
TLSH
T105172A09F94340B2D92B11B14CCBD3BF8A60BB2587128EE7FB4DCB5F6933BA16429155
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 355f349f35a9efefd9f8d7c0927c76882ea1954bbcc5223a582ba9953ffdf564
MD5 59e4c8fdbfe11db631b8dc69e9df7297
SHA1 e65314ec117d75d16b2d06105c8946f420c94dbb
SHA512 a57e3007c3129bf1fec6557d7f8140e370f2afdb18c126703f4486cc840eb0c01826882f0499e414da5c034b4b9374fbe72883a0fe7dd584d3e66c22f503e10a
TLSH
T1F1112B30A4F5C8D3ED32A5877D3ECAA30CE4339B989C6A08634A511DBB94C71CD154D2
MD5 SHA1 SHA512 TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\qap`g`v~dtlq
Size 10B
SHA256 f34d8bec67af27faf6bcdb97e88c1fe61cde97a0cc124beba4d14dbf85cf5524
MD5 87f7ee83756bcd9df1d8673768a97b1c
SHA1 184b18bb728f8a7fb979361ba78f5d92c34aa832
SHA512 3c0b8f6a1e526d147fadd365473ea0ea8b039b42920be000755d866fe56cc516db8ecb6f778fe44ba49fe1c9e93591c888f499f6955f6d432241f942188d34d4
MD5 SHA1 SHA512

Submit Download

memory/256-96-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/256-71-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/256-50-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/256-32-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/896-95-0x0000000000B60000-0x0000000000B81000-memory.dmp

Download

memory/3012-87-0x0000000000E10000-0x0000000000E31000-memory.dmp

Download

memory/4564-83-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/4564-10-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/4564-21-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/4564-59-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/4564-33-0x00000000000F0000-0x0000000000111000-memory.dmp

Download