64ecc66ac9f0ae4b1ab58ed06be80bef4c120f9afed3373351f92c978381416e

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe
Size 10.0MB
Sample260814-bxtg4ssdmf
SHA256 64ecc66ac9f0ae4b1ab58ed06be80bef4c120f9afed3373351f92c978381416e
MD5 a960fc28027d4e2a400ad78172faafab
SHA1 7e05903b62cee379b5a3261fad13ac218d52086f
SHA512 1832eead66a60ed749359a38dd5e176e15fb5614884bd9ff6dafde8debf5c99217dfebfb291cf3b3a24ed2128b101c59d8d45c10b353c115a2ebf10129552d92
SSDEEP 49152:U+E9oqatglJ+E9B+ES+E9oqatglw+E9oqatglJ+E9B+ES+E9oqatglw+E9oqatgE:1QgQgQgQgQgQgQgQgQM
TLSH
T148B63B42FF8984A2E477027148AB82B75B70BD154F12D6EFB348936E5D337C0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5952	svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
2392	svchost_BAACACCAACCBAABABACCAABABBBCCCACCCCBCBAABAAACBCCBBABAAC.exe
1208	svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBABAABABABCCACCCABCBCCCBBACCAABACCABBACCBCBACBAABCCBCBC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe"	2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAAACCABBCACCBAACABCACCBBACBCAAAABCBABBBBCCAAACABCBCBABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BAACACCAACCBAABABACCAABABBBCCCACCCCBCBAABAAACBCCBBABAAC.exe"	svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4652	sc.exe
4448	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2448	cmd.exe
3068	cmd.exe
3408	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BAACACCAACCBAABABACCAABABBBCCCACCCCBCBAABAAACBCCBBABAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4200	2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe
4200	2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe
4200	2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe
4200	2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe
5952	svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
5952	svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
5952	svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
5952	svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
2392	svchost_BAACACCAACCBAABABACCAABABBBCCCACCCCBCBAABAAACBCCBBABAAC.exe
2392	svchost_BAACACCAACCBAABABACCAABABBBCCCACCCCBCBAABAAACBCCBBABAAC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4200	2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	5952	svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
Token: SeDebugPrivilege	2392	svchost_BAACACCAACCBAABABACCAABABBBCCCACCCCBCBAABAAACBCCBBABAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 4200 wrote to memory of 3068	4200	2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe	92
PID 3068 wrote to memory of 4688	3068	cmd.exe	94
PID 5952 wrote to memory of 1140	5952	svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe	95
PID 4200 wrote to memory of 3408	4200	2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe	98
PID 3408 wrote to memory of 4652	3408	cmd.exe	100
PID 4200 wrote to memory of 2448	4200	2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe	101
PID 2448 wrote to memory of 4448	2448	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_a960fc28027d4e2a400ad78172faafab_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4200
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAAAAAACBABABACACCBAAAABBCBACBACBAABACBBCCCCBCABCCBCBBACACABAACAACAACBCBABCBBBCBCCBCACBABCAABACCCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCAAAAAAACBABABACACCBAAAABBCBACBACBAABACBBCCCCBCABCCBCBBACACABAACAACAACBCBABCBBBCBCCBCACBABCAABACCCCBCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_AABBABAABCBBBABACAACCBACAAAACAABCACACACBBBCABBABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe" start= auto displayName= "UserDataSvc_AABBABAABCBBBABACAACCBACAAAACAABCACACACBBBCABBABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_AABBABAABCBBBABACAACCBACAAAACAABCACACACBBBCABBABCCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe" start= auto displayName= "UserDataSvc_AABBABAABCBBBABACAACCBACAAAACAABCACACACBBBCABBABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_AABBABAABCBBBABACAACCBACAAAACAABCACACACBBBCABBABCCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2448
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_AABBABAABCBBBABACAACCBACAAAACAABCACACACBBBCABBABCCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4448

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5952
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1140

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACCAACCBAABABACCAABABBBCCCACCCCBCBAABAAACBCCBBABAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BAACACCAACCBAABABACCAABABBBCCCACCCCBCBAABAAACBCCBBABAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2392

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
1⤵
- Executes dropped EXE
PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bfd840664a0aa0156d0731538ad51fd2745f8ce282fbeaccb91f5d7ae1d434be
MD5 d9aba11c6c262d5f9d4eed947767dbec
SHA1 69e844dce612764a2e2cb6a1206fb8ce75311cfe
SHA512 df5c575d44eb580ee713d40309a2de0bd69350ea98d08456d7f94f49fdeca5cffa6b62d134ff455a84aa90df0e55de6b66d6c2d6fae2ba99deaadcbfaf3f7556
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 eced9b94e3ee87bfe033482d8ea309242ca6addee922a8bbd25aa55b1d2b9b23
MD5 bf66141cd99312a3cf37bf62b68731ae
SHA1 43039439b20743475bd6e0402deceaf794b06e7f
SHA512 b73be2f4e0d1851dca1fd2e1853e03b1f38224f0d6e23c3282bc8295895bb9d2eea61fbdd4df6e0521f5088956ca9d3b01f401236ab96904dfc00f88b1c37c80
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 714d6311813cef10a689986bd35c4f4d7b1cd7864a1ee8bc4262f99da86841a1
MD5 2676b306a0341f43dd6bba18143fd47b
SHA1 440091dfc6308fdb9bfb309c506e4e5ef4a734cb
SHA512 9ef68a40682f3b4918d5faf4bbd6375c3a07f99998c07d0ef728304d7213a79e19a4768725e8ee6cfee3c30af78bc4f533452eb8618fd1ab3f65384c0685ca9d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a30b0cc21c97adabfe5f2781e249f08a5f660d55f701f392c90503aa3fec1c9b
MD5 5f25f1a9eccc6bc2cee68f5bdf5b5e29
SHA1 cbb148003208886454b30d3d122facc509dbf786
SHA512 e047c49fe262e21eb398e054321a868aac2196d6dd71754a99508c56ba11719fecd45285fcf171ec4753f9418237ac734d6017017c4cce3026cf08a3374de291
MD5 SHA1 SHA512

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 30.6MB
SHA256 baccc436cd072235d17d61fba07e2988ed1487fc23d972ab81b9fe8337c84149
MD5 e4dca01c625b1056e6a72a63b732d8b1
SHA1 bc672731bdb74d139dc4a2e97d7a87923a2e917d
SHA512 d442104b44a4c783f98216a6c979ae4807d1805c0bb6b5b1fc9306e6f3f913dade94ac9ca22f8f871aeef2fe758e30d4d1c3f78780f8ff831fb6fc1b787393a8
SSDEEP 98304:1QgQgQgQgQgQgQgQgQ6QgQgQgQgQgQgQgQgQ6QgQgQgQgQgQgQgQgQa2cyob:+cy6
TLSH
T19B673B42FF8984A2E477027148AB82B75B70BD154F12D6EFB348936E5D337C0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LimitStart.exe

Path C:\Users\Admin\Downloads\LimitStart.exe
Size 60.6MB
SHA256 1d76760fb2e7135588f200ef1bdc947da08e6157dba870ac8d5e9e1bd5a19b47
MD5 468f92f02b77c16436a32cb781354fa4
SHA1 6846f4138d14fc1d1b793251933b66c2f6d5ac98
SHA512 e38907a738ccd33d181add2be9d50ad2463f65e6d05cf4f6320398a64aab51f9b86dd674365ce847260b0116717d6f213ec28e87ac87cf309e00334a96bb287b
SSDEEP 98304:1QgQgQgQgQgQgQgQgQ6QgQgQgQgQgQgQgQgQ6QgQgQgQgQgQgQgQgQ6QgQgQgQgi:ucy9
TLSH
T199D73B42FF8984A2E477027148AB82B75B70BD154F12D6EFB348936E5D337C0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 532022472110c1d0be91ec533a0cad678d491634c4f4a519d19b698bd87ca367
MD5 05c5dfe0b855a30d4ceb6fc0ac4071e5
SHA1 428900e416881f728411420bf3b5f55b64f709c1
SHA512 a80d94806ab93d588657c5e651229a36ea41a90633ca6c658545f0a6136a512b8b3cef9fd2b37c1a4f82ac6b90f5c4c0148af20de81a20f1e8215732a65ad8b0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6eb518d25de919abca678e03fa2f851924c7f751a29d82923178fb8bec46acea
MD5 2c6201ceb2e8d4b04659da92f49a31d1
SHA1 2e3475e9d4f8ea26b68865ea859240373e48c7cb
SHA512 d1859015069446fcf806914952ec3ac0709e546c89ffdf5d1a40855990468a1c7c5e8992c30f2566b56f9795dd1b0a965c145d02ab4c4df7b60eaf7e3438df2c
MD5 SHA1 SHA512

Submit Download

svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AABBCCCCACCCAACABCABABAAABBCAAAABCCCCAAACAACBABABABBCBC.exe
Size 10.0MB
SHA256 64ecc66ac9f0ae4b1ab58ed06be80bef4c120f9afed3373351f92c978381416e
MD5 a960fc28027d4e2a400ad78172faafab
SHA1 7e05903b62cee379b5a3261fad13ac218d52086f
SHA512 1832eead66a60ed749359a38dd5e176e15fb5614884bd9ff6dafde8debf5c99217dfebfb291cf3b3a24ed2128b101c59d8d45c10b353c115a2ebf10129552d92
SSDEEP 49152:U+E9oqatglJ+E9B+ES+E9oqatglw+E9oqatglJ+E9B+ES+E9oqatglw+E9oqatgE:1QgQgQgQgQgQgQgQgQM
TLSH
T148B63B42FF8984A2E477027148AB82B75B70BD154F12D6EFB348936E5D337C0AB32665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 1d0fe4fda974e0e2151a8f4380b6f43d018972105f0e8e108e9dc81b7d7e2ed3
MD5 2b73b374840219335fa2b1851c459980
SHA1 442ef99087761524e8e2091399f5bddba6d5b6d9
SHA512 a227e8f27b33a0d08c0303b6ce97bf4ce394f62267a89e4ac42a0f1dfe62912c3ec46a56b5d1dda55f76be534802e0b776672776750741bc60916c289e06aa7c
TLSH
T1DA11B261E4E5D8B3F92329CF921E5B434CF4779F6C5CAA18120E422C6B89C30DD158F6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2392-107-0x0000000000D10000-0x0000000000D31000-memory.dmp

Download

memory/4200-12-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/4200-70-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/4200-0-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/4200-23-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/4200-48-0x0000000000880000-0x00000000008A1000-memory.dmp

Download

memory/5952-68-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/5952-71-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/5952-49-0x0000000000900000-0x0000000000921000-memory.dmp

Download

memory/5952-45-0x0000000000900000-0x0000000000921000-memory.dmp

Download