6fa94059b570bf7b607b174171e18a0c4aa7fc6646eaebf77f7e25663a7435a4

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 03:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe
Size 13.4MB
Sample260814-dytklsteph
SHA256 6fa94059b570bf7b607b174171e18a0c4aa7fc6646eaebf77f7e25663a7435a4
MD5 b60694b8ebc276a836147e48f23989dd
SHA1 e268c01b0aadb9dc87da1b5db52f8202aa074b6b
SHA512 22da81e1dc0b93310bbdd44aed43e29fb043a09f4d40f77c3492a1f0183302470b5bfb621dd031d4203bc77c93ee1358f34532f1dfe575eba0f3385214187421
SSDEEP 49152:U+ES+E9oqatgl7+E9B+ES+E9oqatgljP+ES+E9oqatgl7+E9B+ES+E9oqatgljPN:+SGSGSGSGSGSGSGSGSGSM
TLSH
T1AEE64D45FB8980B2E477027148AB82B75B70BD154F12D6EFB388A36E5D337C0AA31765
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1516	svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBACAAAABBCAAABCBBBACCABCCCAAABBBAABBABBCCABAABACAAACCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe"	2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2648	sc.exe
6092	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2864	cmd.exe
6020	cmd.exe
3268	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1820	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5572	2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe
5572	2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe
5572	2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe
5572	2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe
1516	svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe
1516	svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe
1516	svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe
1516	svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5572	2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	1516	svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5572 wrote to memory of 2864	5572	2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe	92
PID 2864 wrote to memory of 1820	2864	cmd.exe	94
PID 1516 wrote to memory of 4832	1516	svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe	95
PID 5572 wrote to memory of 6020	5572	2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe	96
PID 6020 wrote to memory of 2648	6020	cmd.exe	98
PID 5572 wrote to memory of 3268	5572	2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe	99
PID 3268 wrote to memory of 6092	3268	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_b60694b8ebc276a836147e48f23989dd_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5572
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBCCCCAACACBACABAAACACCABCAAABACABCABCABABBBBCACCCABBACCBCACCBCBCBBCAABBBCBCBCABBACAABACCCBABCABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBCCBBCCCCAACACBACABAAACACCABCAAABACABCABCABABBBBCACCCABBACCBCACCBCBCBBCAABBBCBCBCABBACAABACCCBABCABABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1820
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACACBAACCCABABCBCACCBCCACCBACCCAAAAABBAABACBBBAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe" start= auto displayName= "UserDataSvc_CACACBAACCCABABCBCACCBCCACCBACCCAAAAABBAABACBBBAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6020
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACACBAACCCABABCBCACCBCCACCBACCCAAAAABBAABACBBBAACC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe" start= auto displayName= "UserDataSvc_CACACBAACCCABABCBCACCBCCACCBACCCAAAAABBAABACBBBAACC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2648
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACACBAACCCABABCBCACCBCCACCBACCCAAAAABBAABACBBBAACC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3268
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACACBAACCCABABCBCACCBCCACCBACCCAAAAABBAABACBBBAACC"
    3⤵
    - Launches sc.exe
    PID:6092

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:4832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe
1⤵
PID:5196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ba8f3f9510ddb7b5f3ffabde1fb7c080b0a301b3f855addb34bb68fd746ff6c4
MD5 c7b31d0d0a8d209ce9e84d43efb1855d
SHA1 06186fd9bb5664b04d2491dd934db8766c44564b
SHA512 e76ebf15acc26a017a2a24860d756beb50ce5ce97a9b4d54a229946cbfd1eadb5120f0c2a4b676d7f77ba563fea26285f5cf7d34b76032c423e3e373214443cf
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7474df0381110b76d78ec11d8413af1fb99ff5865429fc7e5ce34e9f95471faa
MD5 74c2b5179ef4889cd84ba3b613e854f8
SHA1 8758f9ec867bee4162815a228f0c5f1fff7e61e3
SHA512 03f092e977870985e7a416d1114577fc5bbf3982251e7e3ac435ea428c868ffb815a6c6223d46929765b0f35d0a8376f2493dc54086a73e5e71bc30cd9828f7f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aa1cd4c096e16afa22fd10db03d68e8a4cc8bc2638e1c11ecbd36fd0489441b4
MD5 980c62c88037964ed595501295424b92
SHA1 234e061ff7bc066a6ea67959d861e16c74273b63
SHA512 196157b40e660c3bcb7de8db3474e8bd079a7337d642daf01b7b8ce5c880d5ba83c7592bea6bc4ccb4cd476c230f587ebd7c5b799f62c13882ab967f4e8588fd
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 ab2d22aee151b0d39915660efbc375ead1fbbc48686ce3c9e202d117f6073aad
MD5 03ef5830d5002dd4a0962f98e94b45d6
SHA1 a8269ef5dcd0add85aefd47045e62f4c7a7c9706
SHA512 34d64276f7f1f728ae6d9e067b6c022569706e3cab3ba29fe3556f58cb2e904f3a7900e772ea0c59f16ecb761f2c11117e8f809ff9a5ae3b7836274ffc03d40f
MD5 SHA1 SHA512

Submit Download

svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBABACBACCCACCCACBCACBCAABCBCCCBBCAAACBACACAABAABAAAC.exe
Size 13.4MB
SHA256 6fa94059b570bf7b607b174171e18a0c4aa7fc6646eaebf77f7e25663a7435a4
MD5 b60694b8ebc276a836147e48f23989dd
SHA1 e268c01b0aadb9dc87da1b5db52f8202aa074b6b
SHA512 22da81e1dc0b93310bbdd44aed43e29fb043a09f4d40f77c3492a1f0183302470b5bfb621dd031d4203bc77c93ee1358f34532f1dfe575eba0f3385214187421
SSDEEP 49152:U+ES+E9oqatgl7+E9B+ES+E9oqatgljP+ES+E9oqatgl7+E9B+ES+E9oqatgljPN:+SGSGSGSGSGSGSGSGSGSM
TLSH
T1AEE64D45FB8980B2E477027148AB82B75B70BD154F12D6EFB388A36E5D337C0AA31765
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1516-24-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/1516-37-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/5572-0-0x0000000000800000-0x0000000000821000-memory.dmp

Download

memory/5572-8-0x0000000000800000-0x0000000000821000-memory.dmp

Download