01d74f282a2c9251b7167fb6727ff90a8c4c583dc8661a83f78ce869dfcb3da3

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe
Size 10.4MB
Sample260814-e1dslsvtf1
SHA256 01d74f282a2c9251b7167fb6727ff90a8c4c583dc8661a83f78ce869dfcb3da3
MD5 5733030ced9b813bafd02c754e0c06e6
SHA1 44770f0e7a77d693a3210077ffc655752c447ebb
SHA512 3fc41fd01d64a8f2224ba192b1f610c84c8c7d7c656905240d4bdc8425fdce91b6baf6f3f20ab8c6d26b95f5d3ce61931fb6a07c8b760bb800bdf346eadbaa8d
SSDEEP 49152:U+E9B+ES+E9B+ErpqatglBy6i1zuajsaup+E9B+ES+E9B+ErpqatglBy6i1zuajU:1ItoItoItoItoItoItoItoItD
TLSH
T1F3B66D0AF69940B1D47B4170895B82BBDA70B8315B129ADFB354C37E5F33BD0AA39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1888	svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
2744	svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
6668	svchost_CBCAAAACCBAABABCBACBCACCABBACCCACBCCBACCCBABABACBAACBBC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CACCCBCBBCACCCBCCCCAABCABBCBBBCABCBAABACACBACAACBACCABBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe"	2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCBBCACAACBCABCCAACACAAABCAACCCCCCBCCCCACAABBABABCBBCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBCAAAACCBAABABCBACBCACCABBACCCACBCCBACCCBABABACBAACBBC.exe"	svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
6616	sc.exe
5500	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3292	cmd.exe
5812	cmd.exe
1568	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBCAAAACCBAABABCBACBCACCABBACCCACBCCBACCCBABABACBAACBBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4228	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3688	2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe
3688	2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe
3688	2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe
3688	2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe
1888	svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
1888	svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
1888	svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
1888	svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	1888	svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 3292	3688	2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe	94
PID 3292 wrote to memory of 4228	3292	cmd.exe	96
PID 1888 wrote to memory of 6688	1888	svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe	99
PID 3688 wrote to memory of 5812	3688	2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe	100
PID 5812 wrote to memory of 5500	5812	cmd.exe	102
PID 3688 wrote to memory of 1568	3688	2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe	103
PID 1568 wrote to memory of 6616	1568	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_5733030ced9b813bafd02c754e0c06e6_amadey_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBAACBABACABCBBAACAACACACAACAACABACCCCBCBCABCCABBBACACBAAABCACAACAAACABBBBACABBABBCAACCAAAAAAAABBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3292
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBAACBABACABCBBAACAACACACAACAACABACCCCBCBCABCCABBBACACBAAABCACAACAAACABBBBACABBABBCAACCAAAAAAAABBCBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4228
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BACBBBAAACBCCCBCBBBAACCAACAAAABBBAACABBBCAACAACAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe" start= auto displayName= "UserDataSvc_BACBBBAAACBCCCBCBBBAACCAACAAAABBBAACABBBCAACAACAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5812
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BACBBBAAACBCCCBCBBBAACCAACAAAABBBAACABBBCAACAACAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe" start= auto displayName= "UserDataSvc_BACBBBAAACBCCCBCBBBAACCAACAAAABBBAACABBBCAACAACAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5500
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BACBBBAAACBCCCBCBBBAACCAACAAAABBBAACABBBCAACAACAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BACBBBAAACBCCCBCBBBAACCAACAAAABBBAACABBBCAACAACAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:6616

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:6688

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
1⤵
- Executes dropped EXE
PID:2744

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAACCBAABABCBACBCACCABBACCCACBCCBACCCBABABACBAACBBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBCAAAACCBAABABCBACBCACCABBACCCACBCCBACCCBABABACBAACBBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:6668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RemoveRestart.exe

Path C:\Users\Admin\Desktop\RemoveRestart.exe
Size 384KB
SHA256 75fa6278baa36ee2eda683a087f0b92bda0471dc890d078fb50effb75cb59d6f
MD5 0a64331e9ec9e7b70ca0b8d3407465f8
SHA1 240a001d6dd09f6c7716b7cbe06482045595fcab
SHA512 434dace7f64acd4fa1e50900e9e542e1f3a24bc6765e0bb86ca9a0106e8e977c3de76aa008f2283402f45e2938513a7cf95189d5ec8843b993138db56ee5ff2d
SSDEEP 6144:m+dTTUFgEs3XojAdkNV43Wb+dTTUFgEs3XojAdP+dTTUFgEs3XojAdkNVC:mgUFgEsnojAeCGbgUFgEsnojA9gUFgEW
TLSH
T193841905FECA44A5E57752B04DEBD2BE8530BA258712C9FFF609874E6833BD09D34622
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RemoveRestart.exe

Path C:\Users\Admin\Desktop\RemoveRestart.exe
Size 1.2MB
SHA256 20b09eda633b9e69214fb6ddc9d444c901f909a4efed2b84c3fd25679d99cace
MD5 c33e35becb5613b124293e51caa966d5
SHA1 1e4771519159123657f54e8df576274a804c7301
SHA512 2cdaad87efdf52ed841b6393bf188163ea53b1228865a88963176a56fab2cd1d14533fa1cb1423a46629071a99825a5877875e43e594f854c524aa06b91e0c1a
SSDEEP 24576:m9+EM0Hb9+EM0q9+EM0Hb9+EM0qyLCkxqatgl8bAy6i1zuxw7ljsam:U+E9B+ES+E9B+ErpqatglBy6i1zuajsr
TLSH
T171457D06F68940B2E47B4171895BC2BBDA70B8215B119ADFB354C37E6F33BD09A39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e55ae918d6ca7596f793d79bc6726f366f7d1dbd48fbfa0edfae943437deb4ab
MD5 1070b5fc2145a9adce4960594d1b5c1c
SHA1 6a1599097fb848d1b9f2f93c9777528caee24342
SHA512 680e898a897bf39c5868ff4a658783a22c3d5e7593a6bd975303dbe8ed920cb8664930ee795d383700eda810a96f742554423c2f8403d557ae6d2eb651df771d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2fc7f872817a694e6b092551406cc25e5b1c2513ebcea7d01ab846f3b6b96ace
MD5 b65484b9731e95d80344089603091153
SHA1 c2f70f9c91a97003414c15fd16d1e74458db21d4
SHA512 60f2ad1c2c5c28e2a2e319203877aba2b70433ad743929e7303a80773f0778a6a278cb80c4d29ecac6e5fe8da6a82c3ae85621112c1134d6fa7de388919d6e89
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b12886e9a86d81365fa136a504fc6c7a017dba658726ac8b25463c240e9335f6
MD5 c4f70c9deff6a7ecc63850c2c22ae665
SHA1 7e54bedcc6c79202abd7314894dc9f6eddabdf97
SHA512 16f54bd7cf3777245a128c75d3a1a3e7f79a3dd0cebe4305d69908d1bb47fbd6261a49e508b7b1de9598fe77bc769aee54faea61c48d44ae34b1cfc10286f615
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2677f03c7a86097da9e39cb9a08b13ab98348b05ab5238ef78d2dbd779f373c2
MD5 02fdbc4a8448e5eb59f14136dd1c3fe7
SHA1 9297dde3d19a5212a9ad3356f7c5b2ad24407873
SHA512 7bf511d6cbd561912bfaac21d26a2c6d8cefc46f97572b6d331425aab22a7d5dfc8cf92c06c3c3f3f523d7e82d3df45cb83259594b7d11d554a1866e21467178
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6b2bc1edaace58b189601791a6498546e227f14d84ec09db3b018f38968fb238
MD5 3945f39b2a49c6d3275fd03e8287969b
SHA1 191abd24fa1142888aa5cff444f2fd58651e159d
SHA512 31fcdab7edd7ad4f842aa6b3ec859b7eea48ca6c268a78236d5b7e0c87c3656b5c42bf02ea4ad1a9bc0c6b1eb962dd8c7164e3a1e84b58ec025bc2927c7c5303
MD5 SHA1 SHA512

Submit Download

svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBBCBCCBBCABACCBACACBAAABBBCAABBCABCBCBBBBABACBBABBAB.exe
Size 10.4MB
SHA256 01d74f282a2c9251b7167fb6727ff90a8c4c583dc8661a83f78ce869dfcb3da3
MD5 5733030ced9b813bafd02c754e0c06e6
SHA1 44770f0e7a77d693a3210077ffc655752c447ebb
SHA512 3fc41fd01d64a8f2224ba192b1f610c84c8c7d7c656905240d4bdc8425fdce91b6baf6f3f20ab8c6d26b95f5d3ce61931fb6a07c8b760bb800bdf346eadbaa8d
SSDEEP 49152:U+E9B+ES+E9B+ErpqatglBy6i1zuajsaup+E9B+ES+E9B+ErpqatglBy6i1zuajU:1ItoItoItoItoItoItoItoItD
TLSH
T1F3B66D0AF69940B1D47B4170895B82BBDA70B8315B129ADFB354C37E5F33BD0AA39B11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1888-34-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/1888-52-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/1888-73-0x00000000003D0000-0x00000000003F1000-memory.dmp

Download

memory/3688-33-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/3688-22-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/3688-11-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/3688-59-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download

memory/3688-0-0x00000000005B0000-0x00000000005D1000-memory.dmp

Download