35769b50e054db88c55a8ec7bbf0ac1ea46eb51dcdcd0785a4e5d4c2b5edd1c9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
Size 6.1MB
Sample260814-e328zsfb99
SHA256 35769b50e054db88c55a8ec7bbf0ac1ea46eb51dcdcd0785a4e5d4c2b5edd1c9
MD5 50bac616ec1d97d20e59009930e8e338
SHA1 65861a02aff9996f421b88a221b07d6b09141413
SHA512 c3081b0557ebf5d3b318bb43f7c058cf8591d98568971bde8ebf17c5cb534bec4b6145012e3768bc443b4c2a4cdc1a54b99ec19885b7bd896b2be1f1cbf90cbb
SSDEEP 49152:U+ES+ES+ES+ES+EPqatgll+ES+ES+ES+ES+EPqatgll+ES+ES+ES+ES+EPqatglV:YMMMMMMMMW
TLSH
T1FA564A45FA4380B2D82B017148CBD3BB4B70BA158B129AEBF74D876FAE337D06635255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2728	svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
852	svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
4208	svchost_ACCCBBCCCBCBCBBAAABCAABACBBABBAABCABCCAAAAABBACBCCAAACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACACCBABACACBBAABBACABCBBACBBAACACABBBCCABCAABABCCBACBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCBBCCCBCBCBBAAABCAABACBBABBAABCABCCAAAAABBACBCCAAACC.exe"	svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_ACBBCCABBBBBABBCBBBCAABBBAABBCABBCACBBACCBCBABBBABCCBBCB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe"	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1980	sc.exe
900	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4620	cmd.exe
1200	cmd.exe
2176	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCBBCCCBCBCBBAAABCAABACBBABBAABCABCCAAAAABBACBCCAAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2396	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
632	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
632	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
632	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
632	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
2728	svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
2728	svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
2728	svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
2728	svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	632	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	2728	svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1656	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 4620	632	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe	103
PID 4620 wrote to memory of 2396	4620	cmd.exe	105
PID 632 wrote to memory of 1200	632	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe	110
PID 1200 wrote to memory of 1980	1200	cmd.exe	112
PID 632 wrote to memory of 2176	632	2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe	113
PID 2176 wrote to memory of 900	2176	cmd.exe	115
PID 2728 wrote to memory of 4472	2728	svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe	117
PID 4472 wrote to memory of 3700	4472	notepad.exe	118

C:\Users\Admin\AppData\Local\Temp\2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_50bac616ec1d97d20e59009930e8e338_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:632
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABCCABABABCCBCACBAABACCCABBACABBACCCBABBABBCBABAABABCBAABABCAACCCAAAACCABBCCBBAACBCCABAAAABCBAACCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBCABCCABABABCCBCACBAABACCCABBACABBACCCBABBABBCBABAABABCBAABABCAACCCAAAACCABBCCBBAACBCCABAAAABCBAACCBBB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2396
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACABCBACBAACBBBCBBBBBBBCCCCABCCBBBCCBACAAAABABBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe" start= auto displayName= "UserDataSvc_CACABCBACBAACBBBCBBBBBBBCCCCABCCBBBCCBACAAAABABBBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1200
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACABCBACBAACBBBCBBBBBBBCCCCABCCBBBCCBACAAAABABBBBB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe" start= auto displayName= "UserDataSvc_CACABCBACBAACBBBCBBBBBBBCCCCABCCBBBCCBACAAAABABBBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACABCBACBAACBBBCBBBBBBBCCCCABCCBBBCCBACAAAABABBBBB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACABCBACBAACBBBCBBBBBBBCCCCABCCBBBCCBACAAAABABBBBB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:900

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3700

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
1⤵
- Executes dropped EXE
PID:852

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:1656

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCCCBCBCBBAAABCAABACBBABBAABCABCCAAAAABBACBCCAAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCBBCCCBCBCBBAAABCAABACBBABBAABCABCCAAAAABBACBCCAAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c48831ecd6a696ca2e0bf5008e743cab0679807b2592c89e1b980abd9e565fb1
MD5 5efc553fcd635766e8e6021532610aac
SHA1 d19e3a75d9f473d375ee5084aeec8bc782c0ca27
SHA512 cf4c3fe85d1091504c566614c962e8abbbe3fc8cf0ce4341e72a08fd0fd4bca0104b2db8b78e31f81d6dfa62221e39f9371a1e573b3c28aeae1d33f7613d0a45
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 17a888cddb044d0300485bad805015449b63c814a457fe8a6a7547e477514438
MD5 74fca49977c7de5dfcedda83e90e34e6
SHA1 0e9e8e10f28c06cfd83a953c975417c94ef966f0
SHA512 cf3a5f386e57a138935f1842fa206f4cf1c5063373369f1dd8b08558bea71e292e5880a5c85cc797f8a4eda199d0b0c2480a4b842f06b32690ef82b665e5a391
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 b4841756da7316cbf2c2a5d3592e5fb06e4e501dc30530fe37c36ceeefdb6e00
MD5 ec39d84d410015ff0605a475dec05fe4
SHA1 646c1e334b8d5ad21418b217476402bc2dd2d774
SHA512 88b3ac6c1e315e7a95b2812855d6f0d6105ed09c0ab6d29be7425cc578ade6e2514c4ee5618d6487e5cc418531088c8bde54fd99087014974aa39d0189e678cb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1b189369fb1410f5481b5d69a08e8375b787212e2df1618f185b62faed4207fa
MD5 3522cacdc3a3f3a5737aa62802ace1e7
SHA1 f74932595a58604568ae70531f6e937019b31180
SHA512 9943cbc8f0c8099f8013d641c32f9c4863d7c30a956d438a03df4a412ece58b6096fba9dc46f080abc5d7e9ea6d02f1cde9b7bd96277e122885842c0a43cec62
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 8600a07a09db9f9f2509afa230ec1aa17a99171405c8286a5dbbae24076337c6
MD5 00401611500ccd8f4e112cd77a1350b5
SHA1 e2026d415173ebe5220ec9fb3257aad8e45894a4
SHA512 662f25d71eac3540d18750dfe56d15f4c98b8bad3ebeef4dfd4753a04cd4667ea62b53552f51816bb918310b8a77ba2177238bde6ba03fee1c75a31002815270
MD5 SHA1 SHA512

Submit Download

svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCABACBBAABBCCBACAAACBCACBABBABACABBAABACABBACBCBCBBACA.exe
Size 6.1MB
SHA256 35769b50e054db88c55a8ec7bbf0ac1ea46eb51dcdcd0785a4e5d4c2b5edd1c9
MD5 50bac616ec1d97d20e59009930e8e338
SHA1 65861a02aff9996f421b88a221b07d6b09141413
SHA512 c3081b0557ebf5d3b318bb43f7c058cf8591d98568971bde8ebf17c5cb534bec4b6145012e3768bc443b4c2a4cdc1a54b99ec19885b7bd896b2be1f1cbf90cbb
SSDEEP 49152:U+ES+ES+ES+ES+EPqatgll+ES+ES+ES+ES+EPqatgll+ES+ES+ES+ES+EPqatglV:YMMMMMMMMW
TLSH
T1FA564A45FA4380B2D82B017148CBD3BB4B70BA158B129AEBF74D876FAE337D06635255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/632-6-0x0000000000340000-0x0000000000361000-memory.dmp

Download

memory/852-74-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/2728-25-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/2728-38-0x0000000000060000-0x0000000000081000-memory.dmp

Download

memory/4208-82-0x0000000000670000-0x0000000000691000-memory.dmp

Download

memory/4472-67-0x0000000005700000-0x0000000005701000-memory.dmp

Download