d10cd9d99c7ed1d588a8d3d50cfaabdf0f5e3d7c2898aafd5b8b683bc3a6b9be

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
Size 21.7MB
Sample260814-e3b2sscp5w
SHA256 d10cd9d99c7ed1d588a8d3d50cfaabdf0f5e3d7c2898aafd5b8b683bc3a6b9be
MD5 5332b8e10a1df2bc3e376e5d88e4c11a
SHA1 174acaec727285f300309191b38ddda149de48ef
SHA512 5270c4f3dee8d2694062368c22efc974f7f1fbde16f46efc3cd37b59509e0afc8149b9bdbcd84e8c94e2263ca35e01d8d900017b6f94d28630625d397fbaa4fa
SSDEEP 98304:irBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8:Y
TLSH
T16F376C0F32ED00B6D87F8275D6968156D670B43127226ADFA290C73D9F6BAC1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1440	svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
1568	svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
4160	svchost_BBACBABABBAABCABBBABCACBABABABCBABCBBABCBCCCACCCAACCAAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBBBAABCAAAABCBCABBCCCCCCBCAACBBCBACBCAAAAABBCCABCCBCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe"	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_AABBAAACBACCBABCABCCCAAACCAACBBAABCCCBABCABBBCBBCCACCAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBACBABABBAABCABBBABCACBABABABCBABCBBABCBCCCACCCAACCAAA.exe"	svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2076	sc.exe
1964	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3932	cmd.exe
2640	cmd.exe
2384	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3472	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3376	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
3376	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
3376	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
3376	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
1440	svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
1440	svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
1440	svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
1440	svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3376	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	1440	svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3268	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 2384	3376	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe	102
PID 2384 wrote to memory of 3472	2384	cmd.exe	104
PID 3376 wrote to memory of 3932	3376	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe	105
PID 3932 wrote to memory of 2076	3932	cmd.exe	107
PID 3376 wrote to memory of 2640	3376	2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe	108
PID 2640 wrote to memory of 1964	2640	cmd.exe	110
PID 1440 wrote to memory of 4752	1440	svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe	112
PID 4752 wrote to memory of 1432	4752	notepad.exe	113

C:\Users\Admin\AppData\Local\Temp\2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_5332b8e10a1df2bc3e376e5d88e4c11a_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAAABCAACBAACBCBBBAAAABBAAAAABBACBCCCABCBABCCBBACCAAAAAACCBCCAACABCCCACCBCBCBBABBAAABBBCCCBAAABACCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2384
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AACAAABCAACBAACBCBBBAAAABBAAAAABBACBCCCABCBABCCBBACCAAAAAACCBCCAACABCCCACCBCBCBBABBAAABBBCCCBAAABACCABB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3472
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CBAAACBBBBCBBBABBAAACABCCCBBABACBAAABACCACCACBCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe" start= auto displayName= "UserDataSvc_CBAAACBBBBCBBBABBAAACABCCCBBABACBAAABACCACCACBCCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CBAAACBBBBCBBBABBAAACABCCCBBABACBAAABACCACCACBCCBCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe" start= auto displayName= "UserDataSvc_CBAAACBBBBCBBBABBAAACABCCCBBABACBAAABACCACCACBCCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2076
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CBAAACBBBBCBBBABBAAACABCCCBBABACBAAABACCACCACBCCBCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2640
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CBAAACBBBBCBBBABBAAACABCCCBBABACBAAABACCACCACBCCBCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1964

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4752
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:1432

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
1⤵
- Executes dropped EXE
PID:1568

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3268

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABABBAABCABBBABCACBABABABCBABCBBABCBCCCACCCAACCAAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABABBAABCABBBABCACBABABABCBABCBBABCBCCCACCCAACCAAA.exe
1⤵
- Executes dropped EXE
PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 af2ed0d86f3efad0fa7c0f8b038a269d8f8cb5ff70b2d45aa62ce39d13cd57ff
MD5 3174e5c694a6edee8d65bfc72f378a94
SHA1 05900ff68b7e9c93c8ab8f54be3f9445637d8f41
SHA512 85fafd939499315509e13ab00a0d7c52a902d17b1f07bacf6db62f305fda67e004d47fdff97f3943e2a1f0082925300360201e7d9af5849e5349ad8109f6bd10
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 16ad7eac382aff81c669a1cc96719d4f268b9646823dd7e3b4f4a805a8d9ab5a
MD5 499feb7249753c46d444ace483a16a7e
SHA1 9f21f5b7ba6cb4a4f0a0dc19cc94d7d880291725
SHA512 dbc091108731aff6d7a1ebae139383c265da86125d75881f27aac3c955bd27c53f1bf1fa2b151f92bd19be5feaee20afee042bb9ee0ffc647659a5cd9c803870
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 78a4230f1115341e406917d2ee2fc74e77ddf810ae45a6e9edbc45e3dbdee2a5
MD5 afc2d6becf4099c6147bbde2bda010c1
SHA1 54f7bfc94c9b80252e4d1d86e5dbe5679bf47fd7
SHA512 0e0365f8ebd38defdaf7002c23f08d7afeef293810d24fffccb617c302383a81e3be72badcdbbbd24cd54d380a777e55df973ae3005ce8aeb033a2b441132523
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6cd6b53ff0315530fcc5f0ed5993aa14f1e64835b8d9ab33731a8d8508e7a0bc
MD5 999935f9e1c99a73e079546ee5e04ee1
SHA1 4308be5f09df141157d2536b2f59311d14172522
SHA512 54003c17792acb804edf7874f6fbceb7a43a1c7d0c82b85b2a9104fc19fd69e416fcbeaddef1a77c343555760f50c718de0f7e64074560867bd6c6fa98b70c2c
MD5 SHA1 SHA512

Submit Download

svchost_BBACBABABBAABCABBBABCACBABABABCBABCBBABCBCCCACCCAACCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABABBAABCABBBABCACBABABABCBABCBBABCBCCCACCCAACCAAA.exe
Size 2.8MB
SHA256 58bc94657c4685f556e8b110a53a24ef739f6413d4bd6e8b6a358236448217d0
MD5 e7f0c7340baa309726a3063a9fed8aa6
SHA1 f74cfe4f43464c22f285aea9b1197c76eb7b889a
SHA512 6d48a3bb5dc94515f90a610b26ce7137c28ed843fa2fec0c4daa6049ab6ba8c8441b706754355f544cc2e7efd193a660d475c2cb4799f34eebc4a0c0e02fb3d3
SSDEEP 49152:U+Ez8obnyMWGhO/+Ez8obnyMWT+ES+Ez8obnyMWGhOSqatgln+Ez8obnm:irBOr/rBV8rm
TLSH
T19ED54B1F22EC00B6D87F8275D2D18156D670B43127226AEFA290C77D9F6BAD1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_BBACBABABBAABCABBBABCACBABABABCBABCBBABCBCCCACCCAACCAAA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBACBABABBAABCABBBABCACBABABABCBABCBBABCBCCCACCCAACCAAA.exe
Size 2.4MB
SHA256 c7db0042d87dbc15455e6292522bbac4a1e24f6db241daacc1c1812c21589e3d
MD5 ece8264791ffdf6a18f176fa7d3bc93e
SHA1 4892344cb7df5dd174880c3000d88d9d7723a6a4
SHA512 8b3ee7c60dbe2201d0f57860c2e2ca77ecc5b3f872ade7cd709b3cbf9ca025e9e867aa71fd72796e7145eb27840b0a5f468435a6907dbe6cd22a7b6783d27a49
SSDEEP 49152:U+Ez8obnyMWGhO/+Ez8obnyMWT+ES+Ez8obnyMWGhOSqatglP:irBOr/rBVM
TLSH
T1CAC56C0F32ED00B6D87F8275D6968156D670B43127226ADFA290C73D9F6BAC1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAACBCBABBCABCAABBAAAAACBBAABBABCCBBAACCCABABBCACBCABAC.exe
Size 21.7MB
SHA256 d10cd9d99c7ed1d588a8d3d50cfaabdf0f5e3d7c2898aafd5b8b683bc3a6b9be
MD5 5332b8e10a1df2bc3e376e5d88e4c11a
SHA1 174acaec727285f300309191b38ddda149de48ef
SHA512 5270c4f3dee8d2694062368c22efc974f7f1fbde16f46efc3cd37b59509e0afc8149b9bdbcd84e8c94e2263ca35e01d8d900017b6f94d28630625d397fbaa4fa
SSDEEP 98304:irBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8rBOr/rBV8:Y
TLSH
T16F376C0F32ED00B6D87F8275D6968156D670B43127226ADFA290C73D9F6BAC1A53DF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1440-27-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/1440-40-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/3376-0-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/3376-7-0x0000000000CD0000-0x0000000000CF1000-memory.dmp

Download

memory/4752-68-0x0000000004A70000-0x0000000004A71000-memory.dmp

Download