1a3d21d4b4d3551c0c3fb0bc0def73a8690c313d13932c87fba82bbaacffd83f

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe
Size 15.0MB
Sample260814-e4vwasvcne
SHA256 1a3d21d4b4d3551c0c3fb0bc0def73a8690c313d13932c87fba82bbaacffd83f
MD5 4e1546ab875eb33bcd7cca2d7188ccfa
SHA1 cc49279461267279a1cc45c4f524c611e475cd0f
SHA512 671a61992ecd6a3f693ef1e42bea72b0bb09e87d8c8984a01b0fde2ac41dfd7f011345f7dbd2b2c9b922f6c8f360ea41e9e3431572266554e5c749d20f78b666
SSDEEP 49152:U+E9oqatgl7+E9oqatgl7+E9oqatgllwqp+E9oqatgl7+E9oqatgl7+E9oqatglU:1VVDVVDVVDVVDVVDVVDVVDVVx
TLSH
T14AF66C81BBD98863E0B70231587792A61E71BD254F15E28F7398535E6D337C0AB337A2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3228	svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
5108	svchost_ABBACBBCAABCBACBACACACACBABBBCAAABACBBBABACCBBACCBCAACC.exe
4172	svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCCACCBCCBBBAACAAAACAABAABCABABACBABACCAABCABAACBCBBCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe"	2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBAABCAACCCAABCBAAAAAACABACCAAACCBCABAABBBCCCCACBCACBABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACBBCAABCBACBACACACACBABBBCAAABACBBBABACCBBACCBCAACC.exe"	svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1012	sc.exe
1788	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4844	cmd.exe
3704	cmd.exe
2108	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACBBCAABCBACBACACACACBABBBCAAABACBBBABACCBBACCBCAACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4148	2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe
4148	2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe
4148	2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe
4148	2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe
3228	svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
3228	svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
3228	svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
3228	svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
5108	svchost_ABBACBBCAABCBACBACACACACBABBBCAAABACBBBABACCBBACCBCAACC.exe
5108	svchost_ABBACBBCAABCBACBACACACACBABBBCAAABACBBBABACCBBACCBCAACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4148	2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	3228	svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
Token: SeDebugPrivilege	5108	svchost_ABBACBBCAABCBACBACACACACBABBBCAAABACBBBABACCBBACCBCAACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3388	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 4844	4148	2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe	103
PID 4844 wrote to memory of 3056	4844	cmd.exe	105
PID 3228 wrote to memory of 4572	3228	svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe	110
PID 4572 wrote to memory of 3448	4572	notepad.exe	111
PID 4148 wrote to memory of 3704	4148	2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe	115
PID 3704 wrote to memory of 1012	3704	cmd.exe	117
PID 4148 wrote to memory of 2108	4148	2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe	118
PID 2108 wrote to memory of 1788	2108	cmd.exe	120

C:\Users\Admin\AppData\Local\Temp\2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_4e1546ab875eb33bcd7cca2d7188ccfa_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBBBCBABACAACACCCCCAABBCABBACCCBCCBBBBBABAABBCAAAABABBAAAACBCABBCBCBBCCBBCBBCAABBACCABABCCBABCAAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4844
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCBBBCBABACAACACCCCCAABBCABBACCCBCCBBBBBABAABBCAAAABABBAAAACBCABBCBCBBCCBBCBBCAABBACCABABCCBABCAAAAAB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAAAAACBAACCAAAACCCCCABAAAACCBACCACABABAAABBBCBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe" start= auto displayName= "UserDataSvc_BAAAAACBAACCAAAACCCCCABAAAACCBACCACABABAAABBBCBBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3704
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAAAAACBAACCAAAACCCCCABAAAACCBACCACABABAAABBBCBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe" start= auto displayName= "UserDataSvc_BAAAAACBAACCAAAACCCCCABAAAACCBACCACABABAAABBBCBBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1012
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAAAAACBAACCAAAACCCCCABAAAACCBACCACABABAAABBBCBBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2108
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAAAAACBAACCAAAACCCCCABAAAACCBACCACABABAAABBBCBBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1788

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3228
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:3448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:3388

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBCAABCBACBACACACACBABBBCAAABACBBBABACCBBACCBCAACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACBBCAABCBACBACACACACBABBBCAAABACBBBABACCBBACCBCAACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
1⤵
- Executes dropped EXE
PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2e7ca431d479586cc5fdf81034042d5dee9f9914b975f7f1dd5ef5afdddeb654
MD5 b8b7c4057b2dff9172f0144ee3c299b6
SHA1 e2e9ca5970ec564452ada63a1a6d2dba7c1a35f3
SHA512 da740549cfed853b6f570378f2e8a2ee446cbd7adee3e14f06ad1af59efe4d21714892c3b028232df8bb36542013cac68c30cc4646fb6ed39e5c6b98ea82f4d0
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1c82c95356c5c15139e2ffb49202d1ee1363f177d2d2a7f49ca0353208829b3c
MD5 2146c1fb43c0eb9ebfc051880099d717
SHA1 4492ad4243f911781dc5b6cd3b8bd8697d7a2bc6
SHA512 64e5a2dbc3ab946ef373c82b2babf09c8578ba0acaf11d164502215025b43c4349fd12e96dff4cc580b3fdb2cb4fb407d358faaeec814baabc53cfa988f95183
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d0d429d68dca46467c48deef4202c8af09665f04aa348488f573364d8542e4b6
MD5 ce293283e5b4d0c694c54ed80eacb63e
SHA1 2507f743b3930fffd148571944921401a23611b7
SHA512 9ad53f96297d340a2fa7144363799df8b22539c31746898a5d76ba3866cdcb8d844dfd64c27c5fb28f53bd456b7dd837d7ffa9d611cd76de7544ae3fbdf2703f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 97411e603e02bd30d568ddd317bed01b4f751538e5a0b7180d6aeda0c66d70cf
MD5 996d2c85101cb11f34c6513465fad7ef
SHA1 aad16e3ef8e7e611f92438d5d40c19d6b10146ab
SHA512 16ee27afe8b82825ce8a10984b96914c60abdae20fcc47f8fc2d7f433042e3e067443d0f963f6d43bad8fc643271e5d7a8ebe360f9f4d24893cb8afc4856a1a3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0d205dffe8fd03adb699554fedeae5f3e35fa1c394e4d2ebe3c213ec8ac459cb
MD5 8969830153bfb676734dbd3af32bbc10
SHA1 d3afb4f9595c9e8a4cd1b005e8b90e934045237e
SHA512 28a92e5726c1f3e147c423c8da250ce0af17aa72cb03d1af78b80443988657e5ee9fd0903a97f1ec4e1deb9d3f2f970677bf4afd17a7e57700298b426f1e4b51
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6095d130fdeaba9b1f2ef3416a07cfa84068ea90db440ce9958ab40227e47eda
MD5 b0fa2289e72cb1114ed9a08a3da115f5
SHA1 01ed61958baab76618e4585fcc92e6731606dc46
SHA512 589fb78581f20e8252fe5ac9743cc043d1b1fbc882b499695991bdb3c757776e17dd944f392a5fa5da404fce5ab63c1f5362ee13a2935c2e6efa705b903875f5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 09e3a96dc34b3d27e59d1f4ca8dd76807fa33fb2bc1578c2a055ce96ec9c8b32
MD5 3902d017055bb49eee4399ac795c5d4e
SHA1 01f2dcfadd9df71219aa4aef1ceab101a3b73c3b
SHA512 51e6952180f963df53a3d4c644ea1f04532de567aac52970731ccdc3a72e47b8d8a6cdd6c7cea8cea4f969bf63db19c72282004e67d5ad0b40c0a9da3c754ec5
MD5 SHA1 SHA512

Submit Download

svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBABCAACCCCBAAAACBCAAACCBABAABACBBBBAAAABABBCBBABAACB.exe
Size 15.0MB
SHA256 1a3d21d4b4d3551c0c3fb0bc0def73a8690c313d13932c87fba82bbaacffd83f
MD5 4e1546ab875eb33bcd7cca2d7188ccfa
SHA1 cc49279461267279a1cc45c4f524c611e475cd0f
SHA512 671a61992ecd6a3f693ef1e42bea72b0bb09e87d8c8984a01b0fde2ac41dfd7f011345f7dbd2b2c9b922f6c8f360ea41e9e3431572266554e5c749d20f78b666
SSDEEP 49152:U+E9oqatgl7+E9oqatgl7+E9oqatgllwqp+E9oqatgl7+E9oqatgl7+E9oqatglU:1VVDVVDVVDVVDVVDVVDVVDVVx
TLSH
T14AF66C81BBD98863E0B70231587792A61E71BD254F15E28F7398535E6D337C0AB337A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 7c331661070f8312b3535c82e64dcc494b8af7c333d8b31cba4ae14d1700a9c6
MD5 227021459a8a7a9c92c443b9440b3bda
SHA1 2ace1d7a2ce85efacc413848b83d91e899a8d8e7
SHA512 c35011923bc74fc8a641ef64f58cded955499f0af876c30b15ed29ead3dceb52b633b3f419c13cf8447216509492fbacea57261aefde79b6d56552dc2b6e084d
TLSH
T12D11EB6598E59873E93368CF93169F831CE4769FE85C9A44130D42287FA9D318E590D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3228-37-0x0000000000B70000-0x0000000000B91000-memory.dmp

Download

memory/4148-0-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4148-8-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/4572-60-0x0000000005060000-0x0000000005061000-memory.dmp

Download

memory/5108-73-0x0000000000EE0000-0x0000000000F01000-memory.dmp

Download