314de25a78db9db68afa7c7519da728e3819bfe67a70c68c3f2691833e44fe97

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
Size 23.5MB
Sample260814-e83rpsvwct
SHA256 314de25a78db9db68afa7c7519da728e3819bfe67a70c68c3f2691833e44fe97
MD5 449db69d5b0f16d2bad8bba76ec44230
SHA1 ab2959a7d1c71b8cad6f3f10cd0b4dc87ebb3312
SHA512 e295d056db0562cbb12dfb7e914463c8c6879643f9fa6f3087ba9510bf2631912d55101ab550c6042fb74b2272a2325a7721bdd173e1185c9836adcc09a93314
SSDEEP 49152:U+ES+ES+ES+ETqatglu+Eq+ES+EBt+ES+ES+ES+ETqatglu+Eq+ES+EBt+ES+ESr:t00r00r00r00r00r00r00r00r00w
TLSH
T12C474B09F94780B2D82B017048CBD3BB4B70BE258B129AEBF78DD72EA9337D06535655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3584	svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
468	svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
3612	svchost_BCACBABCAACBAAAACBCBCCCAAAAAACACAACBBCBCBCCBABCBCCCBACC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CCCABCCCCBCBCBCBACACAACBBCCCACCACBCABCABCABBBBBCACCCBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe"	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CABCBCBCACCCCBABCCCABBAACBBACACBCCABCBCCABCABCCBACBBABAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCACBABCAACBAAAACBCBCCCAAAAAACACAACBBCBCBCCBABCBCCCBACC.exe"	svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4180	sc.exe
2396	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
392	cmd.exe
2212	cmd.exe
4604	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCACBABCAACBAAAACBCBCCCAAAAAACACAACBBCBCBCCBABCBCCCBACC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1440	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2428	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
2428	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
2428	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
2428	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
3584	svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
3584	svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
3584	svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
3584	svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
3612	svchost_BCACBABCAACBAAAACBCBCCCAAAAAACACAACBBCBCBCCBABCBCCCBACC.exe
3612	svchost_BCACBABCAACBAAAACBCBCCCAAAAAACACAACBBCBCBCCBABCBCCCBACC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	3584	svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
Token: SeDebugPrivilege	3612	svchost_BCACBABCAACBAAAACBCBCCCAAAAAACACAACBBCBCBCCBABCBCCCBACC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4680	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 392	2428	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe	96
PID 392 wrote to memory of 1440	392	cmd.exe	98
PID 3584 wrote to memory of 1324	3584	svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe	99
PID 1324 wrote to memory of 4408	1324	notepad.exe	100
PID 2428 wrote to memory of 2212	2428	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe	102
PID 2212 wrote to memory of 4180	2212	cmd.exe	104
PID 2428 wrote to memory of 4604	2428	2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe	105
PID 4604 wrote to memory of 2396	4604	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_449db69d5b0f16d2bad8bba76ec44230_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBAAABBBAABAABCBBBACBBACCACACBBCBACACABBCBCCCCAACACABABAAAACAACAAAACCAAABCACACCBCABABCBBBBBACCCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:392
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABBBBAAABBBAABAABCBBBACBBACCACACBBCBACACABBCBCCCCAACACABABAAAACAACAAAACCAAABCACACCBCABABCBBBBBACCCCBABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1440
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCABAABAAAACACAACBCBABACBABCABAACAABBBBCCACBCCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe" start= auto displayName= "UserDataSvc_CCABAABAAAACACAACBCBABACBABCABAACAABBBBCCACBCCBCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2212
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCABAABAAAACACAACBCBABACBABCABAACAABBBBCCACBCCBCBBA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe" start= auto displayName= "UserDataSvc_CCABAABAAAACACAACBCBABACBABCABAACAABBBBCCACBCCBCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4180
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCABAABAAAACACAACBCBABACBABCABAACAABBBBCCACBCCBCBBA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCABAABAAAACACAACBCBABACBABCABAACAABBBBCCACBCCBCBBA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2396

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4408

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
1⤵
- Executes dropped EXE
PID:468

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBABCAACBAAAACBCBCCCAAAAAACACAACBBCBCBCCBABCBCCCBACC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCACBABCAACBAAAACBCBCCCAAAAAACACAACBBCBCBCCBABCBCCCBACC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ff33070fe2883b942aa423a5d9d47dc5ef2d5c4f3bd2d6116822a3107649ce9b
MD5 b6014071080997e5be18b7f90f8eed14
SHA1 66b0cef7b400c2a7d94878137ba5c413d5e12ebd
SHA512 16b8ef78ee0737714c8d975febb22ee73d83a91254743653674771af8cdafef19193189dfe168b863e526a5144562697805d5160665a856c7006da8078425741
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 5dc3de45eb408cd90632e7d8b11887bf885dc6747579774dbf33f44bcb02f4a8
MD5 b1076b2af1d4a759eccaebbb9fee79eb
SHA1 5081a6c22bb5c9b444e551fdbed3f8b4c14c4cbf
SHA512 971c5e779265719c92a220da5e3db45a875dc45ba08fce20a46e2f984715784cd5fc13b81b5b92a8fa3b1a2971cb9638b1caa8cd43753c22359fc348f079d43b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9c7866b878751c9eb1595225eff59124184991c84ed1b9f0411064cb2ea09b59
MD5 ee9859d2416f40692275ded395ac23eb
SHA1 63d252ef029f9aa60d48965b52ea2d14a0dcfdec
SHA512 6b67b3acb7fdd5f3db3d7e4ea591f6500ed9568acbeb866ee49f01a07868d0031d194093c46eee2590858c0dff71d86fdf6873957e31fb537871d5ac6c543ca5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a3bd6844a08907461b0cdc4eec8230f5f2e4d033c21b375f0892423439899655
MD5 8bcecc4456817361d11e9b974f6c268c
SHA1 2890fadc000d834efa5049b28d396f3edf3be8ce
SHA512 6f2ef681d9fe4c18c3d47cde253e3b99dc740fffea9397676a332e5b21ac5773b8bb5a6568db4827b825f23cc783f66120a570cc111948b1df97736a612d9b05
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 27755644b49b51238872f6f847b831c11b4715f4188742c69770dd9ed0c82134
MD5 bfad3a6734415ee375e3ef55fc3de750
SHA1 6cc68eb34a6d1130603fc9cd065ee5ce36ef9c6c
SHA512 b767df63ff4ba6ed95ff4979a9bf8f15673619d7fe6e0ead884562f08733fe28ff201995b9105f19afe26e327e150f23e0333cabaaf67e3d305415d397fbff1f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 3d7a454d20352fbab173c7e424b2f18f8578b5ada8c8aecb6315142bcb92ad6f
MD5 1da735b2f0e7a82adf08246db9e9bd57
SHA1 a5f7fd7fa9c7d6746305dc1da5f7709877d2d38f
SHA512 2f838b7ae018818cdbf7345fe833bf275141c950deb3cc0d8b7623b6702c048be140f149b8e636aab88ba93d9f2eded230d7947a0d150ec755ebb9d513b15237
MD5 SHA1 SHA512

Submit Download

svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACBCACBBACCCABBAAABBACAACABBACBAACACCBABACCBCACBCABCBB.exe
Size 23.5MB
SHA256 314de25a78db9db68afa7c7519da728e3819bfe67a70c68c3f2691833e44fe97
MD5 449db69d5b0f16d2bad8bba76ec44230
SHA1 ab2959a7d1c71b8cad6f3f10cd0b4dc87ebb3312
SHA512 e295d056db0562cbb12dfb7e914463c8c6879643f9fa6f3087ba9510bf2631912d55101ab550c6042fb74b2272a2325a7721bdd173e1185c9836adcc09a93314
SSDEEP 49152:U+ES+ES+ES+ETqatglu+Eq+ES+EBt+ES+ES+ES+ETqatglu+Eq+ES+EBt+ES+ESr:t00r00r00r00r00r00r00r00r00w
TLSH
T12C474B09F94780B2D82B017048CBD3BB4B70BE258B129AEBF78DD72EA9337D06535655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 934B
SHA256 54d819a2f7f3535f441631d0ab0fa04b7fddc007714978bd723c9dff6a898843
MD5 e94f21c6dfe0f9e8bfcd2f4df652e697
SHA1 1106a6b5f7441eb5468e81bc7192be9edab6e00f
SHA512 4eee3753616c14ac433a0005b25a1a01aa9e7e5184c3406723d95a9b00beaa5751eec79dd93652e1149c427ddb96a673fb4db92232a0937413f2df9e770973af
TLSH
T12511273068E6DC73FB336DCF951A9BA20CF0B78B7C54AA14230D4329AB95D304D518E6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/468-96-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/1324-79-0x0000000002C20000-0x0000000002C21000-memory.dmp

Download

memory/2428-63-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2428-37-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2428-94-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2428-0-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2428-24-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/2428-11-0x00000000008A0000-0x00000000008C1000-memory.dmp

Download

memory/3584-54-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/3584-77-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/3584-36-0x0000000000960000-0x0000000000981000-memory.dmp

Download

memory/3612-116-0x0000000000950000-0x0000000000971000-memory.dmp

Download