783893eb2679ebd524ec8ab9e70251a2547c2c600b3fdceb13950dda14d7aa8f

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe
Size 16.9MB
Sample260814-fmdfcsvfke
SHA256 783893eb2679ebd524ec8ab9e70251a2547c2c600b3fdceb13950dda14d7aa8f
MD5 2409ff26a1cf4fd48fd5d7eb4e488b8f
SHA1 64ea3adaeffbde5668b52c5031cabd33071052cd
SHA512 f7c33373f425af7aafcb0baafb3a7cb4f0408cb0fb03d14bf84b26fea3944123c23f04e7151acc71a5ddac9b9dbe73a8afd1867b956324ed8137f33f98a1ba66
SSDEEP 98304:RGKRuy5aoGKRuy5aoGKRuy5aoGKRuy5aoGKRuy5aoGKRuy5aoGKRuy5aoGKRuy5i:0q0q0q0q0q0q0q0q0qO
TLSH
T1CD079F02F6834072D9772170099FE3BB5A79BB214B25899FE748473F5E33BC0662935A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2964	svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBBACAABBAABABBBABBCAAABBABCABCCCBBACBBACACCABCAAAACACB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe"	2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2788	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3936	cmd.exe
4156	cmd.exe
1696	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
6048	2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe
6048	2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe
6048	2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe
6048	2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe
2964	svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe
2964	svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6048	2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	2964	svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 6048 wrote to memory of 3936	6048	2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe	96
PID 3936 wrote to memory of 2608	3936	cmd.exe	98
PID 6048 wrote to memory of 4156	6048	2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe	101
PID 4156 wrote to memory of 2788	4156	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_2409ff26a1cf4fd48fd5d7eb4e488b8f_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6048
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBBBBBACBBCABCBCAABABCBAAAACCBABACACACACAACBCBACBACBBCBCABAAACBACBCCCCCBBABBCAACCBAABBCACBCBCCBBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3936
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_AABCBBBBBACBBCABCBCAABABCBAAAACCBABACACACACAACBCBACBACBBCBCABAAACBACBCCCCCBBABBCAACCBAABBCACBCBCCBBBBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2608
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABCBCABBBBAACCCBAACABABAABABBABABBABAACBCACACBBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe" start= auto displayName= "UserDataSvc_ABCBCABBBBAACCCBAACABABAABABBABABBABAACBCACACBBBACB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4156
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABCBCABBBBAACCCBAACABABAABABBABABBABAACBCACACBBBACB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe" start= auto displayName= "UserDataSvc_ABCBCABBBBAACCCBAACABABAABABBABABBABAACBCACACBBBACB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2788
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABCBCABBBBAACCCBAACABABAABABBABABBABAACBCACACBBBACB"
  2⤵
  - Executes a command shell one-liner
  PID:1696

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 34.4MB
SHA256 67badb652353cd6d7d8794054a39a03560b4390524c8bd1a58a0017e566533af
MD5 eb7191f70fadfe5b34fbd3e7ade9c738
SHA1 b6b0f5848e71e79dbdfbbcfb2fa845ab9d824fcd
SHA512 80af05f7785154a21227ba933c013cd213ea3108fe0662570950bc7e42e444a50eab87d54e87e4e1aafff5ce919495112dd568686508523cb6c3474417650559
SSDEEP 196608:0q0q0q0q0q0q0q0q0qHq0q0q0q0q0q0q0q0qvY:FFFFFFFFFKFFFFFFFFw
TLSH
T171879F02F6834072D9772170099FE3BB5A79BB214B25899FE748473F5E33BC0662935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 38ac015af267dbace2b7d14b388f770f7423210f9ddc5bc49d7aba10cdfaae3c
MD5 f6d75ab0daae771a73cab9a3d31008d4
SHA1 88b3e186456a509c6c86857a09d50a439ce9a6e0
SHA512 05716f37ef1088b7819efe3d8bed9146d7f749dc3f89f570a081d6ee6fefda020385dfc3457fe28eb911dad5744e6b63583ad9bec55d648fa2627f2c4c8287d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e3374c3f892a92942c06ca41ba6f07a42e4f95892ff4e35efce8a582fa787d0b
MD5 f0038424966bf41818d17aac13ebfbf1
SHA1 29f02d8f3f240a949587c8f1fa1c6a2135b6b5a7
SHA512 f950a0d836a4717f10c6642cc55c776a89b0420d9e2c8a37ab4bf31aa7c81442ae2730080c0a3cd4cc6b1092618df852a39b5cbaece038fd4542624a35a16acc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 92f0333eb3d9cb29d7c5d996fbf0b9338d6a21caf791ed3b21063cf09dddd12b
MD5 d3f17c44972220f30a5700a5a9f9c395
SHA1 9bb59d9da6a6eaf8a7fb9441bc76511244dab0d8
SHA512 14799c9df32c1b42c483d22e105d2bb0918e1f1a351b8836c9f79249876f014409d3d81f8f1fae1fbe798b1201f4b59b48f6c3d932130b143ed6df0221bce288
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7464dc98e402b0c638b341732a13f7742ec0dd67082f4fa8cf154ec3d3719310
MD5 36fa463b03b0910758e07a733bac0849
SHA1 90dbb14c3f76e2e8c43bb724ee50d18e61d0808f
SHA512 06915bd742631b67f05568f00f72916062451e1189c20fc6be9783fb224bf04fa8b264c69fa34e7841b0407c0ada19bb0bd577d628d68a9900b9d8487ebb38be
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 244b27f9156c0dce96caca84de76e84dcedf026163a95fd622e73dee3be05878
MD5 3b451eba1a96180810239db032c1a94c
SHA1 5cb6deb30e8cd6f501497c10becd2ba60e3e621c
SHA512 09c6c0fb494064e83c20d5f14d9985e221abe1c1a1bd88cad81c3040fd5c7ab8f816ed952da402a0315ad4fa571c416176a89ada284ec466f993a021e59cc18d
MD5 SHA1 SHA512

Submit Download

svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBACCACCBCACACCABBCBABCCCAACCBCAACACBAAABCAAAACCCACBCA.exe
Size 16.9MB
SHA256 783893eb2679ebd524ec8ab9e70251a2547c2c600b3fdceb13950dda14d7aa8f
MD5 2409ff26a1cf4fd48fd5d7eb4e488b8f
SHA1 64ea3adaeffbde5668b52c5031cabd33071052cd
SHA512 f7c33373f425af7aafcb0baafb3a7cb4f0408cb0fb03d14bf84b26fea3944123c23f04e7151acc71a5ddac9b9dbe73a8afd1867b956324ed8137f33f98a1ba66
SSDEEP 98304:RGKRuy5aoGKRuy5aoGKRuy5aoGKRuy5aoGKRuy5aoGKRuy5aoGKRuy5aoGKRuy5i:0q0q0q0q0q0q0q0q0qO
TLSH
T1CD079F02F6834072D9772170099FE3BB5A79BB214B25899FE748473F5E33BC0662935A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2964-68-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/2964-45-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/2964-93-0x0000000000750000-0x0000000000771000-memory.dmp

Download

memory/6048-0-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/6048-44-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/6048-77-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/6048-30-0x0000000000430000-0x0000000000451000-memory.dmp

Download

memory/6048-16-0x0000000000430000-0x0000000000451000-memory.dmp

Download