c01feb61aba5000646fdc767efa7219ce3ae51f65ba88fd49a49234e8d67dbed

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe
Size 27.4MB
Sample260814-fnbcdsvfnd
SHA256 c01feb61aba5000646fdc767efa7219ce3ae51f65ba88fd49a49234e8d67dbed
MD5 21d2f1a6b27285a63deaa131dc77a3ff
SHA1 d83e0391e51d89d07ec9aa50486eecab50e17ce5
SHA512 7b67b4402b2fdb5c7d7d1c72f65b81415579861d71dbb8b6cd014ec74c5c289e2bcf3bb1d1c8f87e6eb014e7dc3a1f504470a10bf2def90bcd9b41e12c2e2488
SSDEEP 98304:+TQTQTcTQTQTcTQTQTcTQTQTcTQTQTcTQTQTcTQTQTcTQTQTV:7
TLSH
T172574B42FA8984B2E477027148AB82BB5B70FD154F12D6EFB348936E5D337C0AB31665
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
6036	svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
3864	svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
3888	svchost_BACABBCBCBAABABCBBCCAACACBBBBBABCAAABBBCBCABBCBBABBBBBB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAACBCCBCCCAAAABBCACABBCCCBCCACCBBACCAAACCBABCBCBAACBBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe"	2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABABCBAAABCCAAAABBAAACBACAAACBBBCCCABCBBBCBCCAACCCCBACCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BACABBCBCBAABABCBBCCAACACBBBBBABCAAABBBCBCABBCBBABBBBBB.exe"	svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2036	sc.exe
5948	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3004	cmd.exe
3532	cmd.exe
4732	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BACABBCBCBAABABCBBCCAACACBBBBBABCAAABBBCBCABBCBBABBBBBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1640	2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe
1640	2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe
1640	2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe
1640	2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe
6036	svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
6036	svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
6036	svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
6036	svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	6036	svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 3004	1640	2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe	92
PID 3004 wrote to memory of 3020	3004	cmd.exe	94
PID 1640 wrote to memory of 3532	1640	2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe	95
PID 3532 wrote to memory of 2036	3532	cmd.exe	97
PID 1640 wrote to memory of 4732	1640	2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe	98
PID 4732 wrote to memory of 5948	4732	cmd.exe	100
PID 6036 wrote to memory of 1040	6036	svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_21d2f1a6b27285a63deaa131dc77a3ff_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCABCBBCBBCBCCCAABBCBAACACABBBACBABBCBCBBBBCCCABACBABABCAACACBAABAAAABBCBCCCBABAACBCBCACCCBABCCCCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3004
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BCCCABCBBCBBCBCCCAABBCBAACACABBBACBABBCBCBBBBCCCABACBABABCAACACBAABAAAABBCBCCCBABAACBCBCACCCBABCCCCCBCC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BAABCBCAACCACCBBCACCBACCCCABACBCAABAACBABCCAAAAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe" start= auto displayName= "UserDataSvc_BAABCBCAACCACCBBCACCBACCCCABACBCAABAACBABCCAAAAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3532
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BAABCBCAACCACCBBCACCBACCCCABACBCAABAACBABCCAAAAACCA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe" start= auto displayName= "UserDataSvc_BAABCBCAACCACCBBCACCBACCCCABACBCAABAACBABCCAAAAACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2036
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BAABCBCAACCACCBBCACCBACCCCABACBCAABAACBABCCAAAAACCA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BAABCBCAACCACCBBCACCBACCCCABACBCAABAACBABCCAAAAACCA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5948

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6036
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1040

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
1⤵
- Executes dropped EXE
PID:3864

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBCBCBAABABCBBCCAACACBBBBBABCAAABBBCBCABBCBBABBBBBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BACABBCBCBAABABCBBCCAACACBBBBBABCAAABBBCBCABBCBBABBBBBB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ae1663d6c54c6597b346e86f68d3c444bdca1f3c4bce884fbe502128761b66a8
MD5 d810f30c01aa905336bc8d3eb7558f6a
SHA1 45b58b1e1d09a1afda071a230fbe927c819dc9c7
SHA512 d6e57f4d8c86cfd4da9e471eba0fc3758b63ae4395129aa86026f2dbea48caebed379bc77341a9b743e2af9a701b06ce8b10c582d7016419942b02e2958529d2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 09264bdcc9e08069f91b81c27d905ff1aa8a399c95511155a5053c5718aeabc7
MD5 bed8f5b5d93d8c5e74b1b4d55ee865c6
SHA1 4aa20107aa361b05521ba54d7151a9e902a30ef7
SHA512 772f5bd9f7990493fd5811a2c0ac44df9a8b5cf4a24d053cf61ade90370febe131ffd3bc769ee70a009fbacb00704240506eccfb8306003651e7eac7302e69e3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 46ac1ebf01e0db6b43129892ed4e0385d9df36fadca6eeb8af39cd7c3ad8f4dd
MD5 76108600eb465b436ed00c99902c0bb9
SHA1 3afb1204e008a701d914cf30c55d4d4ecec06b5e
SHA512 b95249c7133b579940b2e636073be31420fd9c9150e02bbe0162a744ba92ea6c1aef89bc17352c078daebcfa264ce3ced46b1867e424aba6bf008f8f474faebc
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 404e48e99e800ce71efd4c0b756842c617feb8d4fadea4eae2e0d738d8412d5a
MD5 185a6874473e3ca345983e6c2a09718e
SHA1 ad6dc7827e28a872fbcbdcf2e6ed772b5a65620f
SHA512 93e52ce256387d17e3717a25344a7f901e70e410369825dcedae5da3b62b7564481648b9030af163db0d8c24203051f1b905326971b956c852ec75dde45a37c2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 94c85d0f83809af2cf381d2b4bb08caa1230791bbb1e1843737441100bc3b223
MD5 a2c410a337a46d2785ab99b44c737d52
SHA1 29b6d3682e6d17f2ec7fad3d568676989989562d
SHA512 78b69ba2f4b4c73107627a91a74d966c72a8b4d30771bf317baaece2d860457bffcbc973fbb984daeb926a3c4c7691790424def7d85f562135d780cf9a074bca
MD5 SHA1 SHA512

Submit Download

svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_AACBAACCAAABBABAACCACBCAABABBCCCBCCBABCBAAAAAABBACAACAC.exe
Size 27.4MB
SHA256 c01feb61aba5000646fdc767efa7219ce3ae51f65ba88fd49a49234e8d67dbed
MD5 21d2f1a6b27285a63deaa131dc77a3ff
SHA1 d83e0391e51d89d07ec9aa50486eecab50e17ce5
SHA512 7b67b4402b2fdb5c7d7d1c72f65b81415579861d71dbb8b6cd014ec74c5c289e2bcf3bb1d1c8f87e6eb014e7dc3a1f504470a10bf2def90bcd9b41e12c2e2488
SSDEEP 98304:+TQTQTcTQTQTcTQTQTcTQTQTcTQTQTcTQTQTcTQTQTcTQTQTV:7
TLSH
T172574B42FA8984B2E477027148AB82BB5B70FD154F12D6EFB348936E5D337C0AB31665
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1640-59-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/1640-10-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/1640-33-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/1640-82-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/1640-21-0x0000000000C70000-0x0000000000C91000-memory.dmp

Download

memory/3864-86-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/3888-95-0x0000000000840000-0x0000000000861000-memory.dmp

Download

memory/6036-50-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/6036-71-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/6036-32-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download

memory/6036-97-0x0000000000F10000-0x0000000000F31000-memory.dmp

Download