e991436ae41096929e326e4dd980e1bada084bfada2b4b0e36440cca1157bc53

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe
Size 11.3MB
Sample260816-kdk63atdpd
SHA256 e991436ae41096929e326e4dd980e1bada084bfada2b4b0e36440cca1157bc53
MD5 1c68015cd3e7538da072e20db4ec5124
SHA1 1425a1581a5bc8d4be87b44b577a2f8b034a1767
SHA512 c7439317686d4da14ea00c06b6b75c8531a5ef3e34b7bdea443665d4a87ecfe456683bf999ac02c158cc27758c38d5ba8eab947b2958647cbd3d2b17f3880c79
SSDEEP 49152:U+ES+Ek6+ES+ES+Ek6+ES+ES+EkUvqatglg+ES+Ek6+ES+ES+Ek6+ES+ES+EkUvw:D44444446
TLSH
T1A9C64C0DFA8A40B1D56A5171488BC2BFCAB1B82147135AEBE789C73E5E33BE17534B44
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3340	svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
2168	svchost_CAAACCBABBCABCBCCAABCACACCACABBAABCAACCACAAAAACBBCAAACA.exe
3840	svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BCBCAACCACCBBBCBCBBCBCCBBBAABBBCBBBAACBABCCACAABCCAAAAAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CAAACCBABBCABCBCCAABCACACCACABBAABCAACCACAAAAACBBCAAACA.exe"	svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACBABBCABCCACACBACAACBCAABBCBABAACCCACBBCBACABBCBBBABABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe"	2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3936	sc.exe
5832	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5864	cmd.exe
5308	cmd.exe
4948	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CAAACCBABBCABCBCCAABCACACCACABBAABCAACCACAAAAACBBCAAACA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2664	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2712	2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe
2712	2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe
2712	2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe
2712	2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe
3340	svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
3340	svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
3340	svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
3340	svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
2168	svchost_CAAACCBABBCABCBCCAABCACACCACABBAABCAACCACAAAAACBBCAAACA.exe
2168	svchost_CAAACCBABBCABCBCCAABCACACCACABBAABCAACCACAAAAACBBCAAACA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2712	2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	3340	svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
Token: SeDebugPrivilege	2168	svchost_CAAACCBABBCABCBCCAABCACACCACABBAABCAACCACAAAAACBBCAAACA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 5864	2712	2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe	93
PID 5864 wrote to memory of 2664	5864	cmd.exe	95
PID 3340 wrote to memory of 5056	3340	svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe	96
PID 2712 wrote to memory of 5308	2712	2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe	99
PID 5308 wrote to memory of 3936	5308	cmd.exe	101
PID 2712 wrote to memory of 4948	2712	2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe	102
PID 4948 wrote to memory of 5832	4948	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_1c68015cd3e7538da072e20db4ec5124_amadey_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACBAABCACACAAABBBCABCBCBACCBABCABAABCAACAACCBCBBAACCBCCBCCAACAAABBBBBABBCCCCBBAACABCABCCACCCABACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5864
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BACBACBAABCACACAAABBBCABCBCBACCBABCABAABCAACAACCBCBBAACCBCCBCCAACAAABBBBBABBCCCCBBAACABCABCCACCCABACAAC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2664
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ACCBBBCCBCAACBAAACBACABBCACCBBCBCABCCCBBBABABAAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe" start= auto displayName= "UserDataSvc_ACCBBBCCBCAACBAAACBACABBCACCBBCBCABCCCBBBABABAAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5308
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ACCBBBCCBCAACBAAACBACABBCACCBBCBCABCCCBBBABABAAAABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe" start= auto displayName= "UserDataSvc_ACCBBBCCBCAACBAAACBACABBCACCBBCBCABCCCBBBABABAAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ACCBBBCCBCAACBAAACBACABBCACCBBCBCABCCCBBBABABAAAABC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ACCBBBCCBCAACBAAACBACABBCACCBBCBCABCCCBBBABABAAAABC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5832

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5056

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCBABBCABCBCCAABCACACCACABBAABCAACCACAAAAACBBCAAACA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CAAACCBABBCABCBCCAABCACACCACABBAABCAACCACAAAAACBBCAAACA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
1⤵
- Executes dropped EXE
PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 ede368c2a83a674eb0dbc770916dd875d8599b1014d3932806709d7855d19c98
MD5 7acbc6a750aaaaa8238e98e34cecfbef
SHA1 7894ce3858d3277f1d5ef0fb24df5b6dd32cddc4
SHA512 f0c9d44aeb93f12bbb2f367ba98587a6438069fce114260ae825e007ac0ab8dcf53e1c1a378801b203181ca5070de491b6e332f1d575abdec9231283aa71a071
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 217261b996fbcf7a08a884d2ba02bb0c2a2b0b7da6a7bd7a08ac6cebe1f8863f
MD5 f5b6f4e72225c508b8997b725af2402f
SHA1 255d7da7960595cfb502b34b571df93c894374e5
SHA512 d4d8c9710e5c56b315f5d1ec950c06d7a13728dc76d96652425fa4724f241514ecb50969000ee8792d20325ae4b0ef68315c998ba61fc9a80f19f490beca97d9
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 93c9de9169be817100a9f93c7275d3e78580a316de8eb55286ce3731f72ef804
MD5 4543cf59be883e869ffa9a1e915ab812
SHA1 7c285a476116f92475831b4e52b89889db84855d
SHA512 da0d254f7f9ecd9c0bc05f074413a874eb4cd135be621392940baaaa6ef9814c8d3325e62b32c642ec43d318053e6e1e7977fac00506f8ac0ad6b18a06a02bec
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 06ae38f0fda634350c6922c35a380b2c47a5eba22b7d7af1aca1afaf0a36aafe
MD5 59125f0a5f00dc93b558514d8723160a
SHA1 79c04e9384b7590df660544acf3a84533fa85260
SHA512 9ac4c4b6c1fd2152f427e603e08cbcb195a82e71e0aa1da38fd3e2367e5ad81fb27a7c4e4ac0ef0c89cccddce83615b3bdfca00139382c2a08f36f2111fd1474
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 6cdf154e1d28408d81f0868290db02c4a2d541abec37dc3c2f0581f7879bfa88
MD5 8e03505f24e50318fb325db15414d4b4
SHA1 5781962aff17289610d3f62cbcc55fc71cd542f0
SHA512 ee25c8367604576466f4c842ee8eee1f449312961417bfeda740aaf38beba1d099a95b4b227c590297c15e7552d6522f9200a92bd5de6352d4f37185f78da52a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 dcad94fa54483e23f8c7741ceec2ee9d69586e40cb7b29d3f20d4b2873818d42
MD5 7f5ae1166d01ac72af236c65b5ddc5d5
SHA1 aa642d94e86add57a4fc94ad338e433c70f07e2e
SHA512 525bdd32e5ffe302e70fbf9d737d81b7b5c8beac3998ccafd50cba66c37fba18acae4b2414be002dd569e3037a85f3fb235cca083e0e0927928758c2e4f21298
MD5 SHA1 SHA512

Submit Download

svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABCBBACACBBBBCCBCCABABACAAAAABABACCBAAAACACCBAABAACACAB.exe
Size 11.3MB
SHA256 e991436ae41096929e326e4dd980e1bada084bfada2b4b0e36440cca1157bc53
MD5 1c68015cd3e7538da072e20db4ec5124
SHA1 1425a1581a5bc8d4be87b44b577a2f8b034a1767
SHA512 c7439317686d4da14ea00c06b6b75c8531a5ef3e34b7bdea443665d4a87ecfe456683bf999ac02c158cc27758c38d5ba8eab947b2958647cbd3d2b17f3880c79
SSDEEP 49152:U+ES+Ek6+ES+ES+Ek6+ES+ES+EkUvqatglg+ES+Ek6+ES+ES+Ek6+ES+ES+EkUvw:D44444446
TLSH
T1A9C64C0DFA8A40B1D56A5171488BC2BFCAB1B82147135AEBE789C73E5E33BE17534B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 63bec79671970039d93812f14c5dfd5c829f7e4873db0b5b9c3fdab42a7e047d
MD5 c36d147732930cc9f5ca72b3d62badfe
SHA1 03afdcf20f38ffcd795c8dcf186b5dd3b11b8e91
SHA512 fc28588c1dae72d415b6890581e01ee873f53201163f6ce101d89f19f0f9229bef99d1175dab142237dc9db843559363333ede400d77207a34f339320e696328
TLSH
T16011916164E5D877FA336CCB611DEF830CB6378F9C5CAF54230D5218AA85C24CD658A2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2168-79-0x00000000001F0000-0x0000000000211000-memory.dmp

Download

memory/2712-0-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/2712-7-0x00000000003A0000-0x00000000003C1000-memory.dmp

Download

memory/3340-33-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download

memory/3340-23-0x00000000008D0000-0x00000000008F1000-memory.dmp

Download