1fd497a232de5e81f89138af5b230005d2e17182ec45a328e425775467e188ea

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 09:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
Size 10.7MB
Sample260816-lnjawsvbqf
SHA256 1fd497a232de5e81f89138af5b230005d2e17182ec45a328e425775467e188ea
MD5 dec965cb2ba295de5ec78d58fb46f55b
SHA1 2ed5a7225861810bb2dba8d9720b859496bbe72d
SHA512 e2ebc43a0ab519730fe4905df8c448d24c2e335ffa14683f37c4fddb90effe757a8cfe1a3c3de074e87d3de2e4ee95a6ada94dda2d20e9a0d7d037a9cbdd9a9c
SSDEEP 49152:U+EpqatglxhOkXpH+EpqatglxhOkXpH+EpqatglxhOkXpH+EpqatglxhOkXpH+E0:iUtUtUtUtUtUtUtUtUQKRuy5a0
TLSH
T1FCB65C06B7D544B1E5730231496B42A68A76BC211F31D7CF63D4A27EAE33BC0BA31B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3888	svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
3308	svchost_CABAACAABBABCBBBCCBCCBBBBBBCBBBBBCBACACAACCABACBBBABCBC.exe
5844	svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BACBBBABCACCABBAACCCCACBCBBACBCBBABCBACCBCCACCCBCCBBAAAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe"	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABBCCCBBCBBABBACABABABABBCCCAAABBBACACCAABCABBBBCACCCCA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABAACAABBABCBBBCCBCCBBBBBBCBBBBBCBACACAACCABACBBBABCBC.exe"	svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3580	sc.exe
4852	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3296	cmd.exe
6088	cmd.exe
2816	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABAACAABBABCBBBCCBCCBBBBBBCBBBBBCBACACAACCABACBBBABCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6096	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3172	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
3172	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
3172	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
3172	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
3888	svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
3888	svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
3888	svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
3888	svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
3308	svchost_CABAACAABBABCBBBCCBCCBBBBBBCBBBBBCBACACAACCABACBBBABCBC.exe
3308	svchost_CABAACAABBABCBBBCCBCCBBBBBBCBBBBBCBACACAACCABACBBBABCBC.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3172	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	3888	svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
Token: SeDebugPrivilege	3308	svchost_CABAACAABBABCBBBCCBCCBBBBBBCBBBBBCBACACAACCABACBBBABCBC.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3172 wrote to memory of 3296	3172	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe	93
PID 3296 wrote to memory of 6096	3296	cmd.exe	95
PID 3888 wrote to memory of 712	3888	svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe	96
PID 3172 wrote to memory of 6088	3172	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe	99
PID 6088 wrote to memory of 4852	6088	cmd.exe	101
PID 3172 wrote to memory of 2816	3172	2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe	102
PID 2816 wrote to memory of 3580	2816	cmd.exe	104

C:\Users\Admin\AppData\Local\Temp\2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_dec965cb2ba295de5ec78d58fb46f55b_amadey_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3172
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBABABBCCBBACACBCBAACCAABCABCBBCCACAAABBBBCAABABCCCBBABABCAAACBBCCCABBACABCBCBCCACACACBABACCCBBCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3296
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ABABBABABBCCBBACACBCBAACCAABCABCBBCCACAAABBBBCAABABCCCBBABABCAAACBBCCCABBACABCBCBCCACACACBABACCCBBCAABA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:6096
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBCABCBBABABCBBAAACCBBBCAACBACCBCAAABAAAACABCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe" start= auto displayName= "UserDataSvc_BCBBCABCBBABABCBBAAACCBBBCAACBACCBCAAABAAAACABCBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6088
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBCABCBBABABCBBAAACCBBBCAACBACCBCAAABAAAACABCBCAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe" start= auto displayName= "UserDataSvc_BCBBCABCBBABABCBBAAACCBBBCAACBACCBCAAABAAAACABCBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4852
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBCABCBBABABCBBAAACCBBBCAACBACCBCAAABAAAACABCBCAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2816
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBCABCBBABABCBBAAACCBBBCAACBACCBCAAABAAAACABCBCAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3580

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3888
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:712

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACAABBABCBBBCCBCCBBBBBBCBBBBBCBACACAACCABACBBBABCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABAACAABBABCBBBCCBCCBBBBBBCBBBBBCBACACAACCABACBBBABCBC.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3308

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
1⤵
- Executes dropped EXE
PID:5844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 c009892de9679950af360707baa88800a4e85df1951f32ebe5711e4c72db9381
MD5 d13e3a8e86b63f93db6e01cc8d2f7e32
SHA1 e7f9745b34f924e71eb6c9c004f66b0863289b6f
SHA512 85c09ee004eb2c7af1cbca337dfce7c05a950ace19c8fd62eef7473cbdc26c6274e2014ad455a2b0057bd52e1dbfca2362f773ee894ff00c301a23f13a75bc3d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 111b398f381d9f215c46d8851c70e05248b8b4ef69f857f081bad70e6708a28b
MD5 0f540db77c5f1e226b4d104a48314c1d
SHA1 c9d2c059b80f3d9094de59249632d657f591628a
SHA512 139ae7acb11bf10282ffa6b8f7999dc154439fc3944a776d77675427ee5c0c804a3729764e0a0892ba77f31c3b9aa3e628842d4807f0f1f216b3f3f1e69c3652
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 a0d2f80b5378d9ddac10466a632cdb01f4cf3b29b92deb6967b9eaeb5e023c29
MD5 9b057c49bb08c4fef150b03534658697
SHA1 0e8e60e40e41d3e1bc76af6ce58f20a138a8a405
SHA512 61f91bd1e20ae609cde43d9e2cc8e8160f0fd5545932d1c59b388dae09e2d054af0f72afa84eb467614723f498cfad295a9982b5e7aa5209d35e7c8eeb1bb5e1
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3339120a180f0eee08b2f4b5a5fd6aa0c69c552167e4fa604f542fea3856ee45
MD5 5649ba538998e4ac489596732ab35c90
SHA1 ab748be5bc7be3a503436c42d391d43f197b05e0
SHA512 13da01d3d58d800dcd6fd35cda8e83ecb9464c1c12a8125a2714034a31bcdc6d25dd1519f58f63307a2132290de76a9d17838dde3a5b12f5fd9144e171bd2b22
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4056e9c78584ad1cea33afe31c59ae627f21838c2b9516e452fba20bcab14d3c
MD5 ec62a31ba029c2075ce2344d76383074
SHA1 8f9288f1ad0bc89b32dc049d8bd45c847b6803f5
SHA512 aee7129557673c686b1286574f47dd1316d5ac2fd7c8d6f2107de2a3c3c15355e0a20257d59a33aaccc9a4959a30446de41c2a8be1ab9717fbd9e1579e4ef511
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 2aa082c0f96f4b12ee91521bbef6b87f9120526a3d324d164413e532dfd2c8ed
MD5 59bc219c82281bda94c7a8a36090b8b2
SHA1 4e1a00c04b8cb4503613c748d0abef085e632cf8
SHA512 01a64851a21da8305a745d8704b3b0751f139df490bf3c0a3d39eb5b3ebc1d263e2916b82b08cd01bca876bb563a970dbd55f063b2dcc89ac7196673f25f2370
MD5 SHA1 SHA512

Submit Download

svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABBACCABABBBCBAAAAAACBBBAAAAACCBBACCBCCCAAACABAACAACBAC.exe
Size 10.7MB
SHA256 1fd497a232de5e81f89138af5b230005d2e17182ec45a328e425775467e188ea
MD5 dec965cb2ba295de5ec78d58fb46f55b
SHA1 2ed5a7225861810bb2dba8d9720b859496bbe72d
SHA512 e2ebc43a0ab519730fe4905df8c448d24c2e335ffa14683f37c4fddb90effe757a8cfe1a3c3de074e87d3de2e4ee95a6ada94dda2d20e9a0d7d037a9cbdd9a9c
SSDEEP 49152:U+EpqatglxhOkXpH+EpqatglxhOkXpH+EpqatglxhOkXpH+EpqatglxhOkXpH+E0:iUtUtUtUtUtUtUtUtUQKRuy5a0
TLSH
T1FCB65C06B7D544B1E5730231496B42A68A76BC211F31D7CF63D4A27EAE33BC0BA31B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 181d0fc2b4e08e67f0f601952ffc71d6616b5229b3b32b6d5c87b2f8070b66b9
MD5 d2c96374630403e79e02d2af534bb7b9
SHA1 1fe0acf0ad436acfbbbfa684b6357057e193e50a
SHA512 3233d379de2b448edcb8edbf3aeaec513cd7aad1724dc2aec270b9d3b5b26355355796e97c01fbe2ecbcf49b4961d818955a661a0cc7e48ab803a8e443d0c3f1
TLSH
T1E111C162E4A59C13FDB268DF432DEFC30EAD376B585C6A54220546287799C329E190E2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3172-8-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/3172-0-0x00000000008F0000-0x0000000000911000-memory.dmp

Download

memory/3308-79-0x0000000000F80000-0x0000000000FA1000-memory.dmp

Download

memory/3888-32-0x0000000000C50000-0x0000000000C71000-memory.dmp

Download