28062f25e7cb3a7d7be063824745137894d54e2505c0c49f70654015f3436f75

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe
Size 3.8MB
Sample260818-px1hbabl21
SHA256 28062f25e7cb3a7d7be063824745137894d54e2505c0c49f70654015f3436f75
MD5 eabc0878ed0a27923dbe5955aa32bf87
SHA1 f7cdce5421d69b65489640d0c9c97ed18f385a18
SHA512 037e81919ee0314313c09eb10de5e2b806a14248865ebe1b366f08765755ac8b2431484849d2d072f75a0134788ad7b67c3cb02cbf9d7308def3d95109a846ab
SSDEEP 49152:U+ES+ES+Ekqatgll+ES+ES+Ekqatgll+ES+ES+Ekqatgll+ES+ES+Ekqatgll+Eh:fhhhhhhh2
TLSH
T141167D45F9469072D82B01B14CCFD2FF8670BD218F128AEBF789A72E6933BD05236655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1696	svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe
696	svchost_BBBABABCACCCCACBBCBBBBAAABCBABCCBABAAAAAAACBCAAACACBCAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBBBABAAACBBACBACBAABBBABBACBAACCCACBAACCCBCCABCCBACAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe"	2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABAAABBAABCAACCBBCACABCACAABAAACBCCABACCAAABCCBCAACABAAB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBABABCACCCCACBBCBBBBAAABCBABCCBABAAAAAAACBCAAACACBCAA.exe"	svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3660	cmd.exe
4168	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBABABCACCCCACBBCBBBBAAABCBABCCBABAAAAAAACBCAAACACBCAA.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5064	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4628	2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe
4628	2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe
4628	2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe
4628	2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe
1696	svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe
1696	svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe
1696	svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe
1696	svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4628	2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	1696	svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3660	4628	2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe	91
PID 3660 wrote to memory of 5064	3660	cmd.exe	93
PID 1696 wrote to memory of 2612	1696	svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe	94
PID 4628 wrote to memory of 4168	4628	2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_eabc0878ed0a27923dbe5955aa32bf87_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABBACBCBAAACCABBABBBAAAACCBCBAABBBCACCABCAACCABCBBAACAACCBAABABBCBAACBACBBACCBACBAACCCBCACCABCCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACABABBACBCBAAACCABBABBBAAAACCBCBAABBBCACCABCAACCABCBBAACAACCBAABABBCBAACBACBBACCBACBAACCCBCACCABCCACAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5064
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACCCACBBCBABCBABBAACCACBBCABAABCBCCBABABAAAACBABC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe" start= auto displayName= "UserDataSvc_CAACCCACBBCBABCBABBAACCACBBCABAABCBCCBABABAAAACBABC"
  2⤵
  - Executes a command shell one-liner
  PID:4168

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2612

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABCACCCCACBBCBBBBAAABCBABCCBABAAAAAAACBCAAACACBCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBABABCACCCCACBBCBBBBAAABCBABCCBABAAAAAAACBCAAACACBCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bab97dac316cf0b279e86863e93e7fe140707530ecadfe7919c018b2a292d141
MD5 702b71f88c8f78c17e7e8f5ab159b131
SHA1 72b3b682cf04076091733c341c8d2dde67ead3ac
SHA512 1c396b6615292913662f23f95608082a94c19f7cf6a0ca896b7b47d2821253b4a386bd7d3fbd79076a109c3404e1ad0681a2697196a5c83157e18dadd6fd8fe8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b98a770b293663f880e2fd369da75f221614eb8fef3842603e55802314c7e18
MD5 3332d26f27c2ed78f4382fb7b8bf7e50
SHA1 655f55e7e7757a227fc5a2688c8f507ccfd7684c
SHA512 788e5924de8b2b6cf42e85539c9b17fbf76b87d0f202bca2742c8b5cdf738523665a07d19b70c9fed081a868844fa51c076742fc588c1ab42a63c2fba5bb3f2f
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 61203888133a2df882f388b0b2c1092293a8b22f1ae277c22c8ffe4989801bb6
MD5 f9ef7754ffb497e481935b7938655296
SHA1 20e6713592eec8ac9c4a204441ae026e1fd18c32
SHA512 7f1a412cc944757072a42371a0bb1f73a4c10b3b67e79b83b02bb2157452ceec4062b4cdf8a58799e5a84439edaca36dc0fe3eb2a43f82039c49c5f7b5f4d878
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e6faad5d0af2869479209f45ec4f579f9459dc7ad5ec0ec577989bdca1e2a5a8
MD5 d39f40dfdd67966b0eea64b3da5059f6
SHA1 2adf6b738b51f8c7ad92d369ca9f5d2dfac63d03
SHA512 e1a4f698806b4ceb417f2e40ec0c4ec880c4724dff4ea204bcaa068011d2534a4f7ae88408bcfddcddad485455cf18269a8914424e5bd1fa813f0e781c326337
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 9751378299721e2f6c7b6788d7013f9991f81bfb3501c3a596c401db85295b0e
MD5 e0174f452ba62c0ad8172e3a083f0b51
SHA1 e7c4e3726e3abdd7371fd7050f45086d59eed9b6
SHA512 d835ea4bda013f93f8ef1f2a14230f0a0d7a8a3874aded11ecaf82493f6372dfd3589c708c2f78da3791cb8585fc490892bc9544046faccddee8d865d45972de
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 f1b78a0409d18f8d9176fa1a588b39a1957a7c996abc35c16a638c9fa2b6638a
MD5 f4185980d6423b7400a90998e214a08d
SHA1 6fed8a97807ca7cc97ae420a8ccb64d20fd1c576
SHA512 ef9d0faf86358f2de6c2d2f70ba721518533c32ebc691eeedfb0829e07b71d71f6a5ee5b3b699476c135d963ca1680b616c6c290094b6ac0a38aafbfd929dd8a
MD5 SHA1 SHA512

Submit Download

svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABACABBAACCACABAACBACBCBBACAABCCBBBCBAACBCBBCCABCACBAAC.exe
Size 3.8MB
SHA256 28062f25e7cb3a7d7be063824745137894d54e2505c0c49f70654015f3436f75
MD5 eabc0878ed0a27923dbe5955aa32bf87
SHA1 f7cdce5421d69b65489640d0c9c97ed18f385a18
SHA512 037e81919ee0314313c09eb10de5e2b806a14248865ebe1b366f08765755ac8b2431484849d2d072f75a0134788ad7b67c3cb02cbf9d7308def3d95109a846ab
SSDEEP 49152:U+ES+ES+Ekqatgll+ES+ES+Ekqatgll+ES+ES+Ekqatgll+ES+ES+Ekqatgll+Eh:fhhhhhhh2
TLSH
T141167D45F9469072D82B01B14CCFD2FF8670BD218F128AEBF789A72E6933BD05236655
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-65-0x00000000001E0000-0x0000000000201000-memory.dmp

Download

memory/1696-35-0x0000000000D70000-0x0000000000D91000-memory.dmp

Download

memory/4628-0-0x00000000000F0000-0x0000000000111000-memory.dmp

Download

memory/4628-8-0x00000000000F0000-0x0000000000111000-memory.dmp

Download