ec79ba06a7247f706e2baff65fbacc0c90269bd817aff0e645348777fb2dc885

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/08/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe
Size 9.2MB
Sample260827-s2ryhsxcla
SHA256 ec79ba06a7247f706e2baff65fbacc0c90269bd817aff0e645348777fb2dc885
MD5 6c90c5aaed88c20a21d38b87cc7f5641
SHA1 da6a09388d69672ed129cafbcc3abac2eb34f284
SHA512 cf17ea3e95c2fada57d33de080d4271ec014e443764796274d401fddcbf54c2b2143b7b59574c066d8e6a991affd6bcf33f245006cd32e3d553d3128fcdbc919
SSDEEP 196608:F525a525a525a525a525a525a525a525e:F525a525a525a525a525a525a525a52I
TLSH
T129A65B9DBB866152EA3341B18C9AC2F76D70B8204B2187EFB545F71D1E33AD0E63B245
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
2268	svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
4660	svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
3164	svchost_CACCCBBCABBBABCBACCCACBCACABAACACBBCCCCCCACACACBBCBCBAA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ABBAACACCCACABACBABBABCCBACBCBBCAABBAAAACBBABACAABCCAABA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe"	2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AAABAACCCBCCCCAABABBCBBABABCAACBBABBCCCBAAABBCBAABCCABBA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CACCCBBCABBBABCBACCCACBCACABAACACBBCCCCCCACACACBBCBCBAA.exe"	svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1516	sc.exe
2576	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4892	cmd.exe
4780	cmd.exe
416	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CACCCBBCABBBABCBACCCACBCACABAACACBBCCCCCCACACACBBCBCBAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2056	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
5972	2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe
5972	2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe
5972	2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe
5972	2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe
2268	svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
2268	svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
2268	svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
2268	svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5972	2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	2268	svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 5972 wrote to memory of 4892	5972	2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe	96
PID 4892 wrote to memory of 2056	4892	cmd.exe	98
PID 5972 wrote to memory of 4780	5972	2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe	101
PID 4780 wrote to memory of 1516	4780	cmd.exe	103
PID 5972 wrote to memory of 416	5972	2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe	104
PID 416 wrote to memory of 2576	416	cmd.exe	106
PID 2268 wrote to memory of 2924	2268	svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe	109

C:\Users\Admin\AppData\Local\Temp\2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_6c90c5aaed88c20a21d38b87cc7f5641_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5972
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABBACCABBBACAAABCABBBABABAABCBCAACABBABCABBBBAACBCBAAAACBCBCCCABBCCCABCBBBCACBCCAACBBBCBCCABAABCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4892
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_CBAABBACCABBBACAAABCABBBABABAABCBCAACABBABCABBBBAACBCBAAAACBCBCCCABBCCCABCBBBCACBCCAACBBBCBCCABAABCBCAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBBCAACBCBCBAACACBBAAABBBACBBAACCBCABCCACCACACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe" start= auto displayName= "UserDataSvc_BCBBCAACBCBCBAACACBBAAABBBACBBAACCBCABCCACCACACACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4780
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBBCAACBCBCBAACACBBAAABBBACBBAACCBCABCCACCACACACCC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe" start= auto displayName= "UserDataSvc_BCBBCAACBCBCBAACACBBAAABBBACBBAACCBCABCCACCACACACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1516
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBBCAACBCBCBAACACBBAAABBBACBBAACCBCABCCACCACACACCC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:416
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBBCAACBCBCBAACACBBAAABBBACBBAACCBCABCCACCACACACCC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2576

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2924

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
1⤵
- Executes dropped EXE
PID:4660

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBBCABBBABCBACCCACBCACABAACACBBCCCCCCACACACBBCBCBAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CACCCBBCABBBABCBACCCACBCACABAACACBBCCCCCCACACACBBCBCBAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

UndoShow.exe

Path C:\Users\Admin\Desktop\UndoShow.exe
Size 28.5MB
SHA256 beb5b3e24f72089fbf79611a9624cd282305e5c871fb799b6c1e00ee09f6e549
MD5 762d63f7b2430b23bdcee69bab8a4241
SHA1 e8e377cf9855da4f9f0e45d662f54296127412bc
SHA512 7be0b2608f73fb8150bd61d927d0ad75a1329d5256823a6983c4401ffc17ee9b5e44aa4317b4b4d80fd34ba9e1440b2bc1ac24227a913858e7f13eee10a438fb
SSDEEP 786432:F525a525a525a525a525a525a525a525i525a525a525a525a525a525a525a520:L
TLSH
T107675B9DBB866152EA3341B18C9AC2F76D70B9204B2187EFB545F31D1E33AD0E63B245
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UndoShow.exe

Path C:\Users\Admin\Desktop\UndoShow.exe
Size 1024KB
SHA256 f678a728b0fe02623fd81a15abd542da21ad3d9d01e78b63bd51eed5e63c0ad8
MD5 935415e8bb5345d2450947f571f2440f
SHA1 84c311414101554b1d975324028dc15bb1eda145
SHA512 e854ebc386d1b2021ffcea1c07a721a19eb5520453bca736c90e4e4b90539da21b1b59d4a6774016ac62d93dded7f5ace6fc26f1d5f3951dc294559b7600c071
SSDEEP 24576:m9+EM0q9+EM0iExqatglBrYn5T9+EM0q9+EM0iExqatglBrYN:U+ES+ETqatglpY5J+ES+ETqatglpYN
TLSH
T17E255C9DBB866162D92741B1888BC2F76D70B9204F214BEFB645F32D1E336D0E23B645
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3999b811c9fa7beb345e7e56e3bfb4816a8a581d3a17bac9271a45bc0fbb93e8
MD5 b928d1b6014dbabd0c77b4a0c8bcd9e9
SHA1 d553569d06689ed5edba1c7c4f4cee40e8999cd4
SHA512 0bc99350f45c8e9e5023e37c89b6f23ca8bbf05c8d9460e5be947b9e92e281659d2b278ddd408f3bf142ecad2189ed9c4d3dca73cf46ee375836c451bfbe71ae
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 951a124b5a43e8ee0764de203f7b395d909fd9e1a6a4d047b24706a94c16ea92
MD5 2db951eeec73c92c44c0bc451e84d523
SHA1 7d90e8e11a27993435c1378d92491fd133244217
SHA512 fa4f97cdff3830273c9eee12a6223b7bdcbe65af501a88255137d35f1e25f9db3fbdf9a36d0e480aab59af0bae5dd75826f36046c4ac596cd97aa370c6261c86
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7837d1335a161998417d3aee9d11f147ae76b1912d19f214968b08f779661b89
MD5 ccf4d9f33e386867d851e6759d7fc77c
SHA1 80ccbc43c0ab22b498ba5a55bb397b7d707c2467
SHA512 8aee4ab4987ea59cb125cbbaf17c1730b06be329cdd927efd26cbc3d5b60a596239cae9dce4ec7bd4ee2310b95abda6c96bab1b8a38f743463c4e93ea2e45533
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 028fafeafcd6fadc7b357fbb747d664d4d2c1417836d536841e27ef1050dc2e7
MD5 d803d3c033718b8e49a889806d928157
SHA1 0ad33382d2e05fe33153e9ee555cb22df572f325
SHA512 1bcf25ecc2edbd7232941afbd79bd5a416a11d0391d8bb071496db68b86cc52fc91ff68e27645a174d7dc1ae8a243436491787951b97ff309be67863eafe3167
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c7287ff20dae7ff52b14acf29d47598e885d8524d7eacf4c1a7f443331a548de
MD5 a11c500cede59f106aa5a5ead6d3516a
SHA1 2832d09dcdad72e0a4e109ed79117228e7ab3698
SHA512 3645f5a6f107d28f483e518ec0678d4e3c5ac3fdaca9f5c4b9935c978784a5b8f91d95bdc9e4c327f307ce3541b179c5a2aecf261effcaa2996eb9c901228935
MD5 SHA1 SHA512

Submit Download

svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ABAAABBBCCACAACCAACABAABCAABCBCCBBAABABCBBBCABBBBBCCCBB.exe
Size 9.2MB
SHA256 ec79ba06a7247f706e2baff65fbacc0c90269bd817aff0e645348777fb2dc885
MD5 6c90c5aaed88c20a21d38b87cc7f5641
SHA1 da6a09388d69672ed129cafbcc3abac2eb34f284
SHA512 cf17ea3e95c2fada57d33de080d4271ec014e443764796274d401fddcbf54c2b2143b7b59574c066d8e6a991affd6bcf33f245006cd32e3d553d3128fcdbc919
SSDEEP 196608:F525a525a525a525a525a525a525a525e:F525a525a525a525a525a525a525a52I
TLSH
T129A65B9DBB866152EA3341B18C9AC2F76D70B8204B2187EFB545F71D1E33AD0E63B245
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2268-72-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/2268-33-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/2268-51-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/4660-88-0x00000000002C0000-0x00000000002E1000-memory.dmp

Download

memory/5972-22-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/5972-0-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/5972-60-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/5972-11-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/5972-84-0x0000000000080000-0x00000000000A1000-memory.dmp

Download

memory/5972-34-0x0000000000080000-0x00000000000A1000-memory.dmp

Download