f6e6a85493f697aedda187986ba265cc5806ec5781550fa6477b9b8ea1f20420

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 22:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe
Size 10.6MB
Sample260830-2lta3sdf94
SHA256 f6e6a85493f697aedda187986ba265cc5806ec5781550fa6477b9b8ea1f20420
MD5 ffbecd7e0c757f050b73645cf03b1cb5
SHA1 e4262dc434e529e2f0634428e8bdc4784b269800
SHA512 f149a4bc023e93ea894e77970baf1e72e053d3082aab9661144afb8248f9001ebd44fb649092c3c812d60b86838da0dfed6af6ada9b293aa0088958675129dcf
SSDEEP 49152:U+E2+ES+EHqatgl1Pwqp+E2+ES+EHqatgl1Pwqp+E2+ES+EHqatgl1Pwqp+E2+E1:KOOOOOOOOL
TLSH
T1EEB67D50B6E50CA2E1BB117119B396660D32BA294B38D18FB6DD435F6D337C05A33BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3768	svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe
5552	svchost_ACCAACCABCABBCBABBACBBCABACACCACACBBBBCBACCCCAAACABCCAB.exe
1424	svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCABCBCCBACBBAABCCBACBCBBAABCBBCCBCBBACBAABABCABCBCCBCBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe"	2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABCBAABABCCABAACBCAAACCAABCAABCBCCCCCACAACBCBCCCACBCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCAACCABCABBCBABBACBBCABACACCACACBBBBCBACCCCAAACABCCAB.exe"	svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2080	sc.exe
2572	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3860	cmd.exe
5528	cmd.exe
1368	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCAACCABCABBCBABBACBBCABACACCACACBBBBCBACCCCAAACABCCAB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5676	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1696	2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe
1696	2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe
1696	2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe
1696	2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe
3768	svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe
3768	svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe
3768	svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe
3768	svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1696	2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	3768	svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1696 wrote to memory of 3860	1696	2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe	91
PID 3860 wrote to memory of 5676	3860	cmd.exe	93
PID 3768 wrote to memory of 5892	3768	svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe	94
PID 1696 wrote to memory of 5528	1696	2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe	97
PID 5528 wrote to memory of 2080	5528	cmd.exe	99
PID 1696 wrote to memory of 1368	1696	2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe	100
PID 1368 wrote to memory of 2572	1368	cmd.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_ffbecd7e0c757f050b73645cf03b1cb5_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1696
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCABAACAAACABACBCAACBACBBCCACBABACBCACCCBCAABAACABACCCACCBBCBCAABCCBAABBCBBCCCCCCBAAACABBAABBCCBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3860
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCABAACAAACABACBCAACBACBBCCACBABACBCACCCBCAABAACABACCCACCBBCBCAABCCBAABBCBBCCCCCCBAAACABBAABBCCBCACA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5676
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_BCBAACAAACCACCABABBBBACCBCACAABABCBCABBCACACCACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe" start= auto displayName= "UserDataSvc_BCBAACAAACCACCABABBBBACCBCACAABABCBCABBCACACCACCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_BCBAACAAACCACCABABBBBACCBCACAABABCBCABBCACACCACCAAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe" start= auto displayName= "UserDataSvc_BCBAACAAACCACCABABBBBACCBCACAABABCBCABBCACACCACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_BCBAACAAACCACCABABBBBACCBCACAABABCBCABBCACACCACCAAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1368
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_BCBAACAAACCACCABABBBBACCBCACAABABCBCABBCACACCACCAAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2572

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3768
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:5892

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACCABCABBCBABBACBBCABACACCACACBBBBCBACCCCAAACABCCAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCAACCABCABBCBABBACBBCABACACCACACBBBBCBACCCCAAACABCCAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe
1⤵
- Executes dropped EXE
PID:1424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 0dc130b5b8f55b6388455d51acf335f11fc935bc32b71ec6430a4365dc5f11c8
MD5 20a08b71d3d771486d50978e3fbe4d88
SHA1 8c87ea2373c109945d97951aa671fd4f5664be38
SHA512 5f6809c387415de2c9d41baab8e4797f24270fe8cb6a6944ae1b53103e67ba5e529fa292015a2898473cc0508e2373e672994abb852b7f7c47821ef34fac2ffb
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3b1b8e48ae5cbc2f1e7a73b97db9c7550f993acdce9bddc36d61688cc069594d
MD5 6c3353f7058a10ad726b3e3d4c214d68
SHA1 8707eaf69488e0df7e4fa1368fd40880fb39bbf9
SHA512 717a06a13138744a0858b0aee5aec13f088722b2c184f9ebb9285ec5d1e701065cad607cc6d76298c97f76629d37b24e31a68d8416a01f01fa01a79463320eac
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 99ec210af0b4a2b5a1a9a1762be48bd321abc4807142f9da6944f55a3b687d16
MD5 b8b4cdf03e0e94dc23a770ff716a92b3
SHA1 24311949f34ef15f0e33972b65517fe270c77b28
SHA512 c284e58a60bcc6f4bc375f7a053870fc0622f6a1c350f2604dc97e44fdbd5785f9fccd1d6a0679b1b34d2d00a586a72f6acc775e6a3cadecf734202c37741f64
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 3859f5e0563cdf32bcced834ddd4b7ad4fee5bd0a755fa6171d4f8986580afca
MD5 c7c3349be7b43a35f8d5ec059fe0beab
SHA1 cae8d86286187d0553b9de84361af6db141c24a8
SHA512 faa5af8157d2e6736dff43e30d312487346a8a612348b13030163c8f2e790208ce7da96cfb2871bb02817a248462c1ddacd8eaed991a6436b925504c4cef1e60
MD5 SHA1 SHA512

Submit Download

ExitMove.exe

Path C:\Users\Admin\Downloads\ExitMove.exe
Size 32.0MB
SHA256 bf21feb05e78cf424ba1e537e93e3aaa716946bb16a16b485b497d079a55695e
MD5 a00cd1c23d68405a50d6ddf654dab59e
SHA1 a31819c714af0c28deee3f83026e82143437b623
SHA512 f70adce7c56d09cbd74b5476d24b6ed23a7a36efb9b7b6c18e7e432a436d0f1053a1be16bffeacf266f025fd2acefb68c8ccd949a3c4e7b13a10c7b0d84344ab
SSDEEP 49152:U+E2+ES+EHqatgl1Pwqp+E2+ES+EHqatgl1Pwqp+E2+ES+EHqatgl1Pwqp+E2+EA:KOOOOOOOOOOOOOOOOOOOOOOOOOO6ipIB
TLSH
T10C777D50B6E50CA2E1BB117119B396660D32BA294B38D18FB6DD435F6D337C05A33BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ExitMove.exe

Path C:\Users\Admin\Downloads\ExitMove.exe
Size 1.2MB
SHA256 5fb73c92dce7818eeea190032106c6752e105c982f28ab85fd93fb4e15fd0ba6
MD5 009511455adc41da09e04e8ffb00f4fe
SHA1 dc095e4986c8fd5d53f71f302db2b3bdab3e0792
SHA512 5e884053e5378d11d55040a39dc73d02ce9e09b2e83a6e9e66c3be6ece2cb68aacc31ea4353cdc653ec15aedc313a4bcab6e0fc39663d1a147fc39c70cb0591b
SSDEEP 24576:m9+EM0O9+EM0q9+EM0qzExqatgl8byVt1+qwA9+EM0I:U+E2+ES+EHqatgl1Pwqp+Ei
TLSH
T1C9557C50B6E50CA2E0BB117119B396760D31BA2A4B38D58FB69D435F6D33BC05933BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 0be36f4352b92676e1ee206d1f4398f17885ddbcbda7523f1d1c48b344f4dc61
MD5 4bf063b16d49ccc08c34f1eaf4c596b3
SHA1 d6544c2ee5769a6f528fa740b62ca9cb6cccdf94
SHA512 20ada1e203582dcedfc88816c4ca67ef891149c167a375b905ec1b8ebe7e9bfdccbe69b6193345634f873166adebd84e46b559b067a60b182a8cf4e4ad4de2d2
MD5 SHA1 SHA512

Submit Download

svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACBBCBBACBCCBBACACABCCBCCBAACCAABABCBACABBCAAAABACBBAAB.exe
Size 10.6MB
SHA256 f6e6a85493f697aedda187986ba265cc5806ec5781550fa6477b9b8ea1f20420
MD5 ffbecd7e0c757f050b73645cf03b1cb5
SHA1 e4262dc434e529e2f0634428e8bdc4784b269800
SHA512 f149a4bc023e93ea894e77970baf1e72e053d3082aab9661144afb8248f9001ebd44fb649092c3c812d60b86838da0dfed6af6ada9b293aa0088958675129dcf
SSDEEP 49152:U+E2+ES+EHqatgl1Pwqp+E2+ES+EHqatgl1Pwqp+E2+ES+EHqatgl1Pwqp+E2+E1:KOOOOOOOOL
TLSH
T1EEB67D50B6E50CA2E1BB117119B396660D32BA294B38D18FB6DD435F6D337C05A33BE2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1424-95-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/1696-86-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1696-60-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1696-34-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1696-0-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1696-22-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/1696-11-0x0000000000F30000-0x0000000000F51000-memory.dmp

Download

memory/3768-48-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/3768-70-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/3768-33-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/3768-94-0x00000000003F0000-0x0000000000411000-memory.dmp

Download

memory/5552-93-0x0000000000270000-0x0000000000291000-memory.dmp

Download