db53da6b0f15db3c82fba458d2d12a7ebadd0d951aee730e8683769b70a8d9ba

Analysis

max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe
Size 1.3MB
Sample260831-bqds3sshng
SHA256 db53da6b0f15db3c82fba458d2d12a7ebadd0d951aee730e8683769b70a8d9ba
MD5 eeece6b2fee0a299225fa4ebd343b45b
SHA1 2a608e9337b4a9be2b75ca3774329cfd9145599f
SHA512 d14411bcb3ccbfd090ea4fd5cf4939f882b045a1951f1b4912f17a8591c3f599d36a0ddccf3ff46f0a192cf57a848e42d376a635c53aad453122179e02399269
SSDEEP 24576:m9+EM0t9+EM0t9+EM0t9+EM0/9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+J:U+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+ExY
TLSH
T1BD553C0AF94780B2D92B41B00CCBE3BF8A70BA2589128E77FB4DC76FB933B516515255
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
3136	svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
2180	svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
3728	svchost_CCCBAACBACCCBBCCAAACCCABACCCCAACBBCABCBABCBBBBBCCCAAAAB.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_BBBCBCCBCCBACBBBCAACCABBAACABBACCCCACCCACBBBAAACCACABABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe"	2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Update_CBABCCBAABAABBABAACCABAAACCBAACBCBACCABAACBAACBCBBBAAABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CCCBAACBACCCBBCCAAACCCABACCCCAACBBCABCBABCBBBBBCCCAAAAB.exe"	svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5056	sc.exe
3548	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1904	cmd.exe
3964	cmd.exe
4304	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CCCBAACBACCCBBCCAAACCCABACCCCAACBBCABCBABCBBBBBCCCAAAAB.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings	calc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2000	2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe
2000	2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe
2000	2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe
2000	2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe
3136	svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
3136	svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
3136	svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
3136	svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2000	2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	3136	svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4436	OpenWith.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2000 wrote to memory of 4304	2000	2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe	96
PID 4304 wrote to memory of 2888	4304	cmd.exe	98
PID 2000 wrote to memory of 1904	2000	2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe	99
PID 1904 wrote to memory of 5056	1904	cmd.exe	101
PID 2000 wrote to memory of 3964	2000	2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe	102
PID 3964 wrote to memory of 3548	3964	cmd.exe	104
PID 3136 wrote to memory of 4516	3136	svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe	106
PID 4516 wrote to memory of 4236	4516	notepad.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_eeece6b2fee0a299225fa4ebd343b45b_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCCABAAACCAACCABAABCCCAAAAACCCBACACACCAAABAAACBCBBCBBBABACCAACBBCCAABBCCCCCABBACCCCCAABAAAABBCBCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BBBCCCABAAACCAACCABAABCCCAAAAACCCBACACACCAAABAAACBCBBCBBBABACCAACBBCCAABBCCCCCABBACCCCCAABAAAABBCBCACCB" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2888
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CAACBACABCCCABACCACAABBAACBCBBBBCCACCACCAACBBBCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe" start= auto displayName= "UserDataSvc_CAACBACABCCCABACCACAABBAACBCBBBBCCACCACCAACBBBCACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1904
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CAACBACABCCCABACCACAABBAACBCBBBBCCACCACCAACBBBCACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe" start= auto displayName= "UserDataSvc_CAACBACABCCCABACCACAABBAACBCBBBBCCACCACCAACBBBCACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5056
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CAACBACABCCCABACCACAABBAACBCBBBBCCACCACCAACBBBCACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3964
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CAACBACABCCCABACCACAABBAACBCBBBBCCACCACCAACBBBCACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3548

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\notepad.exe
  "notepad.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4516
- - C:\Windows\SysWOW64\calc.exe
    calc.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    PID:4236

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
1⤵
- Executes dropped EXE
PID:2180

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:4436

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAACBACCCBBCCAAACCCABACCCCAACBBCABCBABCBBBBBCCCAAAAB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CCCBAACBACCCBBCCAAACCCABACCCCAACBBCABCBABCBBBBBCCCAAAAB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 79e7d29f4afcdba25be3114205fd8a56d2d7ef4cda3d7c18b7eabc061e882e30
MD5 d0f098712d5d03b2b4d5095c8c27ff60
SHA1 10a5e8ae3e5a03981c676c2f10965417b77b38f4
SHA512 4b870bbda0c35807f1932590907cc33654ae8d8bc48fb3676df4eedb22ac2bda29ea531b48cc3396c70ce0c81d8bd1121fc093406435b4505aa9e75ead17e4c7
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 50a9e5540fff6c8644a859822ccc7212f3f58bd699e6a73100081ddbefdb386e
MD5 17dcc01e0f1f3812ed68184716acbd6a
SHA1 77cfc29a89a0aa9ead2ebdd4b59293182b2f8d55
SHA512 25d2d61233a6f21c89185d873ab140d005cf3ca09b2c379adc565d1afac50b51d1bab863bbe0929338a9ac3526c3c5ff8603fd5f74606526fc76fdbd1feac010
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 62c9a6bb4320bd799aed35cd8f768e51803a710e583e0985c34d4098c210d166
MD5 bfde212c847168ac588e0c48a7df0abe
SHA1 3dc76f612901b4229fa165bd255d7f5f114e3b65
SHA512 faf00da6015cb49637553bd08b2d2069ad0ebfa10a2fd6725b50c48cefbec04b8ad65878d813733ca813637b95033474ac9712752343315c83012a5860f3e062
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 7b9924ba1f53365f813e1229a75c911f72f39aa7ace51e36b535c05370fed7ff
MD5 04de13051b21229f59c339e3835f07e9
SHA1 cea1c918612282a56330acb40878aca70585b870
SHA512 440d5e6e13881f7e332968d1b590cab0154b37fa192896ca28a67471aa32a93c90f54e245d6c5b1603fba9b6bfaabc75fe26987bd1e1a27915a66c6509793d19
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 97328b9af98a16edb0210286f909f1885aba45cdb76e44380dd349eb7fedae42
MD5 f001b5da17ea24ca003ee36431373e42
SHA1 269c9c06f5ddeb021a927a15fee39d0d9b93f38a
SHA512 6f72f2ad6d0a648c53b051f68f0ed0ce0ccb17275ca5d91244ee8926fc878c43e2f027b4c050c27ed2c5447881229ab8d12f95921cec8a1231ca7dc6680ec59d
MD5 SHA1 SHA512

Submit Download

svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BABBCCACAABBACACACBCBBCCABBBBCCAACCCCBCCACBBCCBCBCCBCBC.exe
Size 1.3MB
SHA256 db53da6b0f15db3c82fba458d2d12a7ebadd0d951aee730e8683769b70a8d9ba
MD5 eeece6b2fee0a299225fa4ebd343b45b
SHA1 2a608e9337b4a9be2b75ca3774329cfd9145599f
SHA512 d14411bcb3ccbfd090ea4fd5cf4939f882b045a1951f1b4912f17a8591c3f599d36a0ddccf3ff46f0a192cf57a848e42d376a635c53aad453122179e02399269
SSDEEP 24576:m9+EM0t9+EM0t9+EM0t9+EM0/9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+EM0t9+J:U+Ex+Ex+Ex+Ev+Ex+Ex+Ex+Ex+Ex+ExY
TLSH
T1BD553C0AF94780B2D92B41B00CCBE3BF8A70BA2589128E77FB4DC76FB933B516515255
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2000-6-0x0000000000270000-0x0000000000291000-memory.dmp

Download

memory/2180-74-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/3136-25-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/3136-38-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download

memory/3728-82-0x0000000000500000-0x0000000000521000-memory.dmp

Download

memory/4516-67-0x0000000004E40000-0x0000000004E41000-memory.dmp

Download