4637c7ea87605f92638cee18eda26cb089f976269140d028518b9d2e2140120b

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/09/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe
Size 8.9MB
Sample260903-2eqllsttez
SHA256 4637c7ea87605f92638cee18eda26cb089f976269140d028518b9d2e2140120b
MD5 ccbce5e425c99caeac96a92f3e3468bd
SHA1 e362cd3895a52e8108e11ac6de924e334b82629d
SHA512 94d689c8d6f570dd4891366e478463a707b941109b279f98721cef3defe849e7e8a3baad4657ba0cbb6b7a4a95475b48f64d8a887c3be530e694279860f59c38
SSDEEP 49152:U+ETqatgl6+ES+ETqatgl6+ES+ETqatgliu+ETqatgl6+ES+ETqatgl6+ES+ETqp:s22U22U22U22U22U22U22U22o
TLSH
T1F0965C85FA4691B2D4270272489B92FB4770BC214F1297EBF789A33E5E337C05732A95
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
1776	svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe
3680	svchost_CABABCABBCAABCBCCABBBCAAACCACBBBCACABCCBCCABCCABCCBCABB.exe
4356	svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CBBBBACABCAACABAAABBBBBCBABABBACCCACCBCACACBCBCACABAABAA = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe"	2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_AABBBCACBAABCBBBCAACBACCABCCACCABBBBACCCBAAAABACABBCCBBB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CABABCABBCAABCBCCABBBCAAACCACBBBCACABCCBCCABCCABCCBCABB.exe"	svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3060	sc.exe
4252	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2688	cmd.exe
2388	cmd.exe
4772	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CABABCABBCAABCBCCABBBCAAACCACBBBCACABCCBCCABCCABCCBCABB.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5404	schtasks.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
3136	2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe
3136	2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe
3136	2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe
3136	2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe
1776	svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe
1776	svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe
1776	svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe
1776	svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3136	2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	1776	svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3136 wrote to memory of 2688	3136	2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe	95
PID 2688 wrote to memory of 5404	2688	cmd.exe	97
PID 1776 wrote to memory of 1552	1776	svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe	99
PID 3136 wrote to memory of 2388	3136	2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe	102
PID 2388 wrote to memory of 3060	2388	cmd.exe	104
PID 3136 wrote to memory of 4772	3136	2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe	105
PID 4772 wrote to memory of 4252	4772	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-03_ccbce5e425c99caeac96a92f3e3468bd_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3136
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCBCCACBACCACACCCAAAACBBBACCACCBABCABBACAAABCBCCAACBCABCCACBAAAACABAABBCBCCBBBABCACBAACACCABCCBABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACBCCBCCACBACCACACCCAAAACBBBACCACCBABCABBACAAABCBCCAACBCABCCACBAAAACABAABBCBCCBBBABCACBAACACCABCCBABAAA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5404
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CACCAABBBCCABCAABBABCCBAAACACBCBBBBACBBACAACBAAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe" start= auto displayName= "UserDataSvc_CACCAABBBCCABCAABBABCCBAAACACBCBBBBACBBACAACBAAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CACCAABBBCCABCAABBABCCBAAACACBCBBBBACBBACAACBAAABBC" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe" start= auto displayName= "UserDataSvc_CACCAABBBCCABCAABBABCCBAAACACBCBBBBACBBACAACBAAABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CACCAABBBCCABCAABBABCCBAAACACBCBBBBACBBACAACBAAABBC"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4772
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CACCAABBBCCABCAABBABCCBAAACACBCBBBBACBBACAACBAAABBC"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4252

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:1552

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCABBCAABCBCCABBBCAAACCACBBBCACABCCBCCABCCABCCBCABB.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CABABCABBCAABCBCCABBBCAAACCACBBBCACABCCBCCABCCABCCBCABB.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3680

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe
1⤵
- Executes dropped EXE
PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DebugMount.exe

Path C:\Users\Admin\Desktop\DebugMount.exe
Size 18.4MB
SHA256 39419030c4c8faca566998deef23ff8b0c819cb7ae204ba4379727864882b28f
MD5 5cb224ca9822be0b168b8e377d19d1e0
SHA1 e6036030eaa097f349da986edaa39a16441335ea
SHA512 46044bfff7de377b51da928981f19418911591dee6450181283c020ec6bdebdd2e621e404c01800a0ac1868afdbd83b05b3d09b1dfc7b75b0cd92cb1ec5f6ef6
SSDEEP 98304:s22U22U22U22U22U22U22U22R22U22U22U22U22U22U22U22USc7Ej6/:iy
TLSH
T197175C85FA4691B2D4270272489B92FB4770BC214F1297EBF789A33E5E337C05732A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 d4f28fadd745dd27014d0190cce604d29e285055984ff35d1f43cb1e5452c616
MD5 00d25ef1785125d6c07d520d6f13d80b
SHA1 633e61d6fe72075cc6753fffec1205c65d00a6a0
SHA512 4091b9034df824cda75f3a425283526c045b3287f4983ba9279d437fe1c3d35426a9a07108cc7f5d74fb71bc09498601bdf70db62fa2d0fdbd0480094c904fb3
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 6b0d423b69b73b12a59cde76477776cff26bfcb305dd7295b30a5ea33acd3329
MD5 3735eaa961427a4e4bcd4c867dd5aef2
SHA1 bfd65f4da439918aaf0de5daefc18c459008db04
SHA512 ff16276b17f12f0729c2ef3e9a504357d17948040fe8ee6a3be8942b402bbcccde353c1c3c181e6cc76a05e92d2ff2aba6c7555bacc09cc28b6658113cd63a0b
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 25b01e326672859d5275994fef330102e1a6a2b9c0efe46f8e1d11ae64c40562
MD5 9209feedc1e4a04d47da8bb80787d9f0
SHA1 cd16ae0776e6ccc6c74806562ff366437defe860
SHA512 280d6d89201f9d16391b83db2a817e45049d73fa6a60ef32c1ff40e757b16e7f8a09776f722b05eb32061c978088ed3c0a99fe46801157631606b4ba81f19e58
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 30d43d9c700929a19e71177a516c3b84e28183d8dd893b2caae7fa1b0e0e1a50
MD5 1cd3637aec39ecaf9742b4e01f59897d
SHA1 4962120a3cf29fc5f68c3c3d9a257e7cd2d21eb2
SHA512 542f636ffa045700290a2606942e22c4e8942ad6be0bd7bcaaabfa076c33c4a667bd9ba7053eb5dcf6ac046a5fe37d5ac9f88d285db229ddb8219ab2068ca4a8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 1795cc607594b6797836cbff905aacd1d725bd7f069d61425840165351bc8513
MD5 e575549fd1446c08cc804bf3ddf99df2
SHA1 4c45a3b73157373ded66c5f0af533ba5a2bfe91d
SHA512 3bc6f2d42061232dbbe612f2269c1a423a77fffbc412a24a5d768ed107f85f40cdc43992b884b7cfc0e2b5fda173f1f7abc5eb25a7f07b5b6c4a1b1a16f4eb15
MD5 SHA1 SHA512

Submit Download

ResetEdit.exe

Path C:\Users\Admin\Downloads\ResetEdit.exe
Size 5.9MB
SHA256 4ee4541b1ed11cd6a2b8502a73a4915426abff83719dd7af1013ef78f3769d45
MD5 6eaad06a0e3df09479b8243f133ae1d9
SHA1 a5c158cf5ae6e34b69405d4b9a6add8738156ca5
SHA512 24faaedafb298ac1416c60380edb96b3169a2c3188dc2d83cfa905a0e9c091d7d15df503abb30474c19951826bd45f6e2d43216ebb40fe60812997a3184926ac
SSDEEP 49152:U+ETqatgl6+ES+ETqatgl6+ES+ETqatgliu+ETqatgl6+ES+ETqatgl6+ES+ETqd:s22U22U22U22U22UE
TLSH
T191565C85FA4691B2D4270272489B92FB4770BC214F1297EBF789A33E5E337C09732695
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACABBBBCACBCBCABBACCACCAAACCCABBCCCBCCBAAACBCCCABACCCCA.exe
Size 8.9MB
SHA256 4637c7ea87605f92638cee18eda26cb089f976269140d028518b9d2e2140120b
MD5 ccbce5e425c99caeac96a92f3e3468bd
SHA1 e362cd3895a52e8108e11ac6de924e334b82629d
SHA512 94d689c8d6f570dd4891366e478463a707b941109b279f98721cef3defe849e7e8a3baad4657ba0cbb6b7a4a95475b48f64d8a887c3be530e694279860f59c38
SSDEEP 49152:U+ETqatgl6+ES+ETqatgl6+ES+ETqatgliu+ETqatgl6+ES+ETqatgl6+ES+ETqp:s22U22U22U22U22U22U22U22o
TLSH
T1F0965C85FA4691B2D4270272489B92FB4770BC214F1297EBF789A33E5E337C05732A95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1776-64-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/1776-44-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/1776-90-0x0000000000320000-0x0000000000341000-memory.dmp

Download

memory/3136-0-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/3136-63-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/3136-89-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/3136-30-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/3136-16-0x00000000002B0000-0x00000000002D1000-memory.dmp

Download

memory/3680-116-0x0000000000510000-0x0000000000531000-memory.dmp

Download