52ad9f7b0babcd6d91ea77fc2a6d9c8e5a7aec8c8557b43c1efccb4fbd6790fd

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe
Size 14.5MB
Sample260906-vd3ffsdn4v
SHA256 52ad9f7b0babcd6d91ea77fc2a6d9c8e5a7aec8c8557b43c1efccb4fbd6790fd
MD5 d78df70cd51efa4eb78a73eea11c2666
SHA1 36fe87482dd7fc6f07e32d323d0046e094133060
SHA512 05fdea942911f861837f4e4167e9fcd00269241b3d818c0811c7fde18586f4f660d9deadf2c38a35432dc77c51a9481f285b93b00061648b07c622dde84ba4b3
SSDEEP 98304:g350R350l350R350l3501l350R350l350R350l350R350l350:25y5O5y5O565y5O5y5O5y5O5
TLSH
T183E64B49BBE95151F9B342708CAAC2B69D317C204F2197EF6680F32D5E336D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
5568	svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
2808	svchost_CBBBBBBACACCACAAACABBCBAACCAACABCCCBAABACBCCCACBCBACABA.exe
3460	svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_CCCACABBBBCBCBBCBAABACAACBCBABBBCCABBBABBBBCCBCCBAACCABB = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_CBBBBBBACACCACAAACABBCBAACCAACABCCCBAABACBCCCACBCBACABA.exe"	svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BABACCAABAACBBABCBCCBCABCBAAAABCCCBCCABBCBBCCACAAACBBBAC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe"	2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5740	sc.exe
2136	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5952	cmd.exe
672	cmd.exe
4188	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_CBBBBBBACACCACAAACABBCBAACCAACABCCCBAABACBCCCACBCBACABA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1936	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3456	2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe
3456	2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe
3456	2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe
3456	2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe
5568	svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
5568	svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
5568	svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
5568	svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
2808	svchost_CBBBBBBACACCACAAACABBCBAACCAACABCCCBAABACBCCCACBCBACABA.exe
2808	svchost_CBBBBBBACACCACAAACABBCBAACCAACABCCCBAABACBCCCACBCBACABA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3456	2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	5568	svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
Token: SeDebugPrivilege	2808	svchost_CBBBBBBACACCACAAACABBCBAACCAACABCCCBAABACBCCCACBCBACABA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 5952	3456	2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe	94
PID 5952 wrote to memory of 1936	5952	cmd.exe	96
PID 5568 wrote to memory of 2716	5568	svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe	98
PID 3456 wrote to memory of 672	3456	2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe	101
PID 672 wrote to memory of 5740	672	cmd.exe	103
PID 3456 wrote to memory of 4188	3456	2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe	104
PID 4188 wrote to memory of 2136	4188	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_d78df70cd51efa4eb78a73eea11c2666_amadey_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBAAACACCAABCAACABCBBBBACAABBBBBCBACBBBBABCBACBBAABBCBBCBBBAACCCACBACBBBABABACACAACAACBCBBACABAABBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5952
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_BABBAAACACCAABCAACABCBBBBACAABBBBBCBACBBBBABCBACBBAABBCBBCBBBAACCCACBACBBBABABACACAACAACBCBBACABAABBCBA" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1936
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_CCCABAAABBCAAACCCBABBBCCCCAABBAABCACCABCABBCAACACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe" start= auto displayName= "UserDataSvc_CCCABAAABBCAAACCCBABBBCCCCAABBAABCACCABCABBCAACACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_CCCABAAABBCAAACCCBABBBCCCCAABBAABCACCABCABBCAACACAA" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe" start= auto displayName= "UserDataSvc_CCCABAAABBCAAACCCBABBBCCCCAABBAABCACCABCABBCAACACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:5740
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_CCCABAAABBCAAACCCBABBBCCCCAABBAABCACCABCABBCAACACAA"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4188
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_CCCABAAABBCAAACCCBABBBCCCCAABBAABCACCABCABBCAACACAA"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:2136

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5568
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2716

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBBACACCACAAACABBCBAACCAACABCCCBAABACBCCCACBCBACABA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_CBBBBBBACACCACAAACABBCBAACCAACABCCCBAABACBCCCACBCBACABA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
1⤵
- Executes dropped EXE
PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

PingSubmit.exe

Path C:\Users\Admin\Desktop\PingSubmit.exe
Size 29.6MB
SHA256 c827a22919c456020bae59893ae366ce6e3f84a4e46363835615a34467ac3ac1
MD5 e2132a5bddc98949632ca010026bfefa
SHA1 b9a32b1b4495eec94e93107cdf0072641ee7e620
SHA512 3d6db399f28b817b69983c523b4b134b3fd10d8bf190a368cdb934e33228608ba5e64fea2268547953592acc6f158cc05f7c69e2fdde7957874e3631f06d0400
SSDEEP 786432:25y5O5y5O565y5O5y5O5y5O5M5y5O5y5O565y5O5y5O5y5O53:l
TLSH
T1D9674B49BBE95151F9B342708CAAC2B69D317C204F2197EF6680F32D5E336D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 2f5dac3cd83cf32941958e54c110dadfc342f96ff860676bbe5d725ad2eec141
MD5 a758f6165030d79f7e933ff746e9d442
SHA1 19aac291c29b794f23809bd9fddf5c8570f3b26c
SHA512 dc4ca6d8ec984796baad151d6b04bae96b0db019e7d0969f0778a345b4b6076b4f95cd3607aa5117cb1252ce59ef0350f0b31c864f75916a5bfc9619bdb41a81
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 aa918d99fb8c6dcd38957ce2c8ccdaaae31a6f37bcf1d2d6dc780112c5d1392c
MD5 4b4fd7ce2fca1671c92019f9e7b495b0
SHA1 148b6732bd32b23715c9d0f540d2b7bf8e07fabf
SHA512 ba44e64c40123774403b6fe725351169f63f99fccfb5129446df49ae4209a908d7d2e126ba2938788634b9636c739a0d49ee5ae319d7841ce06691d7e66ce414
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 bd61f6c82ce0adad3d70463de4c5c99a16f1cd1fe754d4d54f0ee72d5a5c6cf1
MD5 095bb66420a3e09005666adbb17407b1
SHA1 affa84ddba7f406b46a50289cdd0b3831706254c
SHA512 8b87f52e36560bb5ff118456b96d2fe6a8079dfb93674941c380a88e409338f84bafbee273889ef685b4e673029931d3c1aa914aca67f28a09a62eef6acea4aa
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 7da3eb56978c58b6c147a2599d52d6bd75f902d1e337ee0a1c8796426475a334
MD5 562a4bfafb38c09b221ebcb38edcdcbc
SHA1 3cb958ee2f121e09ab75e4fb4fd44c13842949fb
SHA512 af2ab6b10d3e62c4a3535b05e0acaf565c1b17190e9bc8e29c081b5f78c0a6afaae1ff683d8f1cb4f8884bf0aeaa1ae14b9dc360aa8ec53cde538d07ad5f3aa5
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 8315bfee53dca7425d9af3e11ad4964796b0636f87ef3c7f0bee6ddeeaf1c581
MD5 1622db9068c665904b1ea7dc7bdd241d
SHA1 530e9bddf84fb32f62281ddc8c3f98070a3a1223
SHA512 2fad60425feac082e5e5c19f155b6e03a635fb1e95844a61cb26a211f4b52cca221ca83ebe902363d966c6fa545027d720434e610c7bd378073f57d477c3e5d8
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4d6d7f7859b8b72e8f838276549e4f1c188f931488058395d11a2eb53640ecae
MD5 9403ef433e9d74190de89fd49eeefa1d
SHA1 5fe8c938ff0caae623e969aa85f40dbad5043282
SHA512 c75fefcfd6ca68c1ef3594f9d3454b2ec89475ecafe7ed5896a2355cbd2e81536bdab4a654a08b88ec0bcd4a4f4fcb556a1a7f27b42d3085db94c4cb7719507e
MD5 SHA1 SHA512

Submit Download

svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BBBCACBCCBACCACCABABABACBCCCBACBBCAABCBACCBCBCAAABCACCC.exe
Size 14.5MB
SHA256 52ad9f7b0babcd6d91ea77fc2a6d9c8e5a7aec8c8557b43c1efccb4fbd6790fd
MD5 d78df70cd51efa4eb78a73eea11c2666
SHA1 36fe87482dd7fc6f07e32d323d0046e094133060
SHA512 05fdea942911f861837f4e4167e9fcd00269241b3d818c0811c7fde18586f4f660d9deadf2c38a35432dc77c51a9481f285b93b00061648b07c622dde84ba4b3
SSDEEP 98304:g350R350l350R350l3501l350R350l350R350l350R350l350:25y5O5y5O565y5O5y5O5y5O5
TLSH
T183E64B49BBE95151F9B342708CAAC2B69D317C204F2197EF6680F32D5E336D0E939B16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 a9329ca0f65fbaaa65df1c15478be859c05221ea38ea023191fa5f4979201761
MD5 8a71b3ee790215b2847a83103f4d0d85
SHA1 cf21903362042ad9bb145bb5b98b07a3766fc2df
SHA512 1d909f4249d1a5bcde5465b87878c94fa255b29f240fc1424e054a4c0dde059d49fc46340c004351286a61eb06bb6363dad610c9aa93906392bfae7629d4136e
TLSH
T19111E650B0E5CCA7E03128C7962D9F8B0CB43BDF9C58AF3823084258771AC39CE198D2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2808-130-0x0000000000940000-0x0000000000961000-memory.dmp

Download

memory/3456-77-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/3456-0-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/3456-44-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/3456-116-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/3456-29-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/3456-15-0x0000000000B00000-0x0000000000B21000-memory.dmp

Download

memory/3460-132-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/5568-89-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/5568-63-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/5568-43-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download

memory/5568-131-0x00000000007A0000-0x00000000007C1000-memory.dmp

Download