82e55173ac147b2a08b17488e6bca0a07a9aee31f24b8ba0b87869624af357a1

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 19:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe
Size 2.2MB
Sample260910-xx2pdavcnc
SHA256 82e55173ac147b2a08b17488e6bca0a07a9aee31f24b8ba0b87869624af357a1
MD5 1ea4949a52de70141a59dbcd38b61086
SHA1 e8992b461f8f8289b439a7081cdd6cbbd530800b
SHA512 0347fdf55839f7d00da35c12f1c38b922e78654e9146c0db6881a8923366be3d25e578afc2ca51b7afff98a7aa407220e8a7ea83627506ab39170b28a643cf8f
SSDEEP 49152:U+EHqatgl3+EHqatgl3+EHqatgl3+EHqatgl3+EHqatgl3+EHqatgl3+EHqatglC:qQQQQQQQ8
TLSH
T1A8B54C85F9465172D82701B24CDFD2FB56B0BD204F124AABF699B32E1A33AD093335D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 3 IoCs

pid	Process
4764	svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
4380	svchost_BCBACCBAAAAAAAABAACABCBACACCCBBCAACABAACAACCBBACCBACCAA.exe
5664	svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_BAABBCCCACCBAACABBBABBABABABACCBBCCBCBBBBCAAACCCCBCBCABC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_BCBACCBAAAAAAAABAACABCBACACCCBBCAACABAACAACCBBACCBACCAA.exe"	svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update_ACAAACACACBABCCACABACACABCAACCAABBCAACBACBBAABBBBCBBBCCC = "C:\\Users\\Public\\Documents\\Microsoft\\Windows\\Logs\\svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe"	2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3060	sc.exe
1956	sc.exe

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6032	cmd.exe
428	cmd.exe
672	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost_BCBACCBAAAAAAAABAACABCBACACCCBBCAACABAACAACCBBACCBACCAA.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2020	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2080	2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe
2080	2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe
2080	2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe
2080	2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe
4764	svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
4764	svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
4764	svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
4764	svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
4380	svchost_BCBACCBAAAAAAAABAACABCBACACCCBBCAACABAACAACCBBACCBACCAA.exe
4380	svchost_BCBACCBAAAAAAAABAACABCBACACCCBBCAACABAACAACCBBACCBACCAA.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2080	2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe
Token: SeDebugPrivilege	4764	svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
Token: SeDebugPrivilege	4380	svchost_BCBACCBAAAAAAAABAACABCBACACCCBBCAACABAACAACCBBACCBACCAA.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 6032	2080	2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe	92
PID 6032 wrote to memory of 2020	6032	cmd.exe	94
PID 4764 wrote to memory of 2348	4764	svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe	95
PID 2080 wrote to memory of 428	2080	2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe	98
PID 428 wrote to memory of 3060	428	cmd.exe	100
PID 2080 wrote to memory of 672	2080	2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe	101
PID 672 wrote to memory of 1956	672	cmd.exe	103

C:\Users\Admin\AppData\Local\Temp\2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_1ea4949a52de70141a59dbcd38b61086_elex_glassworm_vidar_wannacry.exe"
1⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACCBCBAACCBBBCCAABBCABCACAABBBBBAACABACCBABBCAACCCBBBCCBBBABCBCCBAAACCBAAACBCCBACACCCBCACACAACCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:6032
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /tn "Microsoft\Windows\MemoryDiagnostic\MicrosoftEdgeUpdateTask_ACAAACCBCBAACCBBBCCAABBCABCACAABBBBBAACABACCBABBCAACCCBBBCCBBBABCBCCBAAACCBAAACBCCBACACCCBCACACAACCABBC" /tr "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe" /sc minute /mo 30 /ru SYSTEM /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2020
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc create "UserDataSvc_ABAABBBBCBABBCBACBCBCCCACBCBCBCBBCBCBACBABCBCACABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe" start= auto displayName= "UserDataSvc_ABAABBBBCBABBCBACBCBCCCACBCBCBCBBCBCBACBABCBCACABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\SysWOW64\sc.exe
    sc create "UserDataSvc_ABAABBBBCBABBCBACBCBCCCACBCBCBCBBCBCBACBABCBCACABAB" binPath= "C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe" start= auto displayName= "UserDataSvc_ABAABBBBCBABBCBACBCBCCCACBCBCBCBBCBCBACBABCBCACABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:3060
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c sc start "UserDataSvc_ABAABBBBCBABBCBACBCBCCCACBCBCBCBBCBCBACBABCBCACABAB"
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:672
- - C:\Windows\SysWOW64\sc.exe
    sc start "UserDataSvc_ABAABBBBCBABBCBACBCBCCCACBCBCBCBBCBCBACBABCBCACABAB"
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:1956

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
1⤵
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\notepad.exe
  "notepad.exe"
  2⤵
  PID:2348

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBAAAAAAAABAACABCBACACCCBBCAACABAACAACCBBACCBACCAA.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_BCBACCBAAAAAAAABAACABCBACACCCBBCAACABAACAACCBBACCBACCAA.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4380

C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
1⤵
- Executes dropped EXE
PID:5664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 177849580920a94f023d34297152792b26e516324ae80e243c5b5d046596b736
MD5 36e71addd04edd1cd66e41eb4e5505a6
SHA1 e3d99154fca45a7dbcd745e430abdad212695b92
SHA512 4db84c58c664e5440e8326a59607b11c0fc741f19196ef118e78d45746c7c255fbe3e5fbb8cb2aeee734cbf27df8c82eb9177d3aea44c33557d03c40cb000352
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 e49cdeab17cd16b6d1a813171e713c4fb30cda88855253d2d524cee1ebe35db8
MD5 4c2333458b835b4d2d4c608eb12fd1e0
SHA1 b5c6598224679ecd53949b0ad31b41f52393fab8
SHA512 226181de7baca79d5b09cb832ac642aa0a53d1abcff713adadb5cea0ba0d3f6ead936bdaab51d88c5616aeabbb5c20a0c34cd048452362dc422b17706130a81d
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 26fbb499c081bf9f400f407e9563dc87578dc2f383c272b6c06b3de9e1da2170
MD5 97470cf226741beffc80054721e068f2
SHA1 d6ab5e442cec4d84083cc4fcd054c6ae72375b9c
SHA512 8526b5224365157473e29f902a2c5f8b7de55c19969947de0f6b073dd86872a752dd7c11b16b40e37be8a67d51bb58a098193a10b635d107cba7c5155deeb432
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 4363c5ff8de6f92b27a86cc121c6c282316ecd5dd5c856f269ff81a6df8779d9
MD5 e7c717abb359e2abfa8b54eecd53f093
SHA1 aef31756d2f9604b9dd0414099bd8e44d2ed4780
SHA512 2744256913ac5dfaa7d2fd37e2de089066363b16fcf824084fdb9ec12e39277798e01fd203d7fe504f388f82317c85285a278a1ed22bd905dfda0c99df58dac2
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Desktop\qap`g`v~dtlq
Size 10B
SHA256 646b92d3a2756e60abb192b594074d012bcd8dffa29d788d60f9d39d31385270
MD5 2c393f2bdaf92ed537ea04d4ada5685d
SHA1 c27e669e28bc2223f09463ab42fa6020e1736c46
SHA512 d738797e10d4076dca365666fed95cdb496e66bf283a26f4ac7abc167406f048d04207e8f938164ffd2e6bdeb5ff0bb9a141a57754935508f7e8e38cb5c01a60
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 bd2005a095f0a2522fe339f5ec3876c7c8b0bc0b9d1dde1395296e6ee1793673
MD5 e7208e2497b4fd7bb6e501a2a7d1aeef
SHA1 745bfb1e400d1a8bc809de407f750a51dfe8af6c
SHA512 4237a209855cff1fcd4a5220c47b7eb2299faf5413f4aca0b9294feb53fc1d2df8de6408743eaae469e897817a249d6a240ab76a277129d9a0fa422ba40eed8a
MD5 SHA1 SHA512

Submit Download

qap`g`v~dtlq

Path C:\Users\Admin\Downloads\qap`g`v~dtlq
Size 10B
SHA256 c0d73bb9fa05e15e132d9bb815ad24c6847f920eac23db6800764011a1ea92af
MD5 47b04840c57a027dc6af5b8d0f83b2c3
SHA1 56dc26709de4cc2bc789a9ff013b02e976bf1e2a
SHA512 e02d091bc54ff80a3e3a9d290d336f46a906cff639efc67f816f5e6835095ae90b8a85dc002b4a599beda11f92b279653f8d75728b4da75dfcdb0fe916fdeba1
MD5 SHA1 SHA512

Submit Download

svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\svchost_ACCCACBACBBBBACACBBBAACABBBACACACAABCBBBCACACACAAABBABC.exe
Size 2.2MB
SHA256 82e55173ac147b2a08b17488e6bca0a07a9aee31f24b8ba0b87869624af357a1
MD5 1ea4949a52de70141a59dbcd38b61086
SHA1 e8992b461f8f8289b439a7081cdd6cbbd530800b
SHA512 0347fdf55839f7d00da35c12f1c38b922e78654e9146c0db6881a8923366be3d25e578afc2ca51b7afff98a7aa407220e8a7ea83627506ab39170b28a643cf8f
SSDEEP 49152:U+EHqatgl3+EHqatgl3+EHqatgl3+EHqatgl3+EHqatgl3+EHqatgl3+EHqatglC:qQQQQQQQ8
TLSH
T1A8B54C85F9465172D82701B24CDFD2FB56B0BD204F124AABF699B32E1A33AD093335D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_log.txt

Path C:\Users\Public\Documents\Microsoft\Windows\Logs\virus_log.txt
Size 926B
SHA256 311e521d357924897e1bc5c411155aec494c50854fd01b9f82b283f3c6567fca
MD5 8e2c96cd663debb1106e2f8d7efd8ed7
SHA1 0667a8ea85d0067ce94c071095eb9da019080568
SHA512 a4161d7d5dfa97a6bcaec415ad4ea9387a67419f5b4c59685f002e190af82fd3e8b0138361b13dcb210d1348b6f51bd5a63047d7198b4eb6e940a3c698262faf
TLSH
T1F3117B7190A5D463F13028DB9925AB8B1DB4364F9CD8AF14230C5318B725C3ACF1D4F2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2080-8-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/2080-0-0x0000000000400000-0x0000000000421000-memory.dmp

Download

memory/4380-74-0x00000000006A0000-0x00000000006C1000-memory.dmp

Download

memory/4764-34-0x0000000000AF0000-0x0000000000B11000-memory.dmp

Download