Analysis
- max time kernel
150s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/05/2026, 01:53
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
45 signatures
150 seconds
General
- Target 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 50KB
- Sample260518-ca144sa15m
- SHA256 22921c5f615a8c15ce71d12665a9051fffecdbfbdf77d32c600bb31ad6cbeb71
- MD5 f32b8df6ed96acdbeac7a6d5a960ca41
- SHA1 df28bd84023ea3c3c1dfd6711ab2268eeec18f86
- SHA512 51ace747896a472e5292bbae454c729986bcec637cc725dc42958bbcc71439de1e13e95bd002b6ffcac9773fc21e423b7535eddb0ad2373d3a14c3c821b1ec81
- SSDEEP 768:zdflfNlBJOAgHtB69fIYMy6/x/Rgr4KC1XXGblfppgKFc5xf:JfP3Jy6NayExGr4KEXGblfLguc7
- TLSH T16533F74477F94615F2FF8ABA4DB182119B30B8939C22D79E0AD5058E1AB3740CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral2/memory/2484-0-0x0000000000930000-0x0000000000942000-memory.dmp disable_win_def behavioral2/files/0x001700000002b88a-2409.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Custom signatureDetects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/2484-0-0x0000000000930000-0x0000000000942000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/files/0x001700000002b88a-2409.dat INDICATOR_SUSPICIOUS_GENRansomware - Custom signatureDetects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral2/memory/2484-0-0x0000000000930000-0x0000000000942000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral2/files/0x001700000002b88a-2409.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1960 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2160 netsh.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_117.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_32.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 928 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 5188 sc.exe 1052 sc.exe 4216 sc.exe 4520 sc.exe 792 sc.exe 5612 sc.exe 4432 sc.exe 5184 sc.exe 2680 sc.exe 5496 sc.exe 4664 sc.exe 5088 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 3988 chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 4668 ipconfig.exe 5812 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2512 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 5992 vssadmin.exe 5472 vssadmin.exe 4104 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134237945081147426" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\ms-settings 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\ms-settings\shell\open\command 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\ms-settings\shell\open 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\ms-settings\shell\open\command 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\ms-settings\shell 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\ms-settings\shell\open 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\ms-settings 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\ms-settings\shell 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4752 schtasks.exe 4432 schtasks.exe 3280 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5316 chrome.exe 5316 chrome.exe 1960 powershell.exe 1960 powershell.exe 1960 powershell.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1960 powershell.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeIncreaseQuotaPrivilege 5428 WMIC.exe Token: SeSecurityPrivilege 5428 WMIC.exe Token: SeTakeOwnershipPrivilege 5428 WMIC.exe Token: SeLoadDriverPrivilege 5428 WMIC.exe Token: SeSystemProfilePrivilege 5428 WMIC.exe Token: SeSystemtimePrivilege 5428 WMIC.exe Token: SeProfSingleProcessPrivilege 5428 WMIC.exe Token: SeIncBasePriorityPrivilege 5428 WMIC.exe Token: SeCreatePagefilePrivilege 5428 WMIC.exe Token: SeBackupPrivilege 5428 WMIC.exe Token: SeRestorePrivilege 5428 WMIC.exe Token: SeShutdownPrivilege 5428 WMIC.exe Token: SeDebugPrivilege 5428 WMIC.exe Token: SeSystemEnvironmentPrivilege 5428 WMIC.exe Token: SeRemoteShutdownPrivilege 5428 WMIC.exe Token: SeUndockPrivilege 5428 WMIC.exe Token: SeManageVolumePrivilege 5428 WMIC.exe Token: 33 5428 WMIC.exe Token: 34 5428 WMIC.exe Token: 35 5428 WMIC.exe Token: 36 5428 WMIC.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeBackupPrivilege 228 vssvc.exe Token: SeRestorePrivilege 228 vssvc.exe Token: SeAuditPrivilege 228 vssvc.exe Token: SeIncreaseQuotaPrivilege 5428 WMIC.exe Token: SeSecurityPrivilege 5428 WMIC.exe Token: SeTakeOwnershipPrivilege 5428 WMIC.exe Token: SeLoadDriverPrivilege 5428 WMIC.exe Token: SeSystemProfilePrivilege 5428 WMIC.exe Token: SeSystemtimePrivilege 5428 WMIC.exe Token: SeProfSingleProcessPrivilege 5428 WMIC.exe Token: SeIncBasePriorityPrivilege 5428 WMIC.exe Token: SeCreatePagefilePrivilege 5428 WMIC.exe Token: SeBackupPrivilege 5428 WMIC.exe Token: SeRestorePrivilege 5428 WMIC.exe Token: SeShutdownPrivilege 5428 WMIC.exe Token: SeDebugPrivilege 5428 WMIC.exe Token: SeSystemEnvironmentPrivilege 5428 WMIC.exe Token: SeRemoteShutdownPrivilege 5428 WMIC.exe Token: SeUndockPrivilege 5428 WMIC.exe Token: SeManageVolumePrivilege 5428 WMIC.exe Token: 33 5428 WMIC.exe Token: 34 5428 WMIC.exe Token: 35 5428 WMIC.exe Token: 36 5428 WMIC.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeDebugPrivilege 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeIncBasePriorityPrivilege 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 5316 chrome.exe Token: SeCreatePagefilePrivilege 5316 chrome.exe Token: SeDebugPrivilege 3904 whoami.exe Token: SeDebugPrivilege 5812 NETSTAT.EXE - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe 5316 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2484 wrote to memory of 5316 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 80 PID 5316 wrote to memory of 5072 5316 chrome.exe 81 PID 2484 wrote to memory of 1960 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 82 PID 2484 wrote to memory of 4432 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 125 PID 2484 wrote to memory of 5184 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 86 PID 2484 wrote to memory of 2680 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 2484 wrote to memory of 5188 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 2484 wrote to memory of 1052 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 2484 wrote to memory of 4216 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 94 PID 5316 wrote to memory of 4916 5316 chrome.exe 96 PID 5316 wrote to memory of 4916 5316 chrome.exe 96 PID 5316 wrote to memory of 3988 5316 chrome.exe 97 PID 5316 wrote to memory of 4448 5316 chrome.exe 99 PID 5316 wrote to memory of 4448 5316 chrome.exe 99 PID 5316 wrote to memory of 5440 5316 chrome.exe 100 PID 5316 wrote to memory of 5236 5316 chrome.exe 101 PID 5316 wrote to memory of 5440 5316 chrome.exe 100 PID 5316 wrote to memory of 5236 5316 chrome.exe 101 PID 5316 wrote to memory of 4896 5316 chrome.exe 102 PID 5316 wrote to memory of 4896 5316 chrome.exe 102 PID 2484 wrote to memory of 5496 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 103 PID 2484 wrote to memory of 4520 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 106 PID 2484 wrote to memory of 2796 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 108 PID 2484 wrote to memory of 792 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 109 PID 2484 wrote to memory of 4664 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 111 PID 2484 wrote to memory of 5992 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 113 PID 2484 wrote to memory of 5428 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 115 PID 5316 wrote to memory of 4756 5316 chrome.exe 116 PID 5316 wrote to memory of 4756 5316 chrome.exe 116 PID 2796 wrote to memory of 2512 2796 fodhelper.exe 148 PID 2484 wrote to memory of 1948 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 122 PID 2484 wrote to memory of 4752 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 2484 wrote to memory of 4432 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 125 PID 2484 wrote to memory of 1844 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 2484 wrote to memory of 3544 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 132 PID 2484 wrote to memory of 2712 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 133 PID 2484 wrote to memory of 1472 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 134 PID 2484 wrote to memory of 5584 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 2484 wrote to memory of 3140 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 136 PID 2484 wrote to memory of 5344 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 2484 wrote to memory of 3280 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 2484 wrote to memory of 2064 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 146 PID 1844 wrote to memory of 5472 1844 cmd.exe 147 PID 3544 wrote to memory of 2512 3544 cmd.exe 148 PID 3140 wrote to memory of 4668 3140 cmd.exe 149 PID 1472 wrote to memory of 3904 1472 cmd.exe 150 PID 2712 wrote to memory of 928 2712 cmd.exe 151 PID 5344 wrote to memory of 5812 5344 cmd.exe 152 PID 5584 wrote to memory of 3032 5584 cmd.exe 153 PID 3032 wrote to memory of 5832 3032 net.exe 154 PID 1844 wrote to memory of 5232 1844 cmd.exe 155 PID 2484 wrote to memory of 348 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 156 PID 5316 wrote to memory of 5720 5316 chrome.exe 157 PID 2484 wrote to memory of 4104 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 160 PID 2484 wrote to memory of 4652 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 162 PID 2484 wrote to memory of 4612 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 164 PID 2484 wrote to memory of 2160 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 165 PID 2484 wrote to memory of 5612 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 168 PID 2484 wrote to memory of 5088 2484 2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe 170 PID 4612 wrote to memory of 5608 4612 net.exe 172 PID 5316 wrote to memory of 5468 5316 chrome.exe 174 PID 5316 wrote to memory of 5076 5316 chrome.exe 175 PID 5316 wrote to memory of 3328 5316 chrome.exe 176 PID 5316 wrote to memory of 1036 5316 chrome.exe 186 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.echodex.io2⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5316 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff96635c728,0x7ff96635c734,0x7ff96635c7403⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1584,i,9942742498379335418,6161118151981274462,262144 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1956 /prefetch:23⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2236,i,11897520459815956353,8376791107073306799,524288 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2276 /prefetch:113⤵
- System Time Discovery
PID:3988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,18134306164058835424,1830936607820213461,524288 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2368 /prefetch:133⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3008,i,678454940873976025,173310939514841194,2097152 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3148 /prefetch:13⤵PID:5440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3000,i,976800105639038206,15157458898452427862,2097152 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3128 /prefetch:13⤵PID:5236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4268,i,18312255564585680843,8993362196968748143,2097152 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4272 /prefetch:93⤵PID:4896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4704,i,8556833232541320720,648789159164693044,2097152 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4740 /prefetch:13⤵PID:4756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5508,i,16360301578229086680,5767415242024837738,524288 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5548 /prefetch:143⤵PID:5720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5588,i,17706519943740589020,1747224100937186636,524288 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4920 /prefetch:143⤵PID:5468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3244,i,5476834751113165633,1207554155421702560,524288 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5524 /prefetch:143⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3248,i,12203407071250299377,15088278503179323752,524288 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5544 /prefetch:143⤵PID:3328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1084,i,6860864761162026466,12931655450835739330,262144 --field-trial-handle=1960,i,3165572522035081959,10615176401219024938,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4396 /prefetch:103⤵PID:1036
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4432
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:5184
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:2680
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:5188
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1052
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4216
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:5496
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4520
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:2512
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:792
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4664
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5992
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:5428
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:1948
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4752
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4432
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1844 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5472
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:5232
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3544 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:2512
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:2712 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:928
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3904
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5832
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:3140 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:4668
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5344 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5812
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3280
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:2064
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:348
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:4104
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:4652
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4752
-
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5608
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2160
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5612
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5088
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:5220
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:228
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:4632
-
C:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:5608
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4832
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260521_004957.jpg
- Size 289KB
- SHA256 da799413b87d71f3c118338ff88e37a113f5c5d4943db224ae7a3f38ba2095f2
- MD5 49addf1d90f0d24f245dacf13dea6340
- SHA1 f5775e2a297e6f36a29d8394df6d710c3d37acac
- SHA512 bae8825d5978b084e7e9a611a803f4cc93491c94d58f30dda0bea3586db4d0179086070f1af8cc304384df5fb2515987d4a1cb6a213e2d64cac8ebb03a66247c
- SSDEEP 6144:WHXR/8iCL01CCW0vlwcIq7QGGPntE2Y8xBvpeTWKt5W0QVN:WF0mWSuj6PGPtE2pBReTHY3
- TLSH T1E254F153CC118A872CDD67ED3C074CBA78966B58C8929BEE11274E6F3F211661CCE25E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 3e5780e709fce60f8abbf4b34747825d87fa9b97bd9b3cee01e27c31e3a0b1cb
- MD5 6142ad72abe9d84c02d47c0a6ae0ce4e
- SHA1 2c13a53c944005df2bcf85a4e0dfe35d1c39dca1
- SHA512 be4a463683bd40bd47d46e9e5afddd2fa17a9bcf5318d4b3c11d665c2bf45b1c838dabb968c64fbc7db29f3399e036fc2590561f46233613b72c1de80a9df91c
- SSDEEP 1536:sBU6AXZ6IC9o9oqFAiKfnUQ9FcigVtHe48hiY9wcghj+PjXQQdLkeSYrNv514G6:sBUnXIICEFArUmhiYycgiXQQGXYrR51m
- TLSH T173632B368F23FCC4677F3D80E05039561C893E6B97B56678FB850DA928A5680EF2E45C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 1ac87451e5ed7a79738c8347359ce247856b99a13575e2d7232c9a2d177c6c5a
- MD5 739e763145a928ab4d110c0a108d138f
- SHA1 ef32019befd29542c23840bc9ad7add563f9d569
- SHA512 7bace7920067b5c8eaeda676c4c3b84b9f85554bb10871ba25d2bc6a1ae2894e474dd8a50ec310b90f391ac6d32b9ee8dad00c54e60c5f43dcc1e53b6600bffc
- SSDEEP 1536:MBU6AXZ6IC9o9oqFAiKfnUQ9FcigVtHe48hiY9wcghj+PjXQQdLkeSYrNv514GN:MBUnXIICEFArUmhiYycgiXQQGXYrR51h
- TLSH T1B4632B368F23FCC4677F3D40E05039561C893E6B87B56678FB850DA928A6680EF2E45C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\92281fef-894c-469d-8ac8-50680b712f47.tmp
- Size 414B
- SHA256 4ebbde8b26ea0acf6e7813a4e0545c7fc826c5e8efe3a79c1c2c721b1a58668c
- MD5 cccc58371e27f73e54c0e6fcf6f02310
- SHA1 a207e52c9ea434b6a866e173e28570186aa508be
- SHA512 1e0284969bd076619a13cffccaf252477702431d4ab74d7853ebabcf4e1fb09556dd958b1881626e724ce6a0403f2bfda434081b7c77e426da4aaecef956dc72
- TLSH T125E02BA6C921EC371DFD1B2C61551745E76013572F805D5B3F3C810C8FB177A554586C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 649B
- SHA256 b8bfd3f5da1b4329347a6adca2745c98fabee8f8ac6625b1ab3818f1f795ff89
- MD5 882e62a7391d499acc3c2a6328d711c2
- SHA1 228adb4430bd88d7404cca7ee0e3f8835cd85aab
- SHA512 2c7184e7fe294b8286d1192d4d36a85938a49540c951e2827d9cb30e75fca53ad5835fcbfd202ba967b7825d6b80deccf8d6152ac6317886282e85171c92551f
- TLSH T143F0F4BAD921AC2718FD1B3870951746E761136B2B81995B3B3C820C8FB163B954581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000020
- Size 879KB
- SHA256 1c387e52bc45dd4e36f75cb411336b3216a1ba10d245b6127cc043662b5bb1d8
- MD5 8b8e45e59458e6d143b86241dd903c56
- SHA1 556cdd86114fbf8738bc55326a38f1a5bd6160b4
- SHA512 6e7d38d35b80e2804189125e51b9c08fb0e2303e7aca5f2f491ea18918d0caea50b44ecd87ad0e24f14262b629388645296d2c3fa30e7dad9e7c92dbc133e794
- SSDEEP 24576:KzwqAdqv6DuOB2FG28Sg3u6SrsOTMCXyGBeni67bw:i8qCDhB245Sg3u7pXBen9Pw
- TLSH T10B15339C00B0A7F557FF8B79ADB76334055BA6B2029913E2CDB0BE33289344669713D6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 336B
- SHA256 91efb3832c79b344af94f0238214b79dfc53b75f971a0f9c88b03181adc42c1a
- MD5 a0e2cd49aae962d3c198794e214cb1b6
- SHA1 e34bf11eb99436cc083f64bf0eb61c3a16662021
- SHA512 947a7fff01a91a370e12817bd877a3695f7a6dcd7c77387fb90947dce20b25af6988bad838afa930f57d7fa49d3b2443da75a8235016b5f0ac97463c77070bae
- TLSH T1FDE05E66EA9011C0E7705FF7579007F8E06E1B2C161B1E0BC1ED50786026AF161F585F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 24678aff92beadc39b3660de5b87c7eab2ecffb3b3952f3f12c0d1f3ed418819
- MD5 2ad7cfa845d72d9922cef1f7b5844cd1
- SHA1 7aa859917451ffa625485286cd6df458e7c3b26b
- SHA512 d55492216082997d1d8701f51a7da105b57a4ff25f4c12f32fbaf13ae1efaf446f0ae50e201cc2ad04d245c815db1c095ce554a2fb7f023b67ecbdf0c04c261b
- SSDEEP 192:D80vnkOOOtk1YazxGtHDJLp6EpWGyNTkg6zW:D80vnkOOOtk1YazxGtHDJLp6EpnyNTkC
- TLSH T161E157F7C3E98A2DC91155F4BF152E1BCE59092853293C2AC8D99F1B97E18B2E20164E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 11KB
- SHA256 63625ae049a3e854ab99c54d72bf80f8c65c5db227fb4c8a8237012bbd02dc19
- MD5 7f221d02176aaa0874dc3cbad56f0980
- SHA1 ec4d4e1bb87a641cdd1c4a2be0e32e6d38f1b0ac
- SHA512 bcfeff01917a33c0fcc8336e868f808400117a81968b545e3a176b527e8cfcc09afe8359dfe3cdea3632e6100fce1f06915bfd0cb8d8fbf5b2325b60053f1d8d
- SSDEEP 192:sROlvPSPyTJRJDv7HpAPRp2slU9DHsb+WNnXqhBR2oYeR+VyIsnAUgtaJ:sROlWMJ7jUXw5wa92+28
- TLSH T1CB42D62EB914663B5CC7D269FA697B63E7F5103125D42E84EAFC8A2C14EB5DC221340B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 17KB
- SHA256 3fceec2368f93ddd3be7eaa1465a3011c325ff47801261d2e3bc86a459460fa8
- MD5 a9125c26694a66613be5174b13bd716c
- SHA1 d0abfcc6f0e0b8d2779b7f996521b8ebdf6cd039
- SHA512 5811381d70a31e2f21b2051a0c5593e8505bc21c15a15c6e78f2f2a296602ffd19c6ce03bfc0a32c575a8048dba5ba42472a9bf5d2aadd73dfc95e4c5fe7a5ed
- SSDEEP 384:97jJY7KxkXqKf/pUZNCgVLH2Hfgsl6y7pLuLcSjvKXODJ4+ErU3rQHGjLsHHG:93JY7KxkXqKf/pUZNCgVLH2HfgsYy7p8
- TLSH T13E720967AC4C9E370F94C5CCD816BF4FADB5024B65E9C86483FA582903D5ADB110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\d178474241f99db5b84114e4d89a384fb7690dee\index.txt
- Size 143B
- SHA256 bc8867fcdd1c116ac6fc88c5e40fa278176233291099ae05dc6467c64231be00
- MD5 4050e062580f97692bf1fa846a5b7913
- SHA1 8d503efc1bb208ee88fcfebef93fa99137da90cd
- SHA512 3fbc1174234b1769dc1840453aa0d34f0c9c18c8b8be6efc45b561f89667378fabe64d5bd16751ef5b930f760439e4e722105c3b03927ff04389b197bea86692
- TLSH T18AC02B0F3362C038FFE5C183BC40A0028233084847C0CC7080338008E182122C0C2A25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\d178474241f99db5b84114e4d89a384fb7690dee\index.txt~RFe589390.TMP
- Size 150B
- SHA256 42e97f5acc932aa833dc661a323d63a0342606b924e5ac181944cfad0ee678a3
- MD5 d0aaf9d5f0b3a27ad0b72fbd557f1de9
- SHA1 3cb38288a3939c7d6ed7fe94dda7450bb4eca51f
- SHA512 3586b9ba72a7ae710d7fec04d80a5765d7d59a54d91edf68cd58c67cecccb5d39208ab43e1dccb78509d26e1a68302c4e7427e9e3861675662611b871060f0a7
- TLSH T111C08C0B33628038FBA1C083A850A10242330C884A80C8708433B004E172122C185A25
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 8c9aa5029e0b5f2bd3ef574762183eaef84a48ba535d2379b4f03224ada3a2dc
- MD5 850a34cefef21d700e82338f4c02fdbf
- SHA1 cb046291df42a00874b79e1c55f44284c0b4ce46
- SHA512 2ff6c2febba34ed8f2ecb01029af012bf13f477583bc734fe542c7a70c35136a0f74e9bc16bc1e35e2ea75a9103d8733805e6f463739f576147d8fe145c6edf7
- TLSH T186C01201D4017216C00E03F82052D4EC73689F25DE1A1B9986F0693EDC7823681162A3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589d06.TMP
- Size 96B
- SHA256 ab3960ba1e432ad2c3110fdc5d3496d66057fec3a20c9bd33b529665fd726de5
- MD5 840c1dbdd2ac447971611a9f98fffc45
- SHA1 fc2d7d27c0223175c828dc123f1b113865a238d0
- SHA512 128ee9ea9d17a5573c67503d8c138c286fbe015b302c55be5652c06eba6f319296d90984641f17d9c58786bb6c4842de861193126394cf5563c4ef02c66b5cc0
- TLSH T15DB0222AC0032202C00303B02080C0C830B0CF38CAC3030282F00AB2CC2CA3202280A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 ca0ff37f447afa19929d6569500414709fcec25f5a2f1f50683d1c2f2699e63e
- MD5 a1488a957fb81116f9653f22c4272f29
- SHA1 bd87b52a1cce4af5a0a7837a22619ab20186b30e
- SHA512 d556e6a6d8398976deebfe5ecc6fb7fec9ca646e6434830480048018c4c8dfa886df1eb5e5cbbb1331ea12c6cd5c059506a36490a46877233d02dceaaecfb5a3
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OnUVumwnGMZ:1nbZeMrv/hGtnznGMZ
- TLSH T191D3874B3A747002DDE5CA721CE054BB5E3CB16D8F15A5D428B620688EF2963A23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 b21fe362e763f40db1bced49d9c5e4be87ab5d9e042fc876d822e296c29eed5d
- MD5 ea711e198bacf5a40c267187e8666bbb
- SHA1 3be1a1d6d6c6499259b3af6716d3b5308559f965
- SHA512 a5eab4972870e77ac408cbbefe2191f76d8ff2f11fbd331f2f1c085dad52c679e185fb67f7be0e583cd4ee1bc6d2325cbae927f806f62ed7d11a9cbac4859d16
- SSDEEP 6144:xiUDJpo0okxTmhRe2q5RKNJ7am7Rkm1tYpBeh2BAou:p0RQRM9oBGcAou
- TLSH T114341237ED7B14B1AA64974FB00A5E2E2DF258E64D21EAB7D1C46B0423D828C1F05F78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 0b30bb074d98b51b586f704b483cae6ce1216bf98aba38df377b664da48afa72
- MD5 5b764157a5ae0e998dd8f215f89e6324
- SHA1 1ba08b0c2c3945f0b862acb8234394ec52aa856f
- SHA512 10f2a658d588df591231cdf9a473477f8e493820dda69865104a9ceea738ae8f4f08d29e0356fc43d751f558d2e95786a84df325f77e207d592c5ae84f039043
- SSDEEP 3072:oGm7D5Lk17ox1tIpud63U8BehbCBi9fTrM+:Dm7Rkm1tYpBeh2BAo+
- TLSH T116C3122B5D71A9365CB9A74EB04D0B1F2EF14DA6C930DE92C8D86B0477FA7CC0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 228KB
- SHA256 5a2bd04dcc2f166ada14a20027c025e14060a4d56280a899a6a85ad55f3f3767
- MD5 a684305ba975005a01e9bb6f2874c24f
- SHA1 79945aff5ca5c4a373013f7376339c97a2b5aa7a
- SHA512 aa1473f1d7b9c782491499f0f5ca327c05d3cbfe90d25fd9a50c4df23075c6ad5be62c2648e6fca2230f01651325545fbbb5a8930e5de55f3df4cb3068eaaf5b
- SSDEEP 6144:EiUDJpo0okxTmhRe2q5RKNJ7am7Rkm1tYpBeh2BAou:g0RQRM9oBGcAou
- TLSH T10B341237ED7B14B1AA64974FB00A5E2E2DF258E64D21EAB7D1C46B0423D828C1F45F78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 229KB
- SHA256 64025fc49466274984fe3d587684d5e3da363d9cc8a3d114b668851a39b535b1
- MD5 60364f2d7609003a4859fa8747ac07f6
- SHA1 78c34991f08a71e33227a1e1bb2f5ba766cdb7f3
- SHA512 a2db4f040061adc89f5640e458b0f177744547ce09c3470e9ff7eec5e4b36696b28b5f7a4c318561d5e6cc32aebb94a69ebb427d112ad47ec0d1062aee9d8d2a
- SSDEEP 6144:H0iUDJpo0okxTmhRe2q5RKNJ7am7Rkm1tYpBeh2BAou:w0RQRM9oBGcAou
- TLSH T1E8341237DD6A14B1AA74978BB00A5F1E2CF198D74D21FA7AE5C46B0413D829C1F05F78
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-18_f32b8df6ed96acdbeac7a6d5a960ca41_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 0e692bcbba51ca4e766a427c9f28a7a4a9e326d2cf835493e57a9dc2121326b5
- MD5 284393596fdd49bebd7b861bf339b82d
- SHA1 a36767dfc423b3c7fd3ff439b616862743a053c8
- SHA512 8d3247ee0c3bf9a9fceea23eb5c646dbd8b3d954f4d62622f49070629e642d6a13bfb0d27949e2355c081d45f5a1101f05a9972782a0f0a478ed90f551d2efeb
- TLSH T1BD0144703376A0D889263F820C2E52C857BF433AA150AD18B998628DED3601B6B212E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hzybfftc.tnk.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 436438f992744c7b63ac0d7ceb2239444203e43584eae7062e6bfd6140d654dd
- MD5 c02b1f241d174b3c1655883209d8d92c
- SHA1 84cf897bad32b2f5817226ad6de07126ffb7fc9f
- SHA512 83973e753fdac41884f4bbfd77d6b3a81a6ef7c6aec124876e423c474cff6c5df0b1463acdf45a30051aa8c8eb84f6f8edc70501fb72ec726fd1258b2e66ff33
- TLSH T10EE072CFA1088AAD0012213B82F38E0CE5F0642C3A27AF3097A4CD0E3A918D55AF2082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 f6cab3b9755d3618bbca867d3ecbd60315f3864b202569312c445552dc375a53
- MD5 38c134c904721f7844e234b3d61fd3f9
- SHA1 03b4bff8b0cd145396e30ecba089a0941dbc2bfc
- SHA512 e7a9d7486a0d3274e391a86b786d84efed04d963ca59b0c65f210fae2dbb656c13fbed3ceaff2690fc3e57a010a3198420ce80e07e4ada51fcf7cd691660608b
- TLSH T16BE072CFA1088AAD0012213B81F38E0CE6E1652C3A37AF30A764CD0E3A818955AF2082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 379KB
- SHA256 631fa8808763169351d77815427d76fe725fbb4520e8154788c85632446c265c
- MD5 143e7a214024747187be6fc56b8e5b50
- SHA1 9ca0fed41904a0c6020e2d949fcb911a81bfa085
- SHA512 a3ab20df956445e1cf219fbab01d9fa7df2c2b9bc6ce9413c0039f72649ef00048017a5f70e4410a97ea4e7726681bc457e246d4a74abc3f6cfaa56227857b04
- SSDEEP 6144:mvtLehMQnxcAi6bymUHGKjUKtRZeAB2L/uaAmzJ+l+9aATwbBWeDZ45G/0elFnI/:mvtApclayeKIwZ+p+l+8ASBGU8elFu
- TLSH T1A4840190CBB68D770D94919B254633EAA478FBE581CCD5F33084AED3A2F3A51D25E01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 379KB
- SHA256 e69dc0fc21b921451845a6bdd97ab367c86d5b7263ba3d0d087a01160362c0b0
- MD5 b5d174c1ef705e1fabb293fcc2a07b2f
- SHA1 95506aeac57d7b53c5b48424c0ce12e96d3e5ddd
- SHA512 5c2a0b3c926033d6003b5e8705e86d19de2c3f6fa06eb41d2e6226fd4ff1c4a0007851d8c258476e4c11d7593269f59f0c9612bb93774fa40f4266c80379b6ed
- SSDEEP 6144:avtLehMQnxcAi6bymUHGKjUKtRZeAB2L/uaAmzJ+l+9aATwbBWeDZ45G/0elFnIz:avtApclayeKIwZ+p+l+8ASBGU8elFK
- TLSH T1CD840190DBB68D770D94919B254633EAA478FBE581CCD5F33084AED3A2F3A11D25E01B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 50KB
- SHA256 22921c5f615a8c15ce71d12665a9051fffecdbfbdf77d32c600bb31ad6cbeb71
- MD5 f32b8df6ed96acdbeac7a6d5a960ca41
- SHA1 df28bd84023ea3c3c1dfd6711ab2268eeec18f86
- SHA512 51ace747896a472e5292bbae454c729986bcec637cc725dc42958bbcc71439de1e13e95bd002b6ffcac9773fc21e423b7535eddb0ad2373d3a14c3c821b1ec81
- SSDEEP 768:zdflfNlBJOAgHtB69fIYMy6/x/Rgr4KC1XXGblfppgKFc5xf:JfP3Jy6NayExGr4KEXGblfLguc7
- TLSH T16533F74477F94615F2FF8ABA4DB182119B30B8939C22D79E0AD5058E1AB3740CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH