chaos | b36ddaf8181d940739ffcee6f9d1ebdfcf6587d3445a193aa094d3cee83ef60e

pid	Process
2920	bcdedit.exe
4988	bcdedit.exe

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

ransomware

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
2964	wbadmin.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\read_it.txt	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4432	svchost.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops desktop.ini file(s) 31 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-552508041-2681165170-3229858294-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1964	cmd.exe
428	cmd.exe
1104	cmd.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4132	chrome.exe
328	chrome.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 9 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

Direct Volume Access

T1006

pid	Process
4512	vssadmin.exe

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = 99ebff004cc2ff000091f8000078d4000067c000003e9200001a6800f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	NOTEPAD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings	svchost.exe

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4572	NOTEPAD.EXE
4948	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 3 IoCs

pid	Process
4432	svchost.exe
296	WINWORD.EXE
296	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
4432	svchost.exe
5360	WMIC.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
Token: SeDebugPrivilege	4432	svchost.exe
Token: SeBackupPrivilege	3348	vssvc.exe
Token: SeRestorePrivilege	3348	vssvc.exe
Token: SeAuditPrivilege	3348	vssvc.exe
Token: SeIncreaseQuotaPrivilege	5360	WMIC.exe
Token: SeSecurityPrivilege	5360	WMIC.exe
Token: SeTakeOwnershipPrivilege	5360	WMIC.exe
Token: SeLoadDriverPrivilege	5360	WMIC.exe
Token: SeSystemProfilePrivilege	5360	WMIC.exe
Token: SeSystemtimePrivilege	5360	WMIC.exe
Token: SeProfSingleProcessPrivilege	5360	WMIC.exe
Token: SeIncBasePriorityPrivilege	5360	WMIC.exe
Token: SeCreatePagefilePrivilege	5360	WMIC.exe
Token: SeBackupPrivilege	5360	WMIC.exe
Token: SeRestorePrivilege	5360	WMIC.exe
Token: SeShutdownPrivilege	5360	WMIC.exe
Token: SeDebugPrivilege	5360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5360	WMIC.exe
Token: SeRemoteShutdownPrivilege	5360	WMIC.exe
Token: SeUndockPrivilege	5360	WMIC.exe
Token: SeManageVolumePrivilege	5360	WMIC.exe
Token: 33	5360	WMIC.exe
Token: 34	5360	WMIC.exe
Token: 35	5360	WMIC.exe
Token: 36	5360	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5360	WMIC.exe
Token: SeSecurityPrivilege	5360	WMIC.exe
Token: SeTakeOwnershipPrivilege	5360	WMIC.exe
Token: SeLoadDriverPrivilege	5360	WMIC.exe
Token: SeSystemProfilePrivilege	5360	WMIC.exe
Token: SeSystemtimePrivilege	5360	WMIC.exe
Token: SeProfSingleProcessPrivilege	5360	WMIC.exe
Token: SeIncBasePriorityPrivilege	5360	WMIC.exe
Token: SeCreatePagefilePrivilege	5360	WMIC.exe
Token: SeBackupPrivilege	5360	WMIC.exe
Token: SeRestorePrivilege	5360	WMIC.exe
Token: SeShutdownPrivilege	5360	WMIC.exe
Token: SeDebugPrivilege	5360	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5360	WMIC.exe
Token: SeRemoteShutdownPrivilege	5360	WMIC.exe
Token: SeUndockPrivilege	5360	WMIC.exe
Token: SeManageVolumePrivilege	5360	WMIC.exe
Token: 33	5360	WMIC.exe
Token: 34	5360	WMIC.exe
Token: 35	5360	WMIC.exe
Token: 36	5360	WMIC.exe
Token: SeBackupPrivilege	5708	wbengine.exe
Token: SeRestorePrivilege	5708	wbengine.exe
Token: SeSecurityPrivilege	5708	wbengine.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	3820	chrome.exe
Token: SeCreatePagefilePrivilege	3820	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeCreatePagefilePrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeCreatePagefilePrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeCreatePagefilePrivilege	2704	chrome.exe
Token: SeShutdownPrivilege	2704	chrome.exe
Token: SeCreatePagefilePrivilege	2704	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
3820	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe
2704	chrome.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
5628	OpenWith.exe
6016	OpenWith.exe
2064	OpenWith.exe
296	WINWORD.EXE
296	WINWORD.EXE
296	WINWORD.EXE
296	WINWORD.EXE
296	WINWORD.EXE
296	WINWORD.EXE
296	WINWORD.EXE
3480	LogonUI.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 4432	4372	2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe	89
PID 4432 wrote to memory of 1964	4432	svchost.exe	90
PID 1964 wrote to memory of 4512	1964	cmd.exe	92
PID 1964 wrote to memory of 5360	1964	cmd.exe	95
PID 4432 wrote to memory of 428	4432	svchost.exe	97
PID 428 wrote to memory of 2920	428	cmd.exe	99
PID 428 wrote to memory of 4988	428	cmd.exe	100
PID 4432 wrote to memory of 1104	4432	svchost.exe	101
PID 1104 wrote to memory of 2964	1104	cmd.exe	103
PID 4432 wrote to memory of 4572	4432	svchost.exe	108
PID 3820 wrote to memory of 2688	3820	chrome.exe	115
PID 3820 wrote to memory of 4132	3820	chrome.exe	116
PID 3820 wrote to memory of 3648	3820	chrome.exe	117
PID 3820 wrote to memory of 3648	3820	chrome.exe	117
PID 3820 wrote to memory of 2768	3820	chrome.exe	119
PID 3820 wrote to memory of 2768	3820	chrome.exe	119
PID 3820 wrote to memory of 2524	3820	chrome.exe	120
PID 3820 wrote to memory of 2524	3820	chrome.exe	120
PID 3820 wrote to memory of 3368	3820	chrome.exe	121
PID 3820 wrote to memory of 3368	3820	chrome.exe	121
PID 3820 wrote to memory of 4972	3820	chrome.exe	122
PID 3820 wrote to memory of 4972	3820	chrome.exe	122
PID 2704 wrote to memory of 3924	2704	chrome.exe	128
PID 2704 wrote to memory of 328	2704	chrome.exe	129
PID 2704 wrote to memory of 2508	2704	chrome.exe	130
PID 2704 wrote to memory of 2508	2704	chrome.exe	130
PID 2704 wrote to memory of 2988	2704	chrome.exe	132
PID 2704 wrote to memory of 2988	2704	chrome.exe	132
PID 2704 wrote to memory of 2996	2704	chrome.exe	133
PID 2704 wrote to memory of 4284	2704	chrome.exe	134
PID 2704 wrote to memory of 2996	2704	chrome.exe	133
PID 2704 wrote to memory of 4284	2704	chrome.exe	134
PID 2704 wrote to memory of 5808	2704	chrome.exe	135
PID 2704 wrote to memory of 5808	2704	chrome.exe	135
PID 2704 wrote to memory of 4972	2704	chrome.exe	136
PID 2704 wrote to memory of 4972	2704	chrome.exe	136
PID 2704 wrote to memory of 4592	2704	chrome.exe	137
PID 2704 wrote to memory of 4592	2704	chrome.exe	137
PID 2704 wrote to memory of 5128	2704	chrome.exe	138
PID 2704 wrote to memory of 5128	2704	chrome.exe	138

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1c5aa245caa094e0fb77a5c110218500_chaos_destroyer_elex_glassworm_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4512
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5360
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:428
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:2920
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:4988
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1104
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:2964
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:4572

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3348

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5708

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:912

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:3012

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5628

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6016

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff83902c728,0x7ff83902c734,0x7ff83902c740
  2⤵
  PID:2688
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --metrics-shmem-handle=1544,i,15876427481844506884,6569845104987170905,524288 --field-trial-handle=2044,i,13588126396452490822,2780054309365084189,262144 --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4132
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1704,i,10951468822513200982,7428514226697767304,262144 --field-trial-handle=2044,i,13588126396452490822,2780054309365084189,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2316,i,5882386298004393524,6763632089808885553,524288 --field-trial-handle=2044,i,13588126396452490822,2780054309365084189,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:13
  2⤵
  PID:2768
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3288,i,12903628515460283321,2275940464440592923,2097152 --field-trial-handle=2044,i,13588126396452490822,2780054309365084189,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3368,i,14588335770759084828,7729456183901607750,2097152 --field-trial-handle=2044,i,13588126396452490822,2780054309365084189,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4688,i,4371809553033323180,6923446668704980439,2097152 --field-trial-handle=2044,i,13588126396452490822,2780054309365084189,262144 --variations-seed-version --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:4972

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3128

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5176

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\read_it.txt
1⤵
- Modifies registry class
- Opens file in notepad (likely ransom note)
PID:4948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff83902c728,0x7ff83902c734,0x7ff83902c740
  2⤵
  PID:3924
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1916,i,11402114696726096792,673805314825801765,524288 --field-trial-handle=1996,i,16400880722878666831,2854843955159912874,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
  2⤵
  - System Time Discovery
  PID:328
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1652,i,7106390377570912895,10700969394816102203,262144 --field-trial-handle=1996,i,16400880722878666831,2854843955159912874,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  PID:2508
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2304,i,4587309371950114842,3798354479377353641,524288 --field-trial-handle=1996,i,16400880722878666831,2854843955159912874,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:13
  2⤵
  PID:2988
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3276,i,209478995083305071,5544864003234009643,2097152 --field-trial-handle=1996,i,16400880722878666831,2854843955159912874,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3332,i,2245972112127250492,3830783381413977774,2097152 --field-trial-handle=1996,i,16400880722878666831,2854843955159912874,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4744,i,9427638739352647819,10528078603827188490,2097152 --field-trial-handle=1996,i,16400880722878666831,2854843955159912874,262144 --variations-seed-version --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4932,i,11767344501917865293,5305240185937344361,2097152 --field-trial-handle=1996,i,16400880722878666831,2854843955159912874,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --metrics-shmem-handle=4872,i,17831932209232875582,3972433875370895619,2097152 --field-trial-handle=1996,i,16400880722878666831,2854843955159912874,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --metrics-shmem-handle=3500,i,12905245180415823868,13665942008311639166,2097152 --field-trial-handle=1996,i,16400880722878666831,2854843955159912874,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:5128

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:3728

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2064

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\FindConvert.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:296

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39cd855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:3480

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5332

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k CameraMonitor
1⤵
PID:576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

Direct Volume Access

T1006

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Inhibit System Recovery