Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
04/08/2026, 16:17
Behavioral task
behavioral1
Sample
2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
49 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
46 signatures
150 seconds
General
- Target 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 48KB
- Sample260804-trpwvade77
- SHA256 162f4cad3ee58a5fab5ad2dd0c4bef46749e6fd2b2b505cfd58c12485d5037db
- MD5 2edd291737cf02af2b41ebfcc2449014
- SHA1 e0ef1c2f2830004b5385e02ee7c6595944e25b13
- SHA512 5ef530ed25270efb4649aa9171f4d2fd0649ef846ca4e50e4408f780dc729035569a6ae1e1c414e5dd93a72f1e40526b14718cb6f438655c051c9fb2e8e35058
- SSDEEP 768:QhnbfALOZgHEftRfC9USv0DL4I//o4aC1XXGblfA03KFcf:knELEtA9DEEII4aEXGblf93ucf
- TLSH T1E323F70477F98115F1FF9ABA8DB196019B31F8939C22E78D06D5058E1AB3B40CDA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://www.ivylive.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://www.ivylive.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4464-0-0x0000000000C00000-0x0000000000C12000-memory.dmp disable_win_def behavioral1/files/0x0007000000024a5f-2381.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/4464-0-0x0000000000C00000-0x0000000000C12000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x0007000000024a5f-2381.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/4464-0-0x0000000000C00000-0x0000000000C12000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x0007000000024a5f-2381.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 3908 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2116 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_8.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_76.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_36.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_123.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_159.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_170.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_41.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_134.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_40.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_72.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_38.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4384 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5372 wscript.exe 5792 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1648 sc.exe 5400 sc.exe 1136 sc.exe 1216 sc.exe 1704 sc.exe 4488 sc.exe 632 sc.exe 2492 sc.exe 5936 sc.exe 4116 sc.exe 4240 sc.exe 4332 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5904 cmd.exe 5544 cmd.exe 5584 cmd.exe 5596 cmd.exe 5564 cmd.exe 5572 cmd.exe 5552 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2648 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 436 ipconfig.exe 1444 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2348 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1740 vssadmin.exe 5156 vssadmin.exe 3924 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303339411201122" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\shell\open\command 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\shell 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\shell\open\command 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\shell\open 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\shell\open 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\.pdf\ = "PDFBotnet" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\ms-settings\shell 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1440 schtasks.exe 3016 schtasks.exe 5836 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4928 chrome.exe 4928 chrome.exe 3908 powershell.exe 3908 powershell.exe 3908 powershell.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeDebugPrivilege 3908 powershell.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeIncreaseQuotaPrivilege 4896 WMIC.exe Token: SeSecurityPrivilege 4896 WMIC.exe Token: SeTakeOwnershipPrivilege 4896 WMIC.exe Token: SeLoadDriverPrivilege 4896 WMIC.exe Token: SeSystemProfilePrivilege 4896 WMIC.exe Token: SeSystemtimePrivilege 4896 WMIC.exe Token: SeProfSingleProcessPrivilege 4896 WMIC.exe Token: SeIncBasePriorityPrivilege 4896 WMIC.exe Token: SeCreatePagefilePrivilege 4896 WMIC.exe Token: SeBackupPrivilege 4896 WMIC.exe Token: SeRestorePrivilege 4896 WMIC.exe Token: SeShutdownPrivilege 4896 WMIC.exe Token: SeDebugPrivilege 4896 WMIC.exe Token: SeSystemEnvironmentPrivilege 4896 WMIC.exe Token: SeRemoteShutdownPrivilege 4896 WMIC.exe Token: SeUndockPrivilege 4896 WMIC.exe Token: SeManageVolumePrivilege 4896 WMIC.exe Token: 33 4896 WMIC.exe Token: 34 4896 WMIC.exe Token: 35 4896 WMIC.exe Token: 36 4896 WMIC.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeBackupPrivilege 3700 vssvc.exe Token: SeRestorePrivilege 3700 vssvc.exe Token: SeAuditPrivilege 3700 vssvc.exe Token: SeIncreaseQuotaPrivilege 4896 WMIC.exe Token: SeSecurityPrivilege 4896 WMIC.exe Token: SeTakeOwnershipPrivilege 4896 WMIC.exe Token: SeLoadDriverPrivilege 4896 WMIC.exe Token: SeSystemProfilePrivilege 4896 WMIC.exe Token: SeSystemtimePrivilege 4896 WMIC.exe Token: SeProfSingleProcessPrivilege 4896 WMIC.exe Token: SeIncBasePriorityPrivilege 4896 WMIC.exe Token: SeCreatePagefilePrivilege 4896 WMIC.exe Token: SeBackupPrivilege 4896 WMIC.exe Token: SeRestorePrivilege 4896 WMIC.exe Token: SeShutdownPrivilege 4896 WMIC.exe Token: SeDebugPrivilege 4896 WMIC.exe Token: SeSystemEnvironmentPrivilege 4896 WMIC.exe Token: SeRemoteShutdownPrivilege 4896 WMIC.exe Token: SeUndockPrivilege 4896 WMIC.exe Token: SeManageVolumePrivilege 4896 WMIC.exe Token: 33 4896 WMIC.exe Token: 34 4896 WMIC.exe Token: 35 4896 WMIC.exe Token: 36 4896 WMIC.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe Token: SeShutdownPrivilege 4928 chrome.exe Token: SeCreatePagefilePrivilege 4928 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe 4928 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4464 wrote to memory of 4928 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 85 PID 4928 wrote to memory of 1996 4928 chrome.exe 86 PID 4464 wrote to memory of 3908 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 87 PID 4464 wrote to memory of 1136 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 4464 wrote to memory of 4116 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 4464 wrote to memory of 1216 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 4464 wrote to memory of 1704 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 94 PID 4464 wrote to memory of 4488 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 97 PID 4464 wrote to memory of 4240 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 99 PID 4464 wrote to memory of 632 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 101 PID 4464 wrote to memory of 2492 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 103 PID 4464 wrote to memory of 752 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 105 PID 4928 wrote to memory of 2180 4928 chrome.exe 106 PID 4928 wrote to memory of 2180 4928 chrome.exe 106 PID 4928 wrote to memory of 2648 4928 chrome.exe 107 PID 4928 wrote to memory of 4388 4928 chrome.exe 108 PID 4928 wrote to memory of 4388 4928 chrome.exe 108 PID 4464 wrote to memory of 4332 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 109 PID 4928 wrote to memory of 1816 4928 chrome.exe 112 PID 4928 wrote to memory of 1816 4928 chrome.exe 112 PID 4928 wrote to memory of 4692 4928 chrome.exe 113 PID 4928 wrote to memory of 4692 4928 chrome.exe 113 PID 4464 wrote to memory of 1648 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 114 PID 4928 wrote to memory of 3412 4928 chrome.exe 116 PID 4928 wrote to memory of 3412 4928 chrome.exe 116 PID 4464 wrote to memory of 1740 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 117 PID 4464 wrote to memory of 4896 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 119 PID 752 wrote to memory of 4368 752 fodhelper.exe 121 PID 4928 wrote to memory of 4428 4928 chrome.exe 123 PID 4928 wrote to memory of 4428 4928 chrome.exe 123 PID 4464 wrote to memory of 5372 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 127 PID 4464 wrote to memory of 1440 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 129 PID 4464 wrote to memory of 3016 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 131 PID 4464 wrote to memory of 5016 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 134 PID 4464 wrote to memory of 5156 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 4464 wrote to memory of 5184 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 4464 wrote to memory of 204 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 4464 wrote to memory of 2116 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 204 wrote to memory of 5500 204 net.exe 144 PID 4464 wrote to memory of 5544 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 145 PID 4464 wrote to memory of 5400 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 147 PID 4464 wrote to memory of 5904 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 149 PID 4464 wrote to memory of 5552 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 150 PID 4464 wrote to memory of 5572 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 151 PID 4464 wrote to memory of 5564 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 152 PID 4464 wrote to memory of 5596 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 153 PID 4464 wrote to memory of 5584 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 154 PID 4464 wrote to memory of 5836 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 161 PID 4464 wrote to memory of 5792 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 163 PID 4464 wrote to memory of 5936 4464 2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe 164 PID 5552 wrote to memory of 4384 5552 cmd.exe 166 PID 5572 wrote to memory of 1280 5572 cmd.exe 167 PID 5596 wrote to memory of 436 5596 cmd.exe 168 PID 5564 wrote to memory of 4204 5564 cmd.exe 169 PID 4204 wrote to memory of 4084 4204 net.exe 170 PID 5904 wrote to memory of 2348 5904 cmd.exe 171 PID 5584 wrote to memory of 1444 5584 cmd.exe 172 PID 5544 wrote to memory of 3924 5544 cmd.exe 173 PID 5544 wrote to memory of 2332 5544 cmd.exe 174 PID 4928 wrote to memory of 5484 4928 chrome.exe 176 PID 4928 wrote to memory of 5796 4928 chrome.exe 186 PID 4928 wrote to memory of 6008 4928 chrome.exe 187 PID 4928 wrote to memory of 6068 4928 chrome.exe 188 PID 4928 wrote to memory of 5692 4928 chrome.exe 199 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.ivylive.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbf18ac728,0x7ffbf18ac734,0x7ffbf18ac7403⤵PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1676,i,11989782597245398336,14967707601480048501,262144 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1992 /prefetch:23⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1564,i,13264990442362471928,7514772566533335859,524288 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2280 /prefetch:33⤵
- System Time Discovery
PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2368,i,14949685359733859762,7388923911238635098,524288 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2340 /prefetch:83⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,8776084494589931840,16356653692882691594,2097152 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3140 /prefetch:13⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,14985955927368545860,1375823025599584467,2097152 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3260 /prefetch:13⤵PID:4692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4360,i,12309506203797659540,3483443744912735634,2097152 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4416 /prefetch:23⤵PID:3412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4560,i,10103877914250949062,4100243285409573949,2097152 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4668 /prefetch:13⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5476,i,3889240562711220992,1621327833213713112,524288 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:83⤵PID:5484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=208,i,5427495477164639177,5015874133821328949,524288 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5768 /prefetch:83⤵PID:5796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5536,i,6248953230863632129,3401881930903442750,524288 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5464 /prefetch:83⤵PID:6008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4824,i,520828559599732090,13090445800778226431,524288 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5816 /prefetch:83⤵PID:6068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=836,i,12406370235005395210,9899551493512153395,262144 --field-trial-handle=1996,i,6377002747382930346,18413113912433362844,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1184 /prefetch:83⤵PID:5692
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3908
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1136
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4116
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:1216
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1704
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:4488
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:4240
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:632
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:2492
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:4368
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4332
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1648
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1740
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4896
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5372
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1440
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3016
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5016
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5156
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5184
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:204 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5500
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2116
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5544 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3924
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:2332
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5400
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5904 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:2348
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5552 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:4384
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5572 -
C:\Windows\system32\whoami.exewhoami3⤵PID:1280
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5564 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4084
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5596 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:436
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5584 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:1444
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5836
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5792
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5936
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:204
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:4124
-
C:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:4848
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4136
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260804_172025.jpg
- Size 106KB
- SHA256 b257fccb9354fe248872b0f9124e3271885470c0a4be38cbf3363741e3e85183
- MD5 12e0ee3775c4346244f62dc6df4bdb32
- SHA1 1734a384131f6a5a50cfa14b2b5ef32f1df98e08
- SHA512 5494274f59ac669e877581797283ce933db17e704757cc0da6a80a3829500be685c522778a651508c9bb33cd07da21fb0f8f6e62b566261691bdb0ec4381c760
- SSDEEP 3072:ANhw9Y/0I4KnK3VVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVVV1ky77psG:ya9Qb4bB7psGht
- TLSH T143B322478C489B83B51997E4BE031EAD2F0A6B1CE9C239FF51530EDB3E656225D4D02E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 74f683186f3dec539c9575615d550f65a1fa4f6a6d2b8b052657fd6b6cdddeae
- MD5 fbbb2f5ac726c063ac140e0bcebf0f00
- SHA1 5074a6cd4496552c12308bbd3143e9ee9aecec0b
- SHA512 76bb17fe9575a47498f2ad7b524d10e669caff6c9052ed9aa16e23e50a2a6da117e28eaf31259e275466868e5298e089a14336c777239471b7dc64acba055278
- SSDEEP 1536:BBUL8Q9S6EOarvpI43y9x2kXwRt1EK+PjXQQdLkeSYr+V9PEbea:BBUL8yS6ERvhiWkgRULXQQGXYrkPEv
- TLSH T128632B368F23FDD4777B3D80E0503C461D883E6B97B526BCFA801DA528A6644DF2E598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 c6f04c5a5750e37f813ed4900262fb49217bc6a15837e949e7c4a92c2200c6ab
- MD5 41be72b063b7a1a96f3b3f18ef58729e
- SHA1 9f2803edd89d1373528c748d7767cd0fb566b528
- SHA512 b79a176b671ddb1b9340d0e2f092c898291626255d4e1df4ed28a1286c1ba793a7a1f0fe8d7a846091bcee05144d421105ca37f2d23f004d6db4bb606ec0a289
- SSDEEP 1536:hBUL8Q9S6EOarvpI43y9x2kXwRt1EK+PjXQQdLkeSYr+V9PEbet:hBUL8yS6ERvhiWkgRULXQQGXYrkPEO
- TLSH T1E4533B368F23FDD4777B3D80E0503C461D883E6B97B526BCFA801DA528A6644DF2E598
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 96acccf8c4a16614c06e42d5b776a5ee5f4292b2eb254c370c1e8b74b1a8742c
- MD5 a6434addc7334de6a1d4503f78a0b9ea
- SHA1 aa999fee18211dfe963e80c33aa58ac659547c1a
- SHA512 5b6d694397d090cd0d63dca14dee0a31e00c0c18d9e8c7a0d2f61eca0cf9d23fa28b9926658df93dc1d485c06fda25266d55558c0548c17a6ef31930cb88a890
- TLSH T1E6E022A9C821BC2708FE07196054A78AE755135B2A81995F3A3DA118CFB0A3A41C7CAE
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 360B
- SHA256 77bb7ccc9ee63a94e4f2d8d99d33ecb7a03c453c6ee5543d6541f1bb3f8a2592
- MD5 7e1d103d2ab1696c58a4779a00b7cd08
- SHA1 a1f33b67ee6bc8a661f6946a1587760ba67511c5
- SHA512 2e53c33ed8674ad7497cebae1fe29b3b44eec96cf18c565fdbbbad23e20ccfe17db54619616bf4e3ffd1d3cf56ee7722b3045511e34a3e5aed3b132a305a2612
- TLSH T1D0E05EC9E9D771B2DB40463358B93E98E13067EC126A1FF288D013B1E13BAD071A746B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\History
- Size 160KB
- SHA256 73e9551f121c82109d0fb6ef3ce8af79831fb00f4d34b96c8330af34e323b194
- MD5 fcb64231592d62ff9186f9a2b7e969fb
- SHA1 1407e005f7fbac3a378b9a0cec29e2917852309a
- SHA512 51313887d8d0a912f5bf93eeb01e9a8b2c3a05e8e07165ed2a2927652b74f70903bb927a5b221d77f885c0fb7ed0354cb46ae25fb726939ebcb9d99fb2fe66ae
- SSDEEP 96:uq/Pgsr2/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0Vq7:NP9C/tH+bF+UI3iWGVYWNkqp3H
- TLSH T1FDF31C1E5F643311CDFD913B69E645A3587DF03F8BA36AC56C6108B1CEE2652B02C4AE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 59698b023541ac94e6896f282ace6fe4be9237916c178386ed26b612be21856b
- MD5 73d81465e89fcaea7bb6dd3239073989
- SHA1 bc9241af7c596fffa28aae51185fe4d6819aca44
- SHA512 315743b69ea17ced31c39188800a0575c2c6420a70743bafa7d23c789f69dd9849cd3e6b2ace70fa029846c6bddb1be7bd6726c6bb86cb90dae322f4b8902512
- TLSH T150416AB3C7D8857D891052F4BA156E1FCD2D0E24535C3D5AC8D8AE0F63E68B5E20058E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 19ddfa26a3c621cd73c2d73a7a3141f7d888e0e9bc04a12ffa01987c7a9217be
- MD5 89867d41a77105a155af2c07941bc009
- SHA1 79cf6245eac9f158420038f08f22ef5128058544
- SHA512 1bbd0876d5a8c8a97fc95d7a85d2d312d6b1b8b0fb3c29c702a92c49a63d2203975b3337e8975e2facaa9126245944a72e9e0a420bdcd81b15b6a47f711635c2
- SSDEEP 192:D+EmRqLFhxaaIEdFGmEzQVhdCthzzcd14t1TZ/U:D+EmRqhfaaIEdFGmEzKhdCthzzcd14tw
- TLSH T1B4D17CF7C7E58A2DCC1156F4BB142D2BCE590D2852283D76C8D5BF4BA3E2872E24464E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 5f71eb09d87e718ba9e9d3713844873e5ee1f91a2cd48008e59dcdd9f2d08b73
- MD5 86330ddf713da080736b49c483632011
- SHA1 5a5f95cc52dae52922512dc0f804950e0c5529e8
- SHA512 6bc980ca0e4ed3fe19621d34acbd087a5cb4342e46747e8a6ad35bd72467eabf56ef131d5bd92b78437a3d9e81f6c77ad956d7d63280a2aac2788dd5f0fc0c6a
- SSDEEP 192:KRpR/TMhximv7spAPRp22ul69wHsb+WNnzGQLZv2FEe4IaylIQ+VyIsnAUge:KRpR74iSYUX/hKwBZ2rNaw2e
- TLSH T15B42E82EF954693B5CCBC229FD667B93D7F5102121942E94E6FCC92C11E79CC222742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 13KB
- SHA256 0b4226b3f0da4d47159f54207690d15491a8e1d5efa86c378ea64649b6b86385
- MD5 99a98282df7d3bd676a54e8d07b1d9dc
- SHA1 20f678a428dec0fbe6cc9e45303e15a90b18a961
- SHA512 4e519439bf8adc8ee6fd6164a62dcd2088e603eab077a4831730a0957799060a24e2f1294cdf2679ad1f953e14fa39c915f6b99e56ad844e7fd2ced8e0e8769a
- SSDEEP 192:KRpRqTXhximv7sp6PRpM2ul69wHsb+WNnzGQLZv2AEe4IaylI6+VyIsnAUgraJ:KRpRgiSYuXxhKwBZ2iNaa2e
- TLSH T18952E82EF9146D7B9CCAC229F9627F53D7F5202121942E64E6FCC92C15E79CC221702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 0f9d89b14c20dbedeb2b1ab941732258e68c35384fcebf3b7f602abe0057c46e
- MD5 38d1f9169127cbf7a89a5a6b70fc834a
- SHA1 fca66d9c8c7d76db0c5f7299435bc8e2de58f664
- SHA512 fcfb94e72f41f8de7dfc388fa6ef9ed108db4d4c2eb1c14235827c00d232c1f79de43af94682b5ae0e088b8ddb71e1613633500f81e86712840495a2c771d3da
- SSDEEP 192:KRpRYTXhximv7spAPRp22ul69wHsb+WNnzGQLZv2DEe4IaylIU+VyIsnAUgraJ:KRpRyiSYUX/hKwBZ2lNa02e
- TLSH T18452E72EF9546D7B9CCAC229F9627B53D7F5202121942EA4E6FCC92C15E79CC231702B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 91441c660ce5831c77512612a5b3b1b241f6e0935e8ed69877c35808c22d4d1a
- MD5 409dfcb760503903975cace637ea9ba7
- SHA1 811f3205b3977c376e440e07b19d37e9cf2bef0f
- SHA512 fb6f9189f43ff1fc8999db43350481bce494586edf325a26031fbf678f5ff336a3745df1ecfebb37298fa0b6a83f5b60b60cb65cd3c4dedbaa58f64202014bed
- SSDEEP 384:gCjUH7KxkXqKf/pUZNCgVLH2HfgslsZ7pLuLcMCDXODUr+ErU3/NHGcmyaOqjmD:gCUH7KxkXqKf/pUZNCgVLH2Hfgs+Z7po
- TLSH T17272F9677C4C8E370F94C6CCD8267F4F9DB5025B65E9886483FA9C2903D5ACB114A2EB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 fc25d466d6fa1464379155525c6a9e5c38de4ab3532ca5e06bf2cf540c7597da
- MD5 cd2c173ad68ee47c9364449104a7be5e
- SHA1 24323d3d802179b744968db8b6ec3b2fdb50e676
- SHA512 fde15e97eabba5df3668e9f1dc1bd273dad168e58b9c1cf7a6dd4519c10b0748116ef939ee6e58ee8aab1c69d06beca16612f326930b578b9cee2e89cb6fad08
- TLSH T152C012C6C215A141C06E03B53186D498F2E8AF24DB2B174C83E42B1AD83D53180162D3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c714.TMP
- Size 96B
- SHA256 69809be72efd8e253d48b055c99d4125ebedf3bc0c3a7fc6824a4b9509957e61
- MD5 1173aa6b9e91a51e1943ddb39030dab1
- SHA1 3995e82c81fca770279a35c0af36c0e5cff3b6ba
- SHA512 b19e03abb099874db8e61fe0ec01b87a8afe259edcef96163f9a1185e70e60e1cf7b77738721c8d6e14448c79b0973b1dfbcb53b8a5c7d7dd5e9b79f3eef467a
- TLSH T172B00295C1127252C0924BB165AAE6D8B1A0DF25C603122293E02BB6FD257754635D71
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 b9aecce6dacf3fd4c7d3daaedf925a00487ccbece3352318840b55c2a8d240ee
- MD5 a104e34d3c29f6ee99b84b740b1eca82
- SHA1 5814c235e0af4b769a1562e46f91d4bac969e113
- SHA512 7554f5c448963764eac3395b57b34ae5729ad39df06640b8aadff081b3fcec232329cba0d4d9043046a003196653a9665aa6e616399ab94d784cf336173b8311
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2OGpX6+ikqOsVumcbwko:jeuvBnhJsueMEGvIW1DcP2OOfiVummno
- TLSH T19BD3864B3A747102EDE59A721CE050BB5E3C716D4F5291D438B620688EF2963B23D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 4a95ba1071e8c67d282697c871b36607bc12ce5d651fb093d8868d38b04aac54
- MD5 da27bf79b9ac4aaef3c01d61a1e09731
- SHA1 e99dfa67dafcc0c1185c6ad81d4294c5ed590067
- SHA512 431ddaf85c638487f4ba6d84292d701175de2b1c9166f9c64f0e4732aac60ef8274d2921b536fe84c07a2e22a387be98c4218c114a172b98625d001583be546c
- SSDEEP 6144:JaAcLI9guPzskI0hIG/kvkYIYARgkm7Rkm1tYpBeh2BAoO:Qa9guPzskIoILoq9oBGcAoO
- TLSH T1113422356D26AD338AF2DB0D700D2E141FF24A6A89305DD2FDE5BA0476A76CD2F059B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 d4084a870efa0f40d586f26d5ab9ce7355e23a4e6a178c65499b45b6012dde04
- MD5 b249a46f1086d37e7da5a4ae0598b563
- SHA1 988d7aae72cd0ad6bc8d3fd3872f6ee763f7750c
- SHA512 edbba5ae474ccf23626464beb1d42522c8be63d67d17321baad1623130a0d0e479c3f2dc5a55beb0fca263ee0e8aef4cc76f8fa9884f75fdd5458082e82bc121
- SSDEEP 6144:aAcLI9guPzskI0hIG/kvkYIYARgkm7Rkm1tYpBeh2BAoO:aa9guPzskIoILoq9oBGcAoO
- TLSH T1603423256E2ABD338AB1DB0D714D1E182FB3486A45305DD2EEF5FB0436A7ACD2B045B0
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 834ceeb971270823023eebeb1c9fc468538e4326cd1df1e103d961baedd57c2e
- MD5 b0a2e731a731832bb2af69aae288bcf8
- SHA1 8ebb9b5e21c563d594c20897f70eac1d58b6b4fb
- SHA512 5deed4d153fc0df8d49dd685010f6e81b17131d356ce5d3a537df9fa2d897249597d2f1210468fc9d9a9a9904f965a58013d55d5821b136491091a6c0e5bf892
- SSDEEP 3072:qGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMj:tm7Rkm1tYpBeh2BAoj
- TLSH T1F8C312375D75F87759B5BB4EB08E1A1F1EF249A6C920DE52C8D85F0823EA7CC0A05A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 8fd2b82840ebc61038db173552ff8313146c9abdd90b10538a910c3a7083e972
- MD5 01fa7c5327712fb6c1d34f9dbdc16ffd
- SHA1 843d08d88d58ff06b44591bd0b194373258d2c34
- SHA512 d1c3cd1a64242f9ee57dd1b18c07f5f23436287efc3a7a94c5104cc23d2668ea2d0ca26911a944e3c13903a62e96598c1107e5e9443792a3df080f4a1d24ff35
- SSDEEP 3072:9Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMK:Um7Rkm1tYpBeh2BAoK
- TLSH T15AC3123B5D75E8779979B70EB08E1B1F1EF149A2C920DE92C8D86A0437EA7CD0A04D34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-08-04_2edd291737cf02af2b41ebfcc2449014_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fprdvqpu.mkb.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 3582ee1d9f1f27819fc9b2088adceb10da304f73bbc0f2a5c805fb2520f45121
- MD5 151c60bf78831a7436e2859f9937f363
- SHA1 3bf0d88646bfba44c21cc9ea0518003ccf721d5d
- SHA512 d23b25069ffb174b9cb82a81b3a394f0400b6c3da0f532e31ad51f2370153f7afe3b707769c15cc6df9ade031b76031de3cb139791b6a75ac3b67291db718628
- TLSH T111E07D8B6188C6640002112BC1F34C0DD1E054183A276E2087E0DD0F37918C654F5442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 9fb25b2a64c8b6d7a266790cbb3136a56744f369c37975d278b3dd3b50356843
- MD5 e560bc8e540c8782f12f26b1d40382c1
- SHA1 f515c67a5c477818c734221089138da9e4359aee
- SHA512 c5d98da19161a32e7120182fca4c27ee0ec24c71531ee61a08707ca7eeab4692a2a95dead14a45bc3ec772f459f183c714e1dd51b9236da1019b927d07681833
- TLSH T15AE07D8B6188C6640002113FC0F34C0DD1E154183E376E2097A0DD0F379188654F5442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 143KB
- SHA256 8f5864cde89691cdbe2d9b80d55ce2074a1ecb3a44c6ee20e0a55d2b2d0b20ff
- MD5 e46b271734d4c34fefaba5e8ec73fb4e
- SHA1 c02e52e2a02fe2ff5eb7fe44af4c45c1c7bf0c3c
- SHA512 c9387a40768460f6a7f31ccbc57fe248477f14f2ffd6b574eb3f8139f0c6a7e5155d5875de6838e8b210f88a3322837f2ae09cc3ad5fcf7a637830869560020c
- SSDEEP 3072:Gbrrjq8ShMG5nqNKvIBbjV42Pja5sVaB+K7P:ePjFUM6nqN426F9P
- TLSH T158E37914C6F68F3A14965AEF091733D5A438F7F192ECD5FB20A6EA63F1728E2C618501
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\DecryptAllFiles.exe
- Size 48KB
- SHA256 162f4cad3ee58a5fab5ad2dd0c4bef46749e6fd2b2b505cfd58c12485d5037db
- MD5 2edd291737cf02af2b41ebfcc2449014
- SHA1 e0ef1c2f2830004b5385e02ee7c6595944e25b13
- SHA512 5ef530ed25270efb4649aa9171f4d2fd0649ef846ca4e50e4408f780dc729035569a6ae1e1c414e5dd93a72f1e40526b14718cb6f438655c051c9fb2e8e35058
- SSDEEP 768:QhnbfALOZgHEftRfC9USv0DL4I//o4aC1XXGblfA03KFcf:knELEtA9DEEII4aEXGblf93ucf
- TLSH T1E323F70477F98115F1FF9ABA8DB196019B31F8939C22E78D06D5058E1AB3B40CDA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 143KB
- SHA256 1be38b14ec7e7dfb8e7cbdc652ad3a765175b64a17d7c271f6e6d1bd6af412f5
- MD5 b998d2f9a7edaa048cb1da819c512080
- SHA1 e77b2c9411cfacacb844d42998250fefa24c8a83
- SHA512 89e47b7b7a61606e2f27c9eb61d1b6273ccf9ee7a48df7ccafb4ce771fa4e67a4a31fcf965ae0d3d22656d1e6e90cf966bf91d5411accf71c056d526ba066140
- SSDEEP 3072:obrrjq8ShMG5nqNKvIBbjV42Pja5sVaB+K7q:kPjFUM6nqN426F9q
- TLSH T1F6E37A14C6F68F3A14965AEF091733D5A478F7F192ECD5FB20A6EA63F1728E2C608501
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH