Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
07/08/2026, 23:24
Behavioral task
behavioral1
Sample
2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
49 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
46 signatures
150 seconds
General
- Target 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 48KB
- Sample260807-3dzcssdp21
- SHA256 a4fdf0569001081d424aedb736102b9fb3a98f58e1be7f751ac65b255b61b418
- MD5 4c74652f1905d0d173b06d54d132c59e
- SHA1 b2982f286dbb05d64ccac94967da41332d39b067
- SHA512 493148e7f39065ea8f0ad4f00661ff0edca6ab6d6d1c6a4fccb6fb63347e1572bd477ad56e9e330697c4cfdee127e3874df882523f609c341c5f072bae3b749f
- SSDEEP 768:zhHDTj5D++kqzyYj1g/4S//o4IC1XXGblfA09KFcx:9HL5DISTxgwSI4IEXGblf99ucx
- TLSH T1DB23F60437F98511E1BF5ABA8DB196019B31F4939C23D78E07D5058E1AB3740CEA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://codethief.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://codethief.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/3672-0-0x0000000000940000-0x0000000000952000-memory.dmp disable_win_def behavioral1/files/0x0007000000024840-2368.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/3672-0-0x0000000000940000-0x0000000000952000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x0007000000024840-2368.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/3672-0-0x0000000000940000-0x0000000000952000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x0007000000024840-2368.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2064 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 2372 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_47.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_75.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_12.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_35.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_84.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_149.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_156.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_143.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_152.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_187.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_96.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_121.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_20.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_89.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_168.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_192.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_52.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_85.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_63.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_80.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_71.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_90.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_118.pdf 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5964 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5612 wscript.exe 5496 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 3172 sc.exe 2240 sc.exe 1604 sc.exe 2284 sc.exe 5000 sc.exe 5956 sc.exe 4948 sc.exe 1472 sc.exe 4336 sc.exe 2432 sc.exe 1640 sc.exe 2088 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5772 cmd.exe 5880 cmd.exe 5432 cmd.exe 5776 cmd.exe 5692 cmd.exe 5684 cmd.exe 1264 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 2068 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 6008 NETSTAT.EXE 1772 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2284 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3356 vssadmin.exe 6112 vssadmin.exe 648 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306186906429415" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\.pdf\ = "PDFBotnet" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2864 schtasks.exe 5816 schtasks.exe 1832 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 416 chrome.exe 416 chrome.exe 2064 powershell.exe 2064 powershell.exe 2064 powershell.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeDebugPrivilege 2064 powershell.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeIncreaseQuotaPrivilege 2460 WMIC.exe Token: SeSecurityPrivilege 2460 WMIC.exe Token: SeTakeOwnershipPrivilege 2460 WMIC.exe Token: SeLoadDriverPrivilege 2460 WMIC.exe Token: SeSystemProfilePrivilege 2460 WMIC.exe Token: SeSystemtimePrivilege 2460 WMIC.exe Token: SeProfSingleProcessPrivilege 2460 WMIC.exe Token: SeIncBasePriorityPrivilege 2460 WMIC.exe Token: SeCreatePagefilePrivilege 2460 WMIC.exe Token: SeBackupPrivilege 2460 WMIC.exe Token: SeRestorePrivilege 2460 WMIC.exe Token: SeShutdownPrivilege 2460 WMIC.exe Token: SeDebugPrivilege 2460 WMIC.exe Token: SeSystemEnvironmentPrivilege 2460 WMIC.exe Token: SeRemoteShutdownPrivilege 2460 WMIC.exe Token: SeUndockPrivilege 2460 WMIC.exe Token: SeManageVolumePrivilege 2460 WMIC.exe Token: 33 2460 WMIC.exe Token: 34 2460 WMIC.exe Token: 35 2460 WMIC.exe Token: 36 2460 WMIC.exe Token: SeIncreaseQuotaPrivilege 2460 WMIC.exe Token: SeSecurityPrivilege 2460 WMIC.exe Token: SeTakeOwnershipPrivilege 2460 WMIC.exe Token: SeLoadDriverPrivilege 2460 WMIC.exe Token: SeSystemProfilePrivilege 2460 WMIC.exe Token: SeSystemtimePrivilege 2460 WMIC.exe Token: SeProfSingleProcessPrivilege 2460 WMIC.exe Token: SeIncBasePriorityPrivilege 2460 WMIC.exe Token: SeCreatePagefilePrivilege 2460 WMIC.exe Token: SeBackupPrivilege 2460 WMIC.exe Token: SeRestorePrivilege 2460 WMIC.exe Token: SeShutdownPrivilege 2460 WMIC.exe Token: SeDebugPrivilege 2460 WMIC.exe Token: SeSystemEnvironmentPrivilege 2460 WMIC.exe Token: SeRemoteShutdownPrivilege 2460 WMIC.exe Token: SeUndockPrivilege 2460 WMIC.exe Token: SeManageVolumePrivilege 2460 WMIC.exe Token: 33 2460 WMIC.exe Token: 34 2460 WMIC.exe Token: 35 2460 WMIC.exe Token: 36 2460 WMIC.exe Token: SeBackupPrivilege 3104 vssvc.exe Token: SeRestorePrivilege 3104 vssvc.exe Token: SeAuditPrivilege 3104 vssvc.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeDebugPrivilege 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeShutdownPrivilege 416 chrome.exe Token: SeCreatePagefilePrivilege 416 chrome.exe Token: SeIncBasePriorityPrivilege 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe 416 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3672 wrote to memory of 416 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 86 PID 416 wrote to memory of 2564 416 chrome.exe 87 PID 3672 wrote to memory of 2064 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 3672 wrote to memory of 4948 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 133 PID 3672 wrote to memory of 3172 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 91 PID 3672 wrote to memory of 2240 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 93 PID 3672 wrote to memory of 4336 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 95 PID 3672 wrote to memory of 1472 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 98 PID 3672 wrote to memory of 1604 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 100 PID 3672 wrote to memory of 2432 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 102 PID 3672 wrote to memory of 2284 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 156 PID 3672 wrote to memory of 2112 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 106 PID 3672 wrote to memory of 5000 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 107 PID 3672 wrote to memory of 1640 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 109 PID 416 wrote to memory of 4956 416 chrome.exe 110 PID 416 wrote to memory of 2068 416 chrome.exe 111 PID 416 wrote to memory of 4956 416 chrome.exe 110 PID 416 wrote to memory of 216 416 chrome.exe 113 PID 416 wrote to memory of 216 416 chrome.exe 113 PID 3672 wrote to memory of 3356 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 169 PID 416 wrote to memory of 4028 416 chrome.exe 116 PID 416 wrote to memory of 4028 416 chrome.exe 116 PID 416 wrote to memory of 1624 416 chrome.exe 115 PID 416 wrote to memory of 1624 416 chrome.exe 115 PID 416 wrote to memory of 2880 416 chrome.exe 118 PID 416 wrote to memory of 2880 416 chrome.exe 118 PID 3672 wrote to memory of 2460 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 120 PID 2112 wrote to memory of 3120 2112 fodhelper.exe 122 PID 416 wrote to memory of 376 416 chrome.exe 125 PID 416 wrote to memory of 376 416 chrome.exe 125 PID 3672 wrote to memory of 5496 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 128 PID 3672 wrote to memory of 1832 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 129 PID 3672 wrote to memory of 2864 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 176 PID 3672 wrote to memory of 5388 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 3672 wrote to memory of 5432 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 3672 wrote to memory of 5880 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 3672 wrote to memory of 5772 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 3672 wrote to memory of 1264 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 3672 wrote to memory of 5684 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 142 PID 3672 wrote to memory of 5692 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 143 PID 3672 wrote to memory of 5776 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 144 PID 3672 wrote to memory of 5816 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 145 PID 3672 wrote to memory of 5612 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 153 PID 5772 wrote to memory of 5964 5772 cmd.exe 154 PID 5776 wrote to memory of 6008 5776 cmd.exe 155 PID 5880 wrote to memory of 2284 5880 cmd.exe 156 PID 5684 wrote to memory of 4696 5684 cmd.exe 157 PID 5692 wrote to memory of 1772 5692 cmd.exe 158 PID 1264 wrote to memory of 6044 1264 cmd.exe 159 PID 4696 wrote to memory of 6060 4696 net.exe 160 PID 5432 wrote to memory of 6112 5432 cmd.exe 161 PID 3672 wrote to memory of 648 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 162 PID 3672 wrote to memory of 4304 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 164 PID 3672 wrote to memory of 4204 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 3672 wrote to memory of 2372 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 168 PID 3672 wrote to memory of 5956 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 170 PID 3672 wrote to memory of 2088 3672 2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe 171 PID 4204 wrote to memory of 5196 4204 net.exe 174 PID 5432 wrote to memory of 4364 5432 cmd.exe 175 PID 416 wrote to memory of 5344 416 chrome.exe 178 PID 416 wrote to memory of 4252 416 chrome.exe 191 PID 416 wrote to memory of 5172 416 chrome.exe 192 PID 416 wrote to memory of 4364 416 chrome.exe 193 PID 416 wrote to memory of 5984 416 chrome.exe 204 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://codethief.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9bc07c728,0x7ff9bc07c734,0x7ff9bc07c7403⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,12420059848777738796,4454059140912202543,262144 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1996 /prefetch:23⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,4774868846789301937,16243595351366260948,524288 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2140 /prefetch:33⤵
- System Time Discovery
PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=1812,i,256381134578542955,10890875396407784307,524288 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2676 /prefetch:83⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3108,i,11327286475181643186,749052772931033301,2097152 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3244 /prefetch:13⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3120,i,12103777943782048542,9921891435015245730,2097152 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3268 /prefetch:13⤵PID:4028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4404,i,8746026041104046803,4297530044180003383,2097152 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:23⤵PID:2880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4660,i,10537921754257113333,15277100952675880371,2097152 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4696 /prefetch:13⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5352,i,6780646400926005846,2045144944827790753,524288 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5288 /prefetch:83⤵PID:5344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5640,i,1868831075983309572,1556556912044757088,524288 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5604 /prefetch:83⤵PID:4252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5644,i,6473945678527798963,10149662554854904415,524288 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5652 /prefetch:83⤵PID:5172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5648,i,6244697024314797178,10160990005064645253,524288 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5636 /prefetch:83⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4424,i,3380926340640801888,2283976493619464625,262144 --field-trial-handle=2000,i,5641442197229501010,9006345486199629762,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1196 /prefetch:83⤵PID:5984
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2064
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4948
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:3172
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:2240
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:4336
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1472
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:1604
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:2432
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:2284
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:3120
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:5000
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:1640
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:3356
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2460
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5496
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1832
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:2864 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4948
-
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5388
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5432 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:6112
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:4364
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5880 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:2284
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5772 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:5964
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\system32\whoami.exewhoami3⤵PID:6044
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5684 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:6060
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5692 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1772
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5776 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
PID:6008
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5816
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5612
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:648
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:4304
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5196
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:2372 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3356
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5956
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:2088
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4448
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3104
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:1284
-
C:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:5376
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding1⤵PID:2864
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5820
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\invoice_1.pdf
- Size 65KB
- SHA256 05a19b33c4997a5b3befcc94ae6041a2ad5afffef6c446a3f7eafa061b002e69
- MD5 1d7f57aea53767fbd3a91ad3aa460426
- SHA1 349d67eb8d1d3a02b144ee04c9ff2ee2764cdaee
- SHA512 aa2c93107dab81d2bb729605fd947cb40fcf1733db162ffcd26994d940ace47648593f069e35fbd085d6ed2e56a30203f5ad38eb4bacfec5e3dd36c2c9dd60ca
- SSDEEP 1536:ABUaGQCigDpJIgIkoL42ruIeVphImuPBJA8ezplLRSku1uJBKYsPEm:ABUaGdigDI2L8uIw6muazplCInSPEm
- TLSH T1FC633B368A23FCD0777E3D80E01439561C883E7B47B5667CFA811DAA28A5640DF3F5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 64KB
- SHA256 86b64448dbf9017616dadb53307fa59f77692d0980761f7ec4c98c123fc7fc7b
- MD5 900df0c4f00683fceff0abde27d92d19
- SHA1 00c9cfeba55a8d7d992f47f74b686670aed6a2b4
- SHA512 f11b1fde6b378c7fbcff899c8a9f41254b9e2f601e453a9f4c6d5953e1de937c3ea19370a7fcb25830ba17a73623ccfd775a5b891b2dc281f595e69cfdc7b575
- SSDEEP 1536:gBUaGQCigDpJIgIkoL42ruIeVphImuPBJA8ezplLRSku1uJBKYsPEh:gBUaGdigDI2L8uIw6muazplCInSPEh
- TLSH T1A4533A368B23FCD0777E3D80E05439961C883E7B4775667CFA811DAA28A5640DF3E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 fd7720b5aa22889ce3202ec86ff66fec16aafab19d3894336c5c6f8019fa1951
- MD5 5f65f0d1316a7ef6c4c1208ae2d0b487
- SHA1 6bea9dcb47a32387367982d12047916de25028f6
- SHA512 a8617d8da039ba72f5334a16b51371b2d03d2a3a96e6301f3990e7ae9e9036e47bc68326f4c94a58692ae519897d00cff021171d723e498828b29152575354d8
- TLSH T175E02BA9CC21EC2B4DFD471D50544746EB21136717A0895F3A3C8108CFB06AB02C585C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 312B
- SHA256 09a3ce4bf8e00d231091f86e724b1006deae7c621b6777e0902a13a49da051d5
- MD5 487ce90c8b3c30bb7d43b5b9abf908a7
- SHA1 9d27122c106e6ef477bd757e8179f1b80cf40015
- SHA512 d70a22a0cc6d3bbe70cdfd1961896218e6d64bb2be8666b635e1dc60cff67d3f4f7ff2c6ef5b9d05631952f30108746f5d501e86aafe1291d23a47fcc11b1fe9
- TLSH T178E0A76909DBB415D797BAF4B4B60F2834736DEE4307526F895E2C0454437EA4152217
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 55cc38d45da11ca414e858e672b3210d991e235f6499570353281daf09cf22eb
- MD5 4e49664c10b235db22a5e55cfcb8c0b0
- SHA1 7325a76259d1bfb8b619d30aff618f4a0e9fbfa6
- SHA512 4b46602902c32c50463c598ee3cc87fac1f62b10a374b5eabec407a6538ab17a81f158fc7dec42f161c7870efb2985eb4bd1f94c38d8ca4621a93d8cd72138de
- SSDEEP 192:DaktRgG1EvaIaEd6YWFMIjR9KzuaRra5aOZMnoS:DaktRgG1EvaIaEd6YWFMIjR9KzuaRrai
- TLSH T1CEE18FF7C3D8972DC91252F59B146E2BCD690928436D3C26C8D9AE1BE3E2872E15064E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 6KB
- SHA256 780fb645d232bb13ba3e58656f47e1bb82cd1a2db605b94a6e9a1969ee48243e
- MD5 ef2e2ca3b57734f307d47aece82d5b8e
- SHA1 d4d1c05112063dcedb032117d9e7253ce838bf43
- SHA512 8fae8717cf8f7a88f9b81c2fa5d6ba76a80b7faf8601e5ac1a006da275604ad604f442c0d63425f2c62605ef7f7530071a86f6ded6fd6d0f0e6a3e8925746353
- SSDEEP 192:DaktRgGNaIaEd6YWFMIjM69Kzuagira5jb4T:DaktRgGNaIaEd6YWFMIjM69Kzuagirag
- TLSH T174D1A1F7C3D8972DC91252F5AB146E2BCD790928435D3C26C8D9AE1BE3E2872E14064F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 5f958a6a7f3dec25b173dcead5694924c3f296eb537e851e3972db614b8589bd
- MD5 52104cb364b76cbb02acd08ba3a668f4
- SHA1 0b3110df8169300f159845ee95fb4e8343b811c1
- SHA512 c255b382ddb71db120a15088a1997e874bf99dfb7e345fad426f928dee5b2dbd531c026cd69fc186e7adb9c2ee9a47bf5255fba7989132ebc9024ef30f2d081d
- TLSH T102417CB3C7E8867D890156F4B7152E1FCE290E24536C3D5AC8D4AF1F67E28B5D20058E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 5d73ad0d1e830e83dded68017ec56b919347a6c02356c7eddf785ee67d3eff91
- MD5 f37086a9e5331002a3543af4913a1a72
- SHA1 1e03ebe02ceb4bdb209267ab619825d45bc20af9
- SHA512 ae267c67daf86257a8fb09ff43f7f765f1412fa613d592a2e29e116d65684934503cc4711e2400f821b204885bbcb64655c8fe02ceb795dce8b78523086167d9
- SSDEEP 192:IRccIPLPD8wX2v7ApAPRp2+lb9qHsb+WNn6bnL52aD2fF1ev2VyIsnAUge:IRcccLPpCkUXZkwKN2A2fFEOe
- TLSH T1C542A72EFE10697B9CCBC215FA657B67E7F5103621902E80EAFC992C28D75CD211742B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 15a6fe12e3489cae1c96b38ba5de6096cf6520825d9d3e23718cfb0ecbb1edd6
- MD5 4ecd781f1f73bc4a4a19868116972274
- SHA1 0321c7224a1b57687ddab2755586aa64757f34a3
- SHA512 20ea9ecc523f5bf19c7f9b2b067b031ddeb60cf058b34879fa5ff37a5c34eca80b7f1c7af435362a8ea8b5a4e8df4429b0102b3f73352fc341e2e02b72735cce
- SSDEEP 384:V7jxY7KxkXqKf/pUZNCgVLH2HfgsluX7pLuLcMvKXODx4+ErU31PHG0/dpS8gfmn:V3xY7KxkXqKf/pUZNCgVLH2HfgskX7p0
- TLSH T138720A67AC4C9E374F94D6CCDC177B4FADB5015B61E988A482FA9C1903D5BCA010A1FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 144B
- SHA256 38929c1876e70e492649ab6606b2e49a23b7f48ce67bacd51176c53625890f0e
- MD5 677e9fd6d8affe15ce8b8fbc03c16e7b
- SHA1 de346d5f8bbb2b43f49a25cce7ffada2add90e20
- SHA512 275cc7455021f00c48bc03080b5ded8b0b3110d2345e33d369e66cd9cd9c3fdcbb0099655b2676e52dcc0566bf6c8541141660fcf748c8dc2e835e054212a6f3
- TLSH T1B8C01246C505B212C19B03B82196D89C71289F20DB0F13CD47F81B63FC3513181171E2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d116.TMP
- Size 96B
- SHA256 d6e465f8c4e9cab2649af52f90c9a18b82950844f0d3e7af54d6cda8e0f4e0cd
- MD5 02210c5406d9598b22a0571328dda63c
- SHA1 eb05671c077f793faf5171812bdeb1b147baf250
- SHA512 ee4abe1e24aec671abfe3ff46ddd2fd4c2accef60955793fa541e7e155873ddcc4ae8d487387a4258a6f88b26e1708306898041d105b10671d71ffbc3a302e2c
- TLSH T1FDB00255C2027316C08357B025DAE6E8B160DF69C743921292F02A77DC656B18D252A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 b615e7371a9eab3922f11e443ec13bc0377a84ca1e08b00b0bb29bb4a96d746c
- MD5 c3c75bc2865acef814c44ca8cca22c21
- SHA1 6ef498999d84f8b4fb917de521378c48e7718f15
- SHA512 e86fef506e44d22089e3d0786709398a28cf88073cba59da1f9f450947816a2f110e213d4ed856382c9a02c29f76f60463964c9349440d5737f3dabd9499d183
- SSDEEP 192:tB+XuvBnl3JsueMEGvIW1/rcP2O3pX6npq3VumXwkA:jeuvBnhJsueMEGvIW1DcP2Ox3VumXnA
- TLSH T1CBD3874B3A743002EDE59A721CE051BB5E3C717D8F56A5D428B620588EF2863B63D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 ddc78111dd7c70307682f9fde769737fd68492dad12c770143ae84f57ba435ce
- MD5 fedcd5de69c357b7af488f8ad8709ab7
- SHA1 37ce595254cb82bfbfcbfe0d61b496e06b0e2682
- SHA512 07aee39fdc7f8cf6257f4fdbf6f1fec45ae335fb2e52726c38bedf89e503e4b54e48caff1cca354bb2ef05099cced6c45c1b7561a36706fdcb416df852fa6250
- SSDEEP 6144:P4xKcvfHpY1X0AkL69mn8lN/9n9Jp2m7Rkm1tYpBeh2BAox:GKwPyX0Abk8lNVb9oBGcAox
- TLSH T1133422394C75ED378CD9A73F605F3A2D2FF09966C918DC86C9C02B48B7583905A88578
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 0f295fd75ea5fd69b5130ade1524763c8fb1e6f0bc7077bbc7575b3fb76da695
- MD5 6457301b6ee3c51341a24ee1a59c5168
- SHA1 ea37bf2e48f7f8bd2f46134951277aaa6479d1ef
- SHA512 1a1ba18be614a4051d66bd26734e080c3dc057aed90af9b017533d20ade0dd967061fb82cee018abc753629596b6821fd74c4f4675d695be8a3a24d8fc234b24
- SSDEEP 3072:AUGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMg:km7Rkm1tYpBeh2BAog
- TLSH T1F7C3123B5D75ED3B5CB5A74EB08E0B1E2EF149A6C920DE9288D85A0437F97CD0A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 61ac1a1165f9145250bb557b9732c262c5173e1827cea8ede10113d26adbe060
- MD5 85fa500c021a29c9dad63d9c9f6e68f2
- SHA1 4a3dd9f44aa4d931cbb9f9d8b71f84144b6d951e
- SHA512 c76f5154fcf485ec4c8948465b6b27c0be42f86313c8558a60c1cc23899fd594f7c6d495cca39d39478f8f725c1371fa2ad85ce5a9444e8ba3da7e7ceb6d44f5
- SSDEEP 3072:ilGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMB:Pm7Rkm1tYpBeh2BAoB
- TLSH T159C3123B5DB4E83B5CB5A70EA04E0B1F1EF149A7C920DE92C8D45B0437E9BCD0A44A38
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 901157cc314c29a6eb8a42b219f5415bc914152dd71fb7a43cef1542b19321e4
- MD5 c2c37477638365bdf7ff0d15b2d631a0
- SHA1 de1ba65f6600598e5b034d02faeb6c5827131f0a
- SHA512 672165847f7ed48229a5d2117ad6a3d3c207e91aecfc1c3441d93d3b65220ff8545649b0af03ab9d7c9a0cca3c43b27ab797a528ad71a293dceaaafe8c3a7e60
- SSDEEP 6144:0xKcvfHpY1X0AkL69mn8lN/9n9Jp2m7Rkm1tYpBeh2BAox:qKwPyX0Abk8lNVb9oBGcAox
- TLSH T1013423294C74ED375CD9E33F706F2B2E3FF098A6C91898C2C9C06B486B64794568893C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-08-07_4c74652f1905d0d173b06d54d132c59e_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_02deb3i1.u3e.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 0434a7c6686741c1a01bf3c9d37a2cca779d538e506fe335e1deeb50839a232b
- MD5 1877f1cc8316e228d4d8af8236e171bb
- SHA1 2fbd2c43de8ba5fca908adc1b262bd86e3740604
- SHA512 b77aee24848b8f43b8cb215bb4726cc9f50e5944eeb1a0767cd49c40cc534db486ba2081377adda6fe40bf6b95e1b584306e1be9edde6753af66896fcf9ba9c0
- TLSH T1D8E07D47A10C85951002112BC0F28D0CD9B1A5192727AF609751DC0D36508C659F1442
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 5c16ab5ba900d2b5e2b410889c0397573177f9fc8c2e76b05f03adafd31f9d39
- MD5 1ccf1e08079a53089d9b545fb70be1ab
- SHA1 428bb2cb2931cfe7446033fbf312d93d75cd30dd
- SHA512 93ef078a089fa6b28edb881b26bee1629c05eb32aee4856fd77f09577a3501d8f32950d2832a2d8d7c401e4490b0494c31980ec054b84dca40b98c55909c5af0
- TLSH T1FCE07D47A11C85951002113BC0F28D0CDAE1A5192B27AF209751DC0D364088659F1442
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 48KB
- SHA256 a4fdf0569001081d424aedb736102b9fb3a98f58e1be7f751ac65b255b61b418
- MD5 4c74652f1905d0d173b06d54d132c59e
- SHA1 b2982f286dbb05d64ccac94967da41332d39b067
- SHA512 493148e7f39065ea8f0ad4f00661ff0edca6ab6d6d1c6a4fccb6fb63347e1572bd477ad56e9e330697c4cfdee127e3874df882523f609c341c5f072bae3b749f
- SSDEEP 768:zhHDTj5D++kqzyYj1g/4S//o4IC1XXGblfA09KFcx:9HL5DISTxgwSI4IEXGblf99ucx
- TLSH T1DB23F60437F98511E1BF5ABA8DB196019B31F4939C23D78E07D5058E1AB3740CEA8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH