Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
09/08/2026, 10:19
Behavioral task
behavioral1
Sample
2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
49 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
46 signatures
150 seconds
General
- Target 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 49KB
- Sample260809-mct4padn2s
- SHA256 ec1e40c8038735fce3921169d92fa5dd2eae09c0fa2023af5691ece4b6a2cefa
- MD5 29c6b4c0c622b79fc67d282c688338e6
- SHA1 b3f8708ae0b64f2d8bc0a94fbb5a0f05dd14c124
- SHA512 7837beeaa795da8eb48f9fe7d3c9ba04517938d2175d590df9427802ca89a578ab13412b5c41b9d4ba5098fbeb180ccac67def5e33b4b36aa611b5f41afd77d5
- SSDEEP 768:khTDb3uOriweukumSLjLM4U//o4QC1XXGblfA0t/KFc5:4TXu41kUzdUI4QEXGblf9t/uc5
- TLSH T10233F71477F98211F1BF4ABA8DB182119B31F8979C22D78D06D5058E1AB3B40DEE8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://socolivetv.video
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://socolivetv.video
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/5092-0-0x0000000000A30000-0x0000000000A42000-memory.dmp disable_win_def behavioral1/files/0x000700000002496c-2351.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/5092-0-0x0000000000A30000-0x0000000000A42000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x000700000002496c-2351.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/5092-0-0x0000000000A30000-0x0000000000A42000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x000700000002496c-2351.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4024 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 6016 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_97.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_106.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_29.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_135.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_138.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_144.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_178.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_46.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_82.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_163.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_188.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_54.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_59.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_184.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_27.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_95.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_122.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_160.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SysUpdate.exe 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_142.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_193.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_23.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_101.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_165.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_183.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_109.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_128.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_140.pdf 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 5360 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 5404 wscript.exe 5208 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4008 sc.exe 4868 sc.exe 1576 sc.exe 3632 sc.exe 1004 sc.exe 4400 sc.exe 2984 sc.exe 4132 sc.exe 4428 sc.exe 1684 sc.exe 412 sc.exe 6124 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1116 cmd.exe 2228 cmd.exe 4216 cmd.exe 2428 cmd.exe 4780 cmd.exe 2360 cmd.exe 4552 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 116 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 5284 NETSTAT.EXE 5384 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5368 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1032 vssadmin.exe 5432 vssadmin.exe 5924 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307443929437789" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\.pdf\ = "PDFBotnet" 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open\command 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings\shell\open 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\ms-settings 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 760 schtasks.exe 4924 schtasks.exe 4784 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 4024 powershell.exe 4024 powershell.exe 4024 powershell.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeDebugPrivilege 4024 powershell.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeIncreaseQuotaPrivilege 3168 WMIC.exe Token: SeSecurityPrivilege 3168 WMIC.exe Token: SeTakeOwnershipPrivilege 3168 WMIC.exe Token: SeLoadDriverPrivilege 3168 WMIC.exe Token: SeSystemProfilePrivilege 3168 WMIC.exe Token: SeSystemtimePrivilege 3168 WMIC.exe Token: SeProfSingleProcessPrivilege 3168 WMIC.exe Token: SeIncBasePriorityPrivilege 3168 WMIC.exe Token: SeCreatePagefilePrivilege 3168 WMIC.exe Token: SeBackupPrivilege 3168 WMIC.exe Token: SeRestorePrivilege 3168 WMIC.exe Token: SeShutdownPrivilege 3168 WMIC.exe Token: SeDebugPrivilege 3168 WMIC.exe Token: SeSystemEnvironmentPrivilege 3168 WMIC.exe Token: SeRemoteShutdownPrivilege 3168 WMIC.exe Token: SeUndockPrivilege 3168 WMIC.exe Token: SeManageVolumePrivilege 3168 WMIC.exe Token: 33 3168 WMIC.exe Token: 34 3168 WMIC.exe Token: 35 3168 WMIC.exe Token: 36 3168 WMIC.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeBackupPrivilege 4124 vssvc.exe Token: SeRestorePrivilege 4124 vssvc.exe Token: SeAuditPrivilege 4124 vssvc.exe Token: SeIncreaseQuotaPrivilege 3168 WMIC.exe Token: SeSecurityPrivilege 3168 WMIC.exe Token: SeTakeOwnershipPrivilege 3168 WMIC.exe Token: SeLoadDriverPrivilege 3168 WMIC.exe Token: SeSystemProfilePrivilege 3168 WMIC.exe Token: SeSystemtimePrivilege 3168 WMIC.exe Token: SeProfSingleProcessPrivilege 3168 WMIC.exe Token: SeIncBasePriorityPrivilege 3168 WMIC.exe Token: SeCreatePagefilePrivilege 3168 WMIC.exe Token: SeBackupPrivilege 3168 WMIC.exe Token: SeRestorePrivilege 3168 WMIC.exe Token: SeShutdownPrivilege 3168 WMIC.exe Token: SeDebugPrivilege 3168 WMIC.exe Token: SeSystemEnvironmentPrivilege 3168 WMIC.exe Token: SeRemoteShutdownPrivilege 3168 WMIC.exe Token: SeUndockPrivilege 3168 WMIC.exe Token: SeManageVolumePrivilege 3168 WMIC.exe Token: 33 3168 WMIC.exe Token: 34 3168 WMIC.exe Token: 35 3168 WMIC.exe Token: 36 3168 WMIC.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeDebugPrivilege 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeShutdownPrivilege 3216 chrome.exe Token: SeCreatePagefilePrivilege 3216 chrome.exe Token: SeIncBasePriorityPrivilege 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeDebugPrivilege 5284 NETSTAT.EXE Token: SeDebugPrivilege 5352 whoami.exe Token: SeDebugPrivilege 5360 tasklist.exe Token: SeShutdownPrivilege 3216 chrome.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe 3216 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 3216 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 85 PID 3216 wrote to memory of 680 3216 chrome.exe 86 PID 5092 wrote to memory of 4024 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 87 PID 5092 wrote to memory of 4008 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 5092 wrote to memory of 4428 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 5092 wrote to memory of 4868 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 5092 wrote to memory of 1576 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 94 PID 5092 wrote to memory of 1684 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 96 PID 5092 wrote to memory of 3632 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 146 PID 5092 wrote to memory of 1004 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 101 PID 5092 wrote to memory of 4400 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 103 PID 5092 wrote to memory of 4036 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 105 PID 3216 wrote to memory of 224 3216 chrome.exe 106 PID 3216 wrote to memory of 224 3216 chrome.exe 106 PID 3216 wrote to memory of 116 3216 chrome.exe 107 PID 5092 wrote to memory of 412 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 108 PID 3216 wrote to memory of 3368 3216 chrome.exe 109 PID 3216 wrote to memory of 3368 3216 chrome.exe 109 PID 3216 wrote to memory of 764 3216 chrome.exe 112 PID 3216 wrote to memory of 3380 3216 chrome.exe 113 PID 3216 wrote to memory of 764 3216 chrome.exe 112 PID 3216 wrote to memory of 3380 3216 chrome.exe 113 PID 5092 wrote to memory of 2984 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 114 PID 3216 wrote to memory of 2156 3216 chrome.exe 115 PID 3216 wrote to memory of 2156 3216 chrome.exe 115 PID 5092 wrote to memory of 1032 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 149 PID 4036 wrote to memory of 1900 4036 fodhelper.exe 119 PID 5092 wrote to memory of 3168 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 120 PID 3216 wrote to memory of 3284 3216 chrome.exe 122 PID 3216 wrote to memory of 3284 3216 chrome.exe 122 PID 5092 wrote to memory of 5404 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 127 PID 5092 wrote to memory of 4784 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 128 PID 5092 wrote to memory of 760 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 130 PID 5092 wrote to memory of 1116 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 5092 wrote to memory of 4552 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 5092 wrote to memory of 2360 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 5092 wrote to memory of 4780 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 5092 wrote to memory of 2428 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 5092 wrote to memory of 4216 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 5092 wrote to memory of 2228 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 142 PID 5092 wrote to memory of 4924 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 143 PID 5092 wrote to memory of 5208 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 151 PID 2228 wrote to memory of 5284 2228 cmd.exe 152 PID 4780 wrote to memory of 5352 4780 cmd.exe 153 PID 2360 wrote to memory of 5360 2360 cmd.exe 154 PID 4552 wrote to memory of 5368 4552 cmd.exe 155 PID 2428 wrote to memory of 5376 2428 cmd.exe 156 PID 4216 wrote to memory of 5384 4216 cmd.exe 157 PID 1116 wrote to memory of 5432 1116 cmd.exe 158 PID 5376 wrote to memory of 5492 5376 net.exe 159 PID 1116 wrote to memory of 5588 1116 cmd.exe 160 PID 5092 wrote to memory of 5648 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 161 PID 5092 wrote to memory of 5924 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 162 PID 5092 wrote to memory of 5948 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 165 PID 5092 wrote to memory of 5988 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 5092 wrote to memory of 6016 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 169 PID 5092 wrote to memory of 6124 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 170 PID 5092 wrote to memory of 4132 5092 2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe 173 PID 5988 wrote to memory of 5476 5988 net.exe 175 PID 3216 wrote to memory of 4860 3216 chrome.exe 178 PID 3216 wrote to memory of 5968 3216 chrome.exe 189 PID 3216 wrote to memory of 5936 3216 chrome.exe 190 PID 3216 wrote to memory of 6088 3216 chrome.exe 191 PID 3216 wrote to memory of 6052 3216 chrome.exe 202 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://socolivetv.video2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaae75c728,0x7ffaae75c734,0x7ffaae75c7403⤵PID:680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1664,i,1908724924821913006,8613349999197360862,262144 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1980 /prefetch:23⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,11519213994731599724,12001579364500400409,524288 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2248 /prefetch:33⤵
- System Time Discovery
PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2364,i,11039900501635907882,14968281073653144882,524288 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2376 /prefetch:83⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3124,i,14583679826317324330,8793418343705484327,2097152 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3144 /prefetch:13⤵PID:764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,10293096286452415842,853511658706884148,2097152 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3172 /prefetch:13⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=3924,i,9694584985065554357,10822812850815359376,2097152 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4424 /prefetch:23⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --metrics-shmem-handle=4668,i,18339258254874983029,10069247853614733382,2097152 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4684 /prefetch:13⤵PID:3284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=3416,i,1587662881166388988,6124520550910126060,524288 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3420 /prefetch:83⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5708,i,12699906486650040393,5735542239069483321,524288 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5596 /prefetch:83⤵PID:5968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5704,i,1974168091503420872,11503027008225948110,524288 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5588 /prefetch:83⤵PID:5936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=4656,i,18211219825307738169,8111287214803082144,524288 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5668 /prefetch:83⤵PID:6088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=4432,i,7316406792370624717,9686116096198296606,262144 --field-trial-handle=1984,i,14925218869366563830,8983165305115327306,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4528 /prefetch:83⤵PID:6052
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:4008
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4428
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:4868
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1576
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1684
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:3632
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:1004
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4400
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:1900
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:412
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:2984
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1032
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3168
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5404
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4784
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:760
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5432
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:5588
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4552 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5368
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:5360
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4780 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5352
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:3632
-
-
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:5376 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5492
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4216 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:5384
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:1032
-
-
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:5284
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:4924
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:5208
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:5648
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5924
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5948
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5988 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5476
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:6016
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:6124
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4132
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:4160
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4124
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:2920
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:5020
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3976
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260809_112119.jpg
- Size 75KB
- SHA256 0d342632a806643f8a82830e4648058cb385804839c58aa693036fbe7fa1e582
- MD5 4edcfedad654174410f79aa89c344858
- SHA1 b014a7b90a52a5859f72af9f0f89ef6bc2775cdf
- SHA512 ed41247389c2004b9c959682dc51d612144b39588489eee05acdd92ed1fe9d26613042c8a079d9c0a4b3840f06828c6713f95f12c01db4470661d674d1c873fb
- SSDEEP 1536:IprRRRRRRRRRRRDClKxDm1w2zbyvl/bXeIb:xcxC1w2utr5
- TLSH T1C6731F1748089B82F12882E4FE071DAC2F566B1CF89779FE05161EDB7E612764C8E47E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 5f22394e76bc9b99ae88dc37b12870f74222e1d827ff4ebd3e09e84060efd461
- MD5 57a8a10fc17967984c54c2968b41fdb3
- SHA1 11857c934636b310ac065d2c653f818e74d41fc5
- SHA512 b7a132ba958e96df907352b988dcba08d3da87291a8b840169ff257c8297a2424b832b16e441c52219e14adc3c7ebef7b249075db9490dfe215819f87de0539e
- SSDEEP 1536:OvBUA19Tir0iGv/IoCzD6DxXJU9w1KtsNL1vc140zzOCBVEFPEl:QBUA1Fir0fvXKW95Uy1gs1Ue0zzd0PEl
- TLSH T142630B36CB23FCD4677F3D80E0143D561C883E6B87B5267CFA85199628E5680DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 65KB
- SHA256 954131b05cd946597043f48c4b98275e70fc1c89a1e571ff97380f73cd084b3c
- MD5 7ee78a3277a9f5e4fc00d454e498f676
- SHA1 fcd66956812f94be06b33656f70cea8ce83cca83
- SHA512 eb51ce75f65b497d5d33cf53fd8daec38145216eabb538ef2d935541c91cad87a5e7dc577e0e275d1130dcd2e3a12d26e8167457a4c5d28d5df0f94a3f45135d
- SSDEEP 1536:uvBUA19Tir0iGv/IoCzD6DxXJU9w1KtsNL1vc140zzOCBVEFPEk:wBUA1Fir0fvXKW95Uy1gs1Ue0zzd0PEk
- TLSH T118630A36CB23FDD4277F3D80E0503D561C883E6B87B5267CFA8519A628E5640DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 1089df1988bba95e10c53eb508ef8cc9d46394f28b4829d8f3c93f5d80329391
- MD5 6ed6923098f2d1e0f79479c4b7356adb
- SHA1 7883952f8593650dbe03df821d5c9b991b0a4b21
- SHA512 8b22ade03dd5f06f1aeeb1a8fabea391520f6fed2ce02f8eee98f5b23930b1e89bfd21ed9e69b5ef549dedf657acc1c07576571e50028565b96ff7d82322dfd7
- TLSH T1DCE02B96C961AC372DFD075811914705EB65135A2A81496F3A3CD30C4FB1A2A4187D5C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000010
- Size 42KB
- SHA256 2123107379ba390f6892513cbce2f1aac49dc6881205a6b729760a72d42083ec
- MD5 cbf2b96e809c5c1a3cfe28e9744fbab2
- SHA1 9872366fb8994bf48ae670a3816547123a39a670
- SHA512 ed61230bba47c8c81f3b78a9ea500c27b6c5d254cca692fc2ecc2e2f6f0d76dde485eeb45dd4e249a41021d95be99136f37c84a4e1cf9429d52436d6bc095b96
- SSDEEP 768:Uaes5t5slxwQoy6StREZPxRMB0L6eORnvXV6jJjYDACUE:6ytulKQh6Sj0xRMw65vV6WAzE
- TLSH T11213F12970D8F7B3B115D60892B62EC73633B9A9B423529CBDB04FC63EA17612127D13
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 360B
- SHA256 4335eea556fab449436c9280d0face76c284a4c12ea9f5f89f4bbb26854c914e
- MD5 b5ed4f0d5d0759c57dd271115e589aa1
- SHA1 5f72cc3837647173833f47a46cffd4369d95a445
- SHA512 0c54f846bfe62057cd8c9c54269d88fcc6673968df3236315fb4234f26c06ca41cb02b73133ef2669d9505244b463a9d3e33102af6f538d022ed2ae4e31cf1dd
- TLSH T1CDE05B5167E5B044CF51433A51155D112630157F116E07436691FC54D9037F5CED2355
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 4KB
- SHA256 5d9cbe571ccd1d489af103f078cc8690084edf032153216f5258169e9e85aedf
- MD5 90a05400db14891e1ee8da4091814c12
- SHA1 29bfa3df80c7e611a2bf31d3d89bf66308920997
- SHA512 a5dd78b73ed9a654a68bc628c6ab1ebd1425bd33dd8fc8e0292ae0f8bd126a9e14e9ffc0a0129c7d1f53ea3cbb2472fa077c1835935d9a943cd67f676d4e0fc8
- SSDEEP 96:DoBocoT1aIaEdalzotioAfoqoBcodono1Po5oH8l:DoBocoT1aIaEdalzotioMoqo+odono1y
- TLSH T10BA1ABF7C7F8992D890152F0EA596E1BCE690928532C3D5ADCE4BE0B53E74B2D24064F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 aa563d117f4d4bf3e257580e56c8c4940df11b4903983192484a1ea7102add76
- MD5 6e6b81fb4580f64a338cb0582a6400b4
- SHA1 3d836272fe2409831287d30142be4c55f10da80e
- SHA512 425624650b0466cfa2a7c8621f9b99773446f7d00d99d8ef74d70f539c7629a5bb00486f5415a113fb53d8537c167c2a7a8451eac3b9d10ba8a05e0a94b2b2f2
- SSDEEP 192:LRHWLtVcmVvDv7hpAPRp2zl695Hsb+WNnIazgX2CJ50kwLfmVyIsnAUgtaJ:LRHA8Q79UXtrwho2e50z+8
- TLSH T10742D92EBD10657B4CCBC225FD267717D7F7206125A41E84EAFC8A6C15EB9CC221741B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 16KB
- SHA256 02c350f2797cef3abcbd01174589eb3f77e1f116c6b262051119a6b04129b70e
- MD5 bf8570b876e66ddbb6deea0c1036738d
- SHA1 8b7bac93cc87b0076c8718468e11d052ee384d07
- SHA512 95851cdd76d6c8577ae7d42550a13dd57f1b6cb23a750c4efd53b940f14ee9c4d4bc63ff1789b6d9a8de88bdcd6ea0ab7c7cb57e0c939b77f7c7baac86c936c0
- SSDEEP 384:Kkj+F7KxkXqKf/pUZNCgVLH2HfgsloD7pLuLcMsNXOD+F+ErU3qsHGZ45hseHkL:Ko+F7KxkXqKf/pUZNCgVLH2HfgsuD7pv
- TLSH T19172F9677C4C9A770F94C6CCEC277B4FADB6024B65E9886542FA581503D5ACF010A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
- Size 120B
- SHA256 ef8eb2bca4ed3fc2bde898d98c6d9e920ea02c825483f302cfa24b4f45632ef4
- MD5 2880e2800cc604cbc544fcd8c68b39a9
- SHA1 bc3902630abe4ee2e592491996158085f4e2751f
- SHA512 70ac24e216742c80b4e99dc266dbd230966e29fc77406b4600614945b670300bfb6d63bcc4711049e2d42ecbc4a42ecab72088fe3756290abbc08d44ff2abbc6
- TLSH T11FB0128190019112C0460EF41DD6188C71349F11960E270147F479738826162C014090
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ccf0.TMP
- Size 96B
- SHA256 ecf4fd3fdba4400ece4cf2915fe756d0c6ba25e36cf7006d283e8a0c989a7750
- MD5 f5d1cab119a9fb3dc96187e58918571f
- SHA1 c0a0bd329eb097fe52790c9e4a8cdb13bf5a7301
- SHA512 61da62cff668e1420300b0352b1b5b3bddcb70a9d63502a78ff69ce570acec2a6e07ece61750ebbfd4268cfa9f983779bfa9f98873d180ad53a8c3d38a26553d
- TLSH T15CB02238C2022202C00B03B0288280C8F020CF2EC303030383E02E2ACC20AAC0A208A0
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 b3654175fc85ab6fc8ca8c7685990194204a9d42aa98dd5315336a4d5994bd9a
- MD5 b91f1dfddedcc30076f5b978448e6974
- SHA1 ffc9b367a565b74869594d8751c2c81e39ec4cc9
- SHA512 c6391b2d65f50061063bafc620a6b208313bc2dab89496937aa0cb5d0010789911ce7f5204303ed14b55f07c9a0578796c6cf9c84be8649e9ac2ac959d3574c4
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2OKzHRVumknW:1nbZeMrv/hGtKzqnW
- TLSH T1E8D3B84B3A747102EDE58A721CE051BB5D3CB16D4F55A1D428B620688EF2963B23D0FF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 58a4f76c17abc56b573cd69b7b08500f5bc43558053a6758ceb9f251ab77ce6c
- MD5 0daf982d63cae6fc1a1b3ff6943b48f7
- SHA1 ffc6c951b118eb2632572e8d26fae9ad9c10e033
- SHA512 7339c0f39bec3b39daff80cce9a77ec5b10f315b8b9ff597922c9b1badda3ba17682f339e6a23507fa9620484f271ec96872564315d718d5156fab553f29e332
- SSDEEP 1536:6fyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbji:Yqfd7NtZL8cHQRZEQ6Sps9
- TLSH T1DBC30237EBC21E335D82CB64BA534FDA97B644A99030D301AABD3BFB6C93451644249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 1ab5245547d0c482925358fb53ee26a03be15d650389c3d6cf874ca362c6adae
- MD5 fb9c7a0f29b9a1330b9bd7c725a7e11f
- SHA1 482ef76b206e08ec210c5480a90f29de318c9009
- SHA512 582554cadffb07a118a7731106126011572dbd385492bd4b6d3162438a4af074f007ae94fe56a3204a72802c98e324758ffad9831d55a6e457a61fe2317f1615
- SSDEEP 6144:Cj4hxNPRW2PYddqmY7U52FjqZ/ZLW3Exx:CAXPRW4Kq97UAdqZ/piQx
- TLSH T1CC342232BFD22F354C86DE6836432D2E6FF688DD90B4B745E9686F4B2C47811A45389C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 cfe30237a691e0ce3ddd32dcbf6a757a397b6c53aa648668f08190602573b88d
- MD5 0b3fb834f10f3d0c5f7f9d87ce2a8585
- SHA1 4e6ceca35831ebfe8bc1740c74add02a520c787d
- SHA512 476ca990cbeb23699c6efaaaeba63502ac7ba4f8b2185e36d57ea121fa1e11cc67de6e4e29519f3ba2371acb14752554c2b72e7ed8ee280d73e319e45389da91
- SSDEEP 1536:/1yEyD4aukHU65fd7Ntk8XOP851ZqODZHQ3gwGSUq0BTQQwsNwSVwxfQEz3bICbb:Nyuqfd7NtZL8cHQRZEQ6SpsY
- TLSH T156C30237ABC21E335ED2DB70B9130EDB97B644A99034D3019BBD2BFB6883455658249C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 4a5f198b804cfce50f09bdcdf7d37a404f747204273ea2cc0a89c7f269c617e0
- MD5 9e2ec48f79074ac67427a61e830cea3f
- SHA1 b33169f512250b9a39ce9a1ce9e67177c9d0d4f4
- SHA512 c5837c277d9448130692bb48f17822a43ef28f80a793f85bff5c57208e05d05f0ffe89034b0a54b2b3bdf7e4b55a6e4b9882fa635a26b72e91464db29e8c32eb
- SSDEEP 3072:9ybXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIcqfd7NtZL8cHQRZEQ6Spsx:wchxNPRW2PYddqmY7U52FjqZ/ZLW3Exx
- TLSH T148342321BFD22F354C86DE6836431D2E6FF689D860F4A781EA696F4F2843C51649389C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 8ef3ce2ed6723fa869a581001d76ede73c114c6fa2bc99be8c587975ee6a64e3
- MD5 ed171cda9eeff3b062badbcbdba5e025
- SHA1 ab449b6de6f63328ff119b654498e69fea4c41a2
- SHA512 dd49581571cef143a26d8f7907a044c244929033c48abb896464c9a2eca4a67a075ffb2154d5661a9153f2f4b5e45bd9a6eaa259c29d5cd2e58b0d81a60d6db3
- SSDEEP 3072:2ybXQSg/TxNP9n3RM2usEnhdFaeqag2Y5ZUVncNBzIcqfd7NtZL8cHQRZEQ6Spsx:TchxNPRW2PYddqmY7U52FjqZ/ZLW3Exx
- TLSH T1DE342331BFD22F354C86DE6836431D2E6FF689D860F4A781EA696F4F2843C51645389C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-08-09_29c6b4c0c622b79fc67d282c688338e6_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eoy3kdth.q01.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 1549756cf2fd76240ddde35df133e0e505d7a6ffb9f550ab6fa72c406a5d7d31
- MD5 4b195eb06a5d294f9dc2e9d935cfba37
- SHA1 ee2a887f65a7e2764cbada6ee36083bc2700ddd5
- SHA512 ddd1a6d33ac038018e81345cfbf07afb460ddea9e1340619abd1f406e38631d8425ac6faac341b7aba24876c0eee3efe54053749a3a951f19c80e0331a4acbf0
- TLSH T192E07D47614C85650011912BC1B28D4CD5A0542836276F2097A1DD4D37A0CC598F1882
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 c0ea45d4044cde23bd5a29363a91a4a2009f4b911268d112249150620e2fbec9
- MD5 3a6b42c209d30d5b55c657f5cc65d9cd
- SHA1 173dd3c2c57e73a4192d7e1e35ccebbb9649b9b1
- SHA512 c8d3f5bb2babac6767791e626b2ae1bb8e8bdd18e4b0433f9ad391d80cd288db34064a8e019d199bbba1ea5c7b4a145f6f8a3e9c4b00cf3d4b5d6af89cd93ef0
- TLSH T157E07D47614C85650011913BC0B28D4CD5D055283A376F20A7A1DD4E3790CC598F1882
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 100KB
- SHA256 f85bc48742de4c24a4bfe99a22bb4b504f39b996dd8fae280bec27840924589a
- MD5 8c20c9175c093c77c07f205f8a7b8592
- SHA1 90c55b200715bcf71528f158c2c6d515a4dc377b
- SHA512 b11a2b20677929f17e7532e6a1ea056533c65780ef04c72c183b45db6ed5f2c6674a83bd2ac36682e4c42cbd72fdbe6e1adca968f0e8f5e95dfd942f381e7c4a
- SSDEEP 1536:JghsmqOOXP/yGFkpbIyJ3jGUfWM+DKrlitXZT:BmeHyGFkp8GKk+D4yXZT
- TLSH T1B4A39344C2B28E2B45825BFF585637C0A13CB7B096ECD5FB20E26E63F4678A6C70D605
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 100KB
- SHA256 d650d16b90ec8279eb0532365691b94a424d9b5425a27a0c015d4013bb432740
- MD5 4b89052702d9a31f286ab4e8485ffdf3
- SHA1 b5672cbbcc3799ac2665477f4999916ce06f79c6
- SHA512 e5988032817ed5adedea2fb25cf70f14f33b72cf6b3599204846dda8c561883a602741bc310bba85901cb4363377322dad87f17946827c0d1ce7c7c977aaca24
- SSDEEP 1536:2ghsmqOOXP/yGFkpbIyJ3jGUfWM+DKrlitXZD:EmeHyGFkp8GKk+D4yXZD
- TLSH T14AA39344C2B28E2B45821BFB585637C0A13CB7B196ECD5FB20E2AD63F4678B6C71D605
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 ec1e40c8038735fce3921169d92fa5dd2eae09c0fa2023af5691ece4b6a2cefa
- MD5 29c6b4c0c622b79fc67d282c688338e6
- SHA1 b3f8708ae0b64f2d8bc0a94fbb5a0f05dd14c124
- SHA512 7837beeaa795da8eb48f9fe7d3c9ba04517938d2175d590df9427802ca89a578ab13412b5c41b9d4ba5098fbeb180ccac67def5e33b4b36aa611b5f41afd77d5
- SSDEEP 768:khTDb3uOriweukumSLjLM4U//o4QC1XXGblfA0t/KFc5:4TXu41kUzdUI4QEXGblf9t/uc5
- TLSH T10233F71477F98211F1BF4ABA8DB182119B31F8979C22D78D06D5058E1AB3B40DEE8B77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH