Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
10/08/2026, 03:42
Behavioral task
behavioral1
Sample
2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
49 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
46 signatures
150 seconds
General
- Target 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 49KB
- Sample260810-d9fswsam61
- SHA256 ef53b73930fdab70312a599b5be63b43f803764a48d4b00b72513ab09f9fd545
- MD5 f9f847d1567867cb030e99c4a0866fc7
- SHA1 cc82cb2be4ab0a20a2cccb54f4949d32f3811371
- SHA512 8cb0fc73c29c5d2f5f9b40f35b69e5a48c856348fc6b65f7800250ac3fb5c23c75aa4baeb6abbf7e8e2393c83aedff64b48e39737a18eb0c6dd23d6183e1b661
- SSDEEP 768:FhR/ByYGy2obH6qhtC4l//w4hC1XXGblfA05KFc6:TRMYGyx6UplQ4hEXGblf95uc6
- TLSH T1F333080437F98511E1FF5BBA4DB282119B30B4A79C22E79E06D5058E1AB3B40DDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
http://sisterhoodclub.io
Mutex
-
ac7e2f05-8df7-4c55-8841-78385f6bb064
Attributes
-
c2_url
http://sisterhoodclub.io
-
default_group
xoilac
-
primary_dns
ali.ns.cloudflare.com
-
secondary_dns
woz.ns.cloudflare.com
-
version
1.2.2.0
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4304-0-0x0000000000C50000-0x0000000000C62000-memory.dmp disable_win_def behavioral1/files/0x00070000000248e4-2300.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/4304-0-0x0000000000C50000-0x0000000000C62000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x00070000000248e4-2300.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/4304-0-0x0000000000C50000-0x0000000000C62000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x00070000000248e4-2300.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2756 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Event Triggered Execution: Image File Execution Options Injection 1 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\regedit.exe\Debugger = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 5740 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\International\Geo\Nation 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_100.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_131.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_133.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_172.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_6.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_49.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_158.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_107.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_154.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_57.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_64.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_153.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_167.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_195.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_15.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_42.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_48.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_127.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_146.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_53.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_91.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_94.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_98.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_99.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_105.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_147.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_148.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_9.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_56.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_169.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_197.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_17.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_24.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_60.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_102.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_112.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_164.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_198.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_114.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_162.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_174.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_3.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_34.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_110.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_200.pdf 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 4984 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\svchost.exe 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\sysupdate.exe 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 1352 wscript.exe 6016 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\wallpaper.bmp" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 12 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1688 sc.exe 1684 sc.exe 1716 sc.exe 1084 sc.exe 4448 sc.exe 116 sc.exe 5880 sc.exe 4544 sc.exe 3924 sc.exe 1972 sc.exe 4292 sc.exe 736 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 5104 cmd.exe 1392 cmd.exe 4424 cmd.exe 4332 cmd.exe 4520 cmd.exe 400 cmd.exe 4236 cmd.exe - System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4524 chrome.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier chrome.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1820 ipconfig.exe 4584 NETSTAT.EXE - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 5136 systeminfo.exe - Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1244 vssadmin.exe 1244 vssadmin.exe 5224 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308069501255161" chrome.exe - Modifies registry class 17 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\shell\open 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ chrome.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\shell\open\command 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\.pdf\ = "PDFBotnet" 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\shell 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\shell\open 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\shell\open\command 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\ms-settings\shell 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5160 schtasks.exe 5000 schtasks.exe 5028 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 2756 powershell.exe 2756 powershell.exe 2756 powershell.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2756 powershell.exe Token: SeShutdownPrivilege 1112 chrome.exe Token: SeCreatePagefilePrivilege 1112 chrome.exe Token: SeShutdownPrivilege 1112 chrome.exe Token: SeCreatePagefilePrivilege 1112 chrome.exe Token: SeIncreaseQuotaPrivilege 2176 WMIC.exe Token: SeSecurityPrivilege 2176 WMIC.exe Token: SeTakeOwnershipPrivilege 2176 WMIC.exe Token: SeLoadDriverPrivilege 2176 WMIC.exe Token: SeSystemProfilePrivilege 2176 WMIC.exe Token: SeSystemtimePrivilege 2176 WMIC.exe Token: SeProfSingleProcessPrivilege 2176 WMIC.exe Token: SeIncBasePriorityPrivilege 2176 WMIC.exe Token: SeCreatePagefilePrivilege 2176 WMIC.exe Token: SeBackupPrivilege 2176 WMIC.exe Token: SeRestorePrivilege 2176 WMIC.exe Token: SeShutdownPrivilege 2176 WMIC.exe Token: SeDebugPrivilege 2176 WMIC.exe Token: SeSystemEnvironmentPrivilege 2176 WMIC.exe Token: SeRemoteShutdownPrivilege 2176 WMIC.exe Token: SeUndockPrivilege 2176 WMIC.exe Token: SeManageVolumePrivilege 2176 WMIC.exe Token: 33 2176 WMIC.exe Token: 34 2176 WMIC.exe Token: 35 2176 WMIC.exe Token: 36 2176 WMIC.exe Token: SeBackupPrivilege 4944 vssvc.exe Token: SeRestorePrivilege 4944 vssvc.exe Token: SeAuditPrivilege 4944 vssvc.exe Token: SeShutdownPrivilege 1112 chrome.exe Token: SeCreatePagefilePrivilege 1112 chrome.exe Token: SeIncreaseQuotaPrivilege 2176 WMIC.exe Token: SeSecurityPrivilege 2176 WMIC.exe Token: SeTakeOwnershipPrivilege 2176 WMIC.exe Token: SeLoadDriverPrivilege 2176 WMIC.exe Token: SeSystemProfilePrivilege 2176 WMIC.exe Token: SeSystemtimePrivilege 2176 WMIC.exe Token: SeProfSingleProcessPrivilege 2176 WMIC.exe Token: SeIncBasePriorityPrivilege 2176 WMIC.exe Token: SeCreatePagefilePrivilege 2176 WMIC.exe Token: SeBackupPrivilege 2176 WMIC.exe Token: SeRestorePrivilege 2176 WMIC.exe Token: SeShutdownPrivilege 2176 WMIC.exe Token: SeDebugPrivilege 2176 WMIC.exe Token: SeSystemEnvironmentPrivilege 2176 WMIC.exe Token: SeRemoteShutdownPrivilege 2176 WMIC.exe Token: SeUndockPrivilege 2176 WMIC.exe Token: SeManageVolumePrivilege 2176 WMIC.exe Token: 33 2176 WMIC.exe Token: 34 2176 WMIC.exe Token: 35 2176 WMIC.exe Token: 36 2176 WMIC.exe Token: SeShutdownPrivilege 1112 chrome.exe Token: SeCreatePagefilePrivilege 1112 chrome.exe Token: SeShutdownPrivilege 1112 chrome.exe Token: SeCreatePagefilePrivilege 1112 chrome.exe Token: SeDebugPrivilege 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 1112 chrome.exe Token: SeCreatePagefilePrivilege 1112 chrome.exe Token: SeIncBasePriorityPrivilege 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeShutdownPrivilege 1112 chrome.exe Token: SeCreatePagefilePrivilege 1112 chrome.exe Token: SeDebugPrivilege 5016 whoami.exe Token: SeDebugPrivilege 4584 NETSTAT.EXE - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe 1112 chrome.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 62 IoCs
description pid Process procid_target PID 4304 wrote to memory of 1112 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 84 PID 1112 wrote to memory of 5032 1112 chrome.exe 85 PID 4304 wrote to memory of 2756 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 86 PID 4304 wrote to memory of 3924 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 4304 wrote to memory of 1688 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 4304 wrote to memory of 1684 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 4304 wrote to memory of 1716 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 94 PID 4304 wrote to memory of 1084 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 96 PID 4304 wrote to memory of 1972 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 98 PID 4304 wrote to memory of 4292 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 100 PID 4304 wrote to memory of 4448 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 143 PID 4304 wrote to memory of 3640 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 104 PID 4304 wrote to memory of 736 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 105 PID 1112 wrote to memory of 4580 1112 chrome.exe 106 PID 1112 wrote to memory of 4580 1112 chrome.exe 106 PID 1112 wrote to memory of 4524 1112 chrome.exe 107 PID 1112 wrote to memory of 4988 1112 chrome.exe 109 PID 1112 wrote to memory of 4988 1112 chrome.exe 109 PID 4304 wrote to memory of 116 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 111 PID 1112 wrote to memory of 4104 1112 chrome.exe 112 PID 1112 wrote to memory of 4104 1112 chrome.exe 112 PID 1112 wrote to memory of 1308 1112 chrome.exe 113 PID 1112 wrote to memory of 1308 1112 chrome.exe 113 PID 4304 wrote to memory of 1244 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 150 PID 4304 wrote to memory of 2176 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 117 PID 3640 wrote to memory of 5996 3640 fodhelper.exe 120 PID 1112 wrote to memory of 5932 1112 chrome.exe 121 PID 1112 wrote to memory of 5932 1112 chrome.exe 121 PID 4304 wrote to memory of 1352 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 125 PID 4304 wrote to memory of 5160 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 126 PID 4304 wrote to memory of 5000 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 128 PID 4304 wrote to memory of 4332 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 133 PID 4304 wrote to memory of 4424 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 135 PID 4304 wrote to memory of 1392 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 136 PID 4304 wrote to memory of 5104 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 137 PID 4304 wrote to memory of 4236 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 138 PID 4304 wrote to memory of 400 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 139 PID 4304 wrote to memory of 4520 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 140 PID 4304 wrote to memory of 5028 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 4304 wrote to memory of 6016 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 149 PID 4332 wrote to memory of 1244 4332 cmd.exe 150 PID 4520 wrote to memory of 4584 4520 cmd.exe 151 PID 400 wrote to memory of 1820 400 cmd.exe 179 PID 4236 wrote to memory of 1300 4236 cmd.exe 153 PID 5104 wrote to memory of 5016 5104 cmd.exe 154 PID 1392 wrote to memory of 4984 1392 cmd.exe 155 PID 1300 wrote to memory of 5152 1300 net.exe 156 PID 4424 wrote to memory of 5136 4424 cmd.exe 157 PID 4332 wrote to memory of 4740 4332 cmd.exe 158 PID 4304 wrote to memory of 1248 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 159 PID 4304 wrote to memory of 5224 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 160 PID 4304 wrote to memory of 5260 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 161 PID 4304 wrote to memory of 5328 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 164 PID 4304 wrote to memory of 5740 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 166 PID 4304 wrote to memory of 5880 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 168 PID 4304 wrote to memory of 4544 4304 2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe 169 PID 5328 wrote to memory of 5856 5328 net.exe 172 PID 1112 wrote to memory of 4488 1112 chrome.exe 174 PID 1112 wrote to memory of 5884 1112 chrome.exe 185 PID 1112 wrote to memory of 5624 1112 chrome.exe 186 PID 1112 wrote to memory of 220 1112 chrome.exe 187 PID 1112 wrote to memory of 3720 1112 chrome.exe 198 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Modifies security service
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Event Triggered Execution: Image File Execution Options Injection
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4304 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://sisterhoodclub.io2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa4774c728,0x7ffa4774c734,0x7ffa4774c7403⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1672,i,269949675444302602,9432855358284255143,262144 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=1988 /prefetch:23⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=1560,i,265863517564374838,12830820089001456712,524288 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2240 /prefetch:33⤵
- System Time Discovery
PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --metrics-shmem-handle=2356,i,904317145590836358,1104679742093190142,524288 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=2368 /prefetch:83⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --metrics-shmem-handle=3148,i,14388720340904585782,9390679917117098297,2097152 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3160 /prefetch:13⤵PID:4104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --metrics-shmem-handle=3164,i,10378813412431092169,9026723432360480991,2097152 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3192 /prefetch:13⤵PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --metrics-shmem-handle=4560,i,6526756962677779567,7922119675590155025,2097152 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=4380 /prefetch:13⤵PID:5932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --metrics-shmem-handle=5452,i,4658887761937992835,1899324038275328400,524288 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5460 /prefetch:83⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5668,i,14849729979041814397,2353875562744788374,524288 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5680 /prefetch:83⤵PID:5884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5672,i,8124437891722331585,5520885116728625678,524288 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5484 /prefetch:83⤵PID:5624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --metrics-shmem-handle=5664,i,5294036055313982959,3910693096860736268,524288 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=5752 /prefetch:83⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --metrics-shmem-handle=1048,i,9871870299993348014,15370058188692309356,262144 --field-trial-handle=1992,i,12432304389362988812,4566082831436693436,262144 --variations-seed-version=20260513-090056.789000-production --mojo-platform-channel-handle=3168 /prefetch:83⤵PID:3720
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:3924
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:1688
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:1684
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1716
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:1084
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:1972
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4292
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4448
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:5996
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:736
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wuauserv2⤵
- Launches sc.exe
PID:116
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:1244
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2176
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:1352
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5160
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 30 /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5000
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4332 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1244
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵PID:4740
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:5136
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
PID:4984
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:5016
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV13⤵PID:4448
-
-
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:5152
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:400 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:1820
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4520 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:5028
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:6016
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1248
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:5224
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵PID:5260
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:5328 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:5856
-
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:5740
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:5880
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:4544
-
-
C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"1⤵PID:716
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4944
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:3900
-
C:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:936
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5580
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵PID:1820
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
5Windows Service
5Event Triggered Execution
2Image File Execution Options Injection
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
4Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\SysUpdate\Scr\scr_20260810_044327.jpg
- Size 156KB
- SHA256 8f19e5b186adb7cb42e2fb4508ea551683565eee3eb50153b8919d23e3ccf7ec
- MD5 bd749abb88bc9ec28ed8057b9cb6802d
- SHA1 d9794d546c1edc424369ca332dfe35716158e31c
- SHA512 099ab9fe8d5720b87cfab5194d3f5162bdb54de78037816a42d7e412dbbf5f4435b9dcce98406f0821db99599904561c13be43de13da481b9c8b35ff8f5413d7
- SSDEEP 3072:hbwMMh/nfyNMTgGriGmef6TQRwuntE1uIi24BBfyGx:8Zn+LGmef6TQuutE1Y2CfPx
- TLSH T188F3C5139C189B93956983E87E130EBD2F1B6B4CA8923BFF51225DCB7E106255C8F41E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 51c5d416fb16384980e35af6c75e6e56d369fe7e11195733db44cf37837659b3
- MD5 7dc6e6e6525d158078a9779d4106900f
- SHA1 aedb9f09742c0ff7ff27d6cd358d3975aeff2e67
- SHA512 d3cce6d71d0163f20353698c05fb7242c1db251f7ebc042ec32e793745e3cd9789015c0c39fdc1b0ddea8ebddb9f2e72ae2ab2ecea2dcf1dba630ee7ea4795e8
- SSDEEP 1536:EuBUJlXLyKxdMBIGvxNyCRt4E7uPBJA8ezplLRSku1uJBKYrPEY5e8:jBUJlbyKjMDLyCRB7uazplCInxPEw
- TLSH T14F632A378B23FCD4777F2D40E0503D561C883E6B97B526BCFA810DA628A5544DF2E5A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 65KB
- SHA256 5458055d2acb10da50f9cc617d687838456ca7cc1d1ca150b81dd6f412704feb
- MD5 f1d594066449ed9e256eff149e9c5662
- SHA1 9789fcd71ed540392111375b2cf762ed57627c4b
- SHA512 a9e83c4d094751718a15b67fb53ab125b8214c2410ace5664fa352e9638040d425656c7ef1c46e008ba56d13bf1e75e3095b0917b6f9824ebffef367729775e9
- SSDEEP 1536:kuBUJlXLyKxdMBIGvxNyCRt4E7uPBJA8ezplLRSku1uJBKYrPEY5ef:DBUJlbyKjMDLyCRB7uazplCInxPEr
- TLSH T15A631A378B23FCD0777F2D40E0603D561C883E6B977526BCFA810DA628A5554DF2E9A8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
- Size 414B
- SHA256 1dcdb17fa2e96c5a477bbc36e829eae8ec5ff580bfcc889d38b8d2be3d1c633f
- MD5 6dc3807ce0155609effe0faa89541648
- SHA1 a8703aebf67c431fe8f740734ef540122e0d9e2b
- SHA512 df25c1e8b7618b1b82f56c95ecaf3be12d2b7cafda98a7121ee3aa8e13a44d658276129a69b6a7b70b19c6643c0579d4f9c8d487bcb026a6bea26e4a7e39de66
- TLSH T10DE02BBADA71BC3B19FD572C50445786E780135B3B40894F3A3D800DCFB4736025581C
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 120B
- SHA256 3ea347ec248605e09568a373b1b7a5f56ec75d26ab7a8aadea8a90c7886c6c1b
- MD5 c847a0f2dcb926436e9a47bffc30f4d8
- SHA1 2a3899318fed26897fb8b7405c26620b0af85fec
- SHA512 6d4841aee5a232b8af27b92d333ed231a2240ccb935eb6ef0edb4878fcd35b1ac2e5a1d27dce3c4b4aaca54066173a6c161fc09f2a3ea5069eab96f762d7bd46
- TLSH T1BAB0120501915672CB5003BDDCFB06D0331337B9019B028BA2C5E58468325FDC781967
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
- Size 2KB
- SHA256 79ebfc914c8e2519c9dcacc31bfca52710ade8691835bc9fb94bdec70cae80bc
- MD5 4dcf6d8140de975b4b3716206c4628b5
- SHA1 42b6bb7f6028be3d5aff0b05fd58b510e092a394
- SHA512 74f8cad64ae8dbfaeb94be8ddca3bcfb1b7682485b49bf2c1a30f4a6764874c36359a75688bc4076495fa4657953ad9e0d385e89aa4d18d23e877c4fc26ddd7f
- TLSH T1DC519BF783F4856DCA10A2F4AA116E1BCEAD0914032C7CA6C8D8AE1F93F2971D10168F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 6273c0dac2b537d5ac24df742504bc991d5f1bd87e1f5eeb1a9afa9bf06f350e
- MD5 d6e414dec4608a8b239c44b2113de994
- SHA1 9a82e5321bb27d9b7781aa1543394eae2adc88c0
- SHA512 56ff3efcfb58f43467ae30e38b3097506cfbfb5f545473d9e74056b473e911ec53c099a9175998f79d749dc4d5eb8eada267ebb85fb4465123f1687dd33b2da7
- SSDEEP 192:/R6pxi9kv78pZPRp9YlM9DHsb+WNnCL2FC2jksOFakwVVyIsnAUgraJ:/R6pUA4DXn5wAB2gsO8je
- TLSH T1E442E82EB9106A3B5CDAD629FD56BB13D3F6102161A01E54EAFC8D2C15E7ACC332711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
- Size 12KB
- SHA256 80eeecdfb226c861fe9e15d02bb4e1c2af6c9b6f6c6b6aa93b6723456216ee62
- MD5 27e1af27539d3ecf0e2933f8a7c8cd8b
- SHA1 acc9a4ea59fdf0b4e550a7c3b01364bc7d667d0e
- SHA512 c4ee7acb802af4a5700ff002ee4e826149d015c217146b8dca489b660d7e7093023f88ee535ad5f3243f27a7467dfa71f14d48d5e9fa4ff7d9cfbf81b040fe42
- SSDEEP 192:/R6pxi9kv78pAPRp2YlM9DHsb+WNnCL2FC2LksOFakwGVyIsnAUgtaJ:/R6pUA4UXC5wAB2YsO8+8
- TLSH T1CC42D72EAA106A3B5CDBD629FD257753D3F6102161A11E90EAFC892C15E7ACC322711B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
- Size 13KB
- SHA256 3426e293396fa1424a09f9423424627a398157ab7bfc3ec06964ae1df493a1c5
- MD5 be6f9d6a2cbcb56c02708e735863c266
- SHA1 974f8ac2aeecd275c490a6e72bf1549cc608ea18
- SHA512 5d06f958f136237f1a30c847cff1a2af158baf7b8f8804d6c444ebc126d222c22c946442ed853f321e6823a9c6894841dac031de891b36a87a920630130e9eec
- SSDEEP 384:6QjOp7KxkXqKf/pUZNCgVLH2Hfgsl9RXODOB+ErU3ymHG/5Ut4vtEp:6UOp7KxkXqKf/pUZNCgVLH2HfgsL1OSK
- TLSH T1EE52E867648D9A3B0FC8D58DDC16BF4FADB6015766780C7452FA5C0803A97CB124A2FB
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Data
- Size 138KB
- SHA256 32a74cf9c8db921a58ebde23bb62ebe5ded689ad256053446b8b06f59c90db5a
- MD5 353c23686fc0d3f623833913c7237252
- SHA1 63529c50e1a9ee0d954c3cd6699962a53aa58b29
- SHA512 d795ebcd69fd459781e0db76c20e5562a085b690e6683f8cc8541e4e5d77b3735058b84c69873a0f76c6924bfbc39ef92376de8a06f9eef78fd624bb8384af15
- SSDEEP 384:jeuvBnhJsueMEGvIW1DcP2O3MUVumTny4a4:1nbZeMrv/hGt3Hny4X
- TLSH T10CD3974B3A743002EDE59A722CF051BB5E3CB16D4F51A5D428B620588EF2963B63D4BF
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 236KB
- SHA256 85499280111a6a1424df7fd5ab8b9aff790842368231eb9f64372e6a1f2480d2
- MD5 3508ff84d9a03982be7f84389ad00229
- SHA1 9b1b166a0ebc89e159f61dc076c6572a42ec6887
- SHA512 2751b24203ed2c038955bd34136644de41f96c9509401983cca5e4cb75bbf4c4f7383ab7456e5fddbf7f6f148aafd8186fa23ea462cf0efd9054f33734e14f80
- SSDEEP 6144:k1mX4NwhgqKR4ILo59R57lOYo8cm7Rkm1tYpBeh2BAoC0:cmoNweqYhLw/7lp9oBGcAoT
- TLSH T1FF342372DD326BB95CB9AF6F300C2A290EF1979DD668D946C8C47A08335E59C4B0993C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 115KB
- SHA256 734c90c3ba27de462dee232cd2f0c6185d1048942a77e51b0dda22caeb821ab5
- MD5 c78cbea906ed7c0bda38f6317f1d934a
- SHA1 e6de271220dc440d16ddfd9101fea949cbbcb128
- SHA512 8869a85bac3ce895bfe20a01058594492e69477d36b69c6dc8e96666b8e0a0a300f247997c85f757f961aefd27241de690d24f49f32b8d354e002f45a6934fd7
- SSDEEP 3072:5Gm7D5Lk17ox1tIpud63U8BehbCBi9fTrMO:4m7Rkm1tYpBeh2BAoO
- TLSH T174C3123B5D65E9375D79A71EB48E0B1E1EF249A6C930DE42C8D46A0433FA7CC1A04A34
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 116KB
- SHA256 bb6934790fac52d861c42269a45ff4d4272f02c00949f2039db8e7d3b2170705
- MD5 72d97fad32e27000a3be02af7b9976af
- SHA1 8f66c428a4e719509f1c187e3477ae82f9b5fd69
- SHA512 d48d32183f1a127dbdaca1ad74c4d97d598ab6c3850767477db5d5adc16bd73fb2623f238c6b4a375c5e4c16b6fbc8b1fd91bd8b85a376ad6f9f5403f6ccbfd7
- SSDEEP 3072:wsGm7D5Lk17ox1tIpud63U8BehbCBi9fTrMr:wfm7Rkm1tYpBeh2BAor
- TLSH T129C312376D75E93759B9BB1AB04E0A1F1DF14DA7C920DE92C8D86B0823F97CC1A44934
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
- Size 235KB
- SHA256 75193427eb03e5da37f198dc4cbc50451b9aaef0ca2777b798ca767ea6934524
- MD5 cf9414f797549653dd2dcf6856e8c645
- SHA1 ca0eae7e2f9c558f3d4f72c2e197c7f9f9a485fd
- SHA512 b6b9639929ada04cf8d96017623ec54b4157c10693c0d6f9bc672257fc5833027c1b022003dfe4b2327e1aed14375d56c5315528f23ba8032642e216025a40eb
- SSDEEP 6144:TWX4NwhgqKR4ILo59R57lOYo8cm7Rkm1tYpBeh2BAoC0:TWoNweqYhLw/7lp9oBGcAoT
- TLSH T1B7342372ED326BB95C79ABBF300D1E2D4FF29999D564E942C9C47A08335DA9C070893C
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-08-10_f9f847d1567867cb030e99c4a0866fc7_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v3irec22.wez.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 1aba61fd1a3c56f33c21e4a51108332397bbb2aef2267f8a0316915f6f60b0e0
- MD5 751d8be090f35e78a8e0f7bce4f1e223
- SHA1 88ec5b2fddbeb6ad3297b2480a09dc981be7cc4a
- SHA512 a5641e6814ae6ec09b2ae67138df73c4fc5ab0a1b5b296249f26cf8c5d6b10fed96d8c50ddcb234a60a14fa5ad032d30d9fc111daa9b6a5c93c0be3c530432c3
- TLSH T199E0CD4BB15CC9A50016512BC1B34D4DE5B454592E277E6097A1DD4D3661CC65DF1082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 552f25a7d428598578a12afc6eef14fb4b71a3fe5f7848314337c3c55ca435e3
- MD5 4cd71c66c43ad8fecf9f38e76d1ef32a
- SHA1 e391abbbccf8fab723d7bcd2f8d7e7b1160dabdc
- SHA512 830979c99ebbe0debaddb8bfa6dd342d80ad3f1f524f5fb5e104a60b01baf2a5be231b96ba23068798fd2320dbaf6c22f048ba7a148b27f846956136cc2ccf99
- TLSH T10FE07D4BB11CC9A40002113BC0B34D0CE1E054592E276E209760CD0D3751C865DF1082
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
- Size 208KB
- SHA256 15b75016e40e4a35bd66d7e132decc9c71abb153a86ef8983acf4edd51c535c6
- MD5 72920f80cd57e4ebe4cfd6464d348fda
- SHA1 d3c7f8b8af3294982fd9e06b4471f6a07ef1c048
- SHA512 815d705362ae266a917a73f5c359f518542fc6f1a754338b062e30430012bb4758a03c9383a80209f2f8d8a1925a4b8cfda744bf11b0ba5b2fc38c1e4e548e53
- SSDEEP 3072:hzF+kSS1X6ckHkgUz7qn6mfEawDids+8vh1f418a8tfKcRCZ8+leA23GUKzPivz0:H+kSS1X6cOk0kOdssMscRp+UX3GDy0
- TLSH T129243E54D2F38E6B14965AAF081637D4A438B7F196FC80FB71A3AE67F0638E2D21D114
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\Desktop\stolen_data_here.txt
- Size 209KB
- SHA256 a310e77ab20f1160f6276d79ec1529b76b96e0acc60a32fc971b63f780e8d220
- MD5 3887809ded05b2f4b8741b54e462e831
- SHA1 9588d6141977bda298aed5208ac555fe35f98b0d
- SHA512 acf07364f68e17f58208d2955c050fa3fcb0fddde42e69bee70ae139763e8c64ecbe0553c9b9b68b9db2898b5ccc24a463a00ea152d8d9f1fef224dd889acb83
- SSDEEP 3072:3zF+kSS1X6ckHkgUz7qn6mfEawDids+8vh1f418a8tfKcRCZ8+leA23GUKzPivz6:x+kSS1X6cOk0kOdssMscRp+UX3GDy6
- TLSH T17E243E54D2F38E6B14965AAF081637D4A438B7F196FC80FB71A3AE67F0638E2D60D114
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 ef53b73930fdab70312a599b5be63b43f803764a48d4b00b72513ab09f9fd545
- MD5 f9f847d1567867cb030e99c4a0866fc7
- SHA1 cc82cb2be4ab0a20a2cccb54f4949d32f3811371
- SHA512 8cb0fc73c29c5d2f5f9b40f35b69e5a48c856348fc6b65f7800250ac3fb5c23c75aa4baeb6abbf7e8e2393c83aedff64b48e39737a18eb0c6dd23d6183e1b661
- SSDEEP 768:FhR/ByYGy2obH6qhtC4l//w4hC1XXGblfA05KFc6:TRMYGyx6UplQ4hEXGblf95uc6
- TLSH T1F333080437F98511E1FF5BBA4DB282119B30B4A79C22E79E06D5058E1AB3B40DDA8F77
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 9e00229c7b616d536f9d0ea92954d99cccc1777a6478bf836fc8b6ff301c7d03
- MD5 ffbf3122b27f828d8fd3c577ccf970b0
- SHA1 d28033df68bd7a6c5cf8d7af9277af61c29b9e73
- SHA512 4eba49f44ca9bab724735fcb87e7b066d531fb7d3280b601ad4583ac18186aafc4f973d586fe63a2c8cb41878d5ec959349658b6aac70dab3b0c87ecaae6c370
- TLSH T12D312435064955EC26F3C1940439B43FD20BF0F60DEBE9CA7A8DC54A77B1A5D12E624D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 23383fbd5759a11751c072d17065026f026dbb6e364a8cf3402c6a78aa316577
- MD5 d7645147eacea72992c3efbc22e7a507
- SHA1 f83f062966494c08c716ef3b22228dccdd6a554a
- SHA512 2ca8d2edd67e5891dd6ce0cdb701c3a1978a7c526dbdbefe75b074b00c40bdbbc57a3da7c0cea3a861be544ddbedaf7e7d63f603030b90e9499728171c789aa9
- TLSH T1F1313335064955EC26F3C1940439B43FD21BF0F60DEBE9CA3A8DC54A77B1A5D12E224D
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\system32\drivers\etc\hosts
- Size 1KB
- SHA256 05cbb805453fb4d33b6ebe61ba64f15bd852227542c765c1b49f7b76a000cf29
- MD5 20c351356d10acf150d790bfa940d4ca
- SHA1 cb3f2a2b2e9e4a96bf64b1439cfcfe9e8e77e426
- SHA512 d1432210bd44c3ade5ea85be5c6df72a420bd7a1e610c574cdfd39b9d2b7e6d6205cf4daac5f0b8479e2d7784ba1d74ab3e752ea0eb2eb853460225b452a5fe6
- TLSH T10B218835064991AC26F381A50429F42FE31FE0FB0DABD9C93A8DC54E3BA1A1C53A2649
- MD5 SHA1 SHA512 TLSH