Overview

overview

10

Static

static

3

2026-10-20...ry.exe

windows10-2004-x64

10

2026-10-20...ry.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    144s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/10/2026, 03:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-20_e2f6f66c7bb84ed744b5136389f82fef_elex_glassworm_hijackloader_wannacry.exe
  • Size 11.0MB
  • Sample261020-dvnvyscv8w
  • SHA256 14180c5dccd33ccaf9b409ac6c5f07d0d0fbcbd9f331fd6e271f585938bdf280
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverymofksyspersistenceprivilege_escalationspywarestealerworm

Malware Config

Signatures

  • Family: Mofksys

    Mofksys is a worm written in VisualBasic.

    wormmofksys
  • Detects Mofksys worm 5 IoCs
  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
    persistence
  • Modifies visibility of hidden/system files in Explorer 2 TTPs 2 IoCs
    defense_evasion
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Detects executables containing SQL queries to confidential data stores. Observed in infostealers 1 IoCs
  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 9 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Drops file in Drivers directory 6 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 39 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 7 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 52 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies Internet Explorer settings 1 TTPs 63 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: LoadsDriver 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-20_e2f6f66c7bb84ed744b5136389f82fef_elex_glassworm_hijackloader_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-20_e2f6f66c7bb84ed744b5136389f82fef_elex_glassworm_hijackloader_wannacry.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4756
    • \??\c:\users\admin\appdata\local\temp\2026-10-20_e2f6f66c7bb84ed744b5136389f82fef_elex_glassworm_hijackloader_wannacry.exe 
      c:\users\admin\appdata\local\temp\2026-10-20_e2f6f66c7bb84ed744b5136389f82fef_elex_glassworm_hijackloader_wannacry.exe 
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:5068
      • C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
        "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp" -d "C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Installs/modifies Browser Helper Object
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5872
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1932
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:3576
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3612
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:3916
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1064
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • Modifies registry class
            PID:5808
        • C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
          "C:\Program Files (x86)\Internet Download Manager\idmBroker.exe" -RegServer
          4⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          PID:4504
        • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
          "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" /rtr
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5804
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:2236
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:4020
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:4708
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:808
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:960
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:5300
          • C:\Windows\SysWOW64\regsvr32.exe
            "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
            5⤵
            • Loads dropped DLL
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5816
            • C:\Windows\system32\regsvr32.exe
              /s "C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll"
              6⤵
              • Loads dropped DLL
              • Modifies registry class
              PID:1344
          • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
            "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious use of WriteProcessMemory
            PID:5224
            • C:\Windows\system32\RUNDLL32.EXE
              "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
              6⤵
              • Drops file in Drivers directory
              • Adds Run key to start application
              • Suspicious use of WriteProcessMemory
              PID:4008
              • C:\Windows\system32\runonce.exe
                "C:\Windows\system32\runonce.exe" -r
                7⤵
                • Checks processor information in registry
                • Suspicious use of WriteProcessMemory
                PID:5316
                • C:\Windows\System32\grpconv.exe
                  "C:\Windows\System32\grpconv.exe" -o
                  8⤵
                    PID:2248
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4580
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1340
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5592
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:4924
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2252
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:3040
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5372
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1092
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4312
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:1604
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                6⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:2028
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  7⤵
                  • System Location Discovery: System Language Discovery
                  PID:2512
              • C:\Windows\SysWOW64\regsvr32.exe
                "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                6⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1204
                • C:\Windows\system32\regsvr32.exe
                  /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                  7⤵
                  • Loads dropped DLL
                  PID:4100
            • C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
              "C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe"
              5⤵
              • Executes dropped EXE
              • System Location Discovery: System Language Discovery
              PID:4344
      • C:\Users\Admin\AppData\Local\icsys.icn.exe
        C:\Users\Admin\AppData\Local\icsys.icn.exe
        2⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4400
        • \??\c:\windows\system\explorer.exe
          c:\windows\system\explorer.exe
          3⤵
          • Modifies WinLogon for persistence
          • Modifies visibility of hidden/system files in Explorer
          • Boot or Logon Autostart Execution: Active Setup
          • Executes dropped EXE
          • Adds Run key to start application
          • Drops file in Windows directory
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: GetForegroundWindowSpam
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:5008
          • \??\c:\windows\system\spoolsv.exe
            c:\windows\system\spoolsv.exe SE
            4⤵
            • Executes dropped EXE
            • Drops file in Windows directory
            • System Location Discovery: System Language Discovery
            • Suspicious use of SetWindowsHookEx
            • Suspicious use of WriteProcessMemory
            PID:2188
            • \??\c:\windows\system\svchost.exe
              c:\windows\system\svchost.exe
              5⤵
              • Modifies WinLogon for persistence
              • Modifies visibility of hidden/system files in Explorer
              • Boot or Logon Autostart Execution: Active Setup
              • Executes dropped EXE
              • Adds Run key to start application
              • Drops file in Windows directory
              • System Location Discovery: System Language Discovery
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:984
              • \??\c:\windows\system\spoolsv.exe
                c:\windows\system\spoolsv.exe PR
                6⤵
                • Executes dropped EXE
                • System Location Discovery: System Language Discovery
                • Suspicious use of SetWindowsHookEx
                PID:1928
              • C:\Windows\SysWOW64\at.exe
                at 04:22 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:472
              • C:\Windows\SysWOW64\at.exe
                at 04:23 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:6104
              • C:\Windows\SysWOW64\at.exe
                at 04:24 /interactive /every:M,T,W,Th,F,S,Su c:\windows\system\svchost.exe
                6⤵
                • System Location Discovery: System Language Discovery
                PID:3548
    • C:\Windows\system32\grpconv.exe
      grpconv -o
      1⤵
        PID:5044
      • C:\Program Files (x86)\Internet Download Manager\IDMan.exe
        "C:\Program Files (x86)\Internet Download Manager\IDMan.exe" -Embedding
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Modifies registry class
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:4772
        • C:\Windows\SysWOW64\regsvr32.exe
          "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
          2⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:6116
          • C:\Windows\system32\regsvr32.exe
            /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
            3⤵
            • Loads dropped DLL
            • Suspicious use of AdjustPrivilegeToken
            PID:3332
        • C:\Program Files (x86)\Internet Download Manager\Uninstall.exe
          "C:\Program Files (x86)\Internet Download Manager\Uninstall.exe" -instdriv
          2⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4828
          • C:\Windows\system32\RUNDLL32.EXE
            "C:\Windows\Sysnative\RUNDLL32.EXE" SETUPAPI.DLL,InstallHinfSection DefaultInstall 128 C:\Program Files (x86)\Internet Download Manager\idmwfp.inf
            3⤵
            • Drops file in Drivers directory
            • Adds Run key to start application
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1508
            • C:\Windows\system32\runonce.exe
              "C:\Windows\system32\runonce.exe" -r
              4⤵
              • Checks processor information in registry
              • Suspicious use of WriteProcessMemory
              PID:5856
              • C:\Windows\System32\grpconv.exe
                "C:\Windows\System32\grpconv.exe" -o
                5⤵
                  PID:696
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\System32\net.exe" start IDMWFP
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:2564
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start IDMWFP
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4476
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\System32\net.exe" start IDMWFP
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:996
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 start IDMWFP
                4⤵
                • System Location Discovery: System Language Discovery
                PID:4320
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\System32\net.exe" start IDMWFP
              3⤵
              • System Location Discovery: System Language Discovery
              • Suspicious use of WriteProcessMemory
              PID:4816
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                4⤵
                  PID:2248
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:3092
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:4764
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:4632
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:5748
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:2644
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" start IDMWFP
                3⤵
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:3596
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 start IDMWFP
                  4⤵
                  • System Location Discovery: System Language Discovery
                  PID:5812
              • C:\Windows\SysWOW64\regsvr32.exe
                "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                3⤵
                • Loads dropped DLL
                • System Location Discovery: System Language Discovery
                • Suspicious use of WriteProcessMemory
                PID:1784
                • C:\Windows\system32\regsvr32.exe
                  /s "C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll"
                  4⤵
                  • Loads dropped DLL
                  • Suspicious use of AdjustPrivilegeToken
                  PID:5032
            • C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
              "C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe"
              2⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • System Location Discovery: System Language Discovery
              • Suspicious use of SetWindowsHookEx
              PID:5956
          • C:\Windows\system32\svchost.exe
            C:\Windows\system32\svchost.exe -k GPSvcGroup
            1⤵
              PID:4896

            Network

                  MITRE ATT&CK Enterprise v16

                  Reconnaissance

                  Resource Development

                  Initial Access

                  Execution

                  Persistence

                  Boot or Logon Autostart Execution

                  3
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Browser Extensions

                  1
                  T1176

                  Event Triggered Execution

                  1
                  T1546

                  Component Object Model Hijacking

                  1
                  T1546.015

                  Privilege Escalation

                  Boot or Logon Autostart Execution

                  3
                  T1547

                  Active Setup

                  1
                  T1547.014

                  Registry Run Keys / Startup Folder

                  1
                  T1547.001

                  Winlogon Helper DLL

                  1
                  T1547.004

                  Event Triggered Execution

                  1
                  T1546

                  Component Object Model Hijacking

                  1
                  T1546.015

                  Defense Evasion

                  Hide Artifacts

                  1
                  T1564

                  Hidden Files and Directories

                  1
                  T1564.001

                  Modify Registry

                  6
                  T1112

                  Credential Access

                  Credentials from Password Stores

                  1
                  T1555

                  Credentials from Web Browsers

                  1
                  T1555.003

                  Unsecured Credentials

                  1
                  T1552

                  Credentials In Files

                  1
                  T1552.001

                  Discovery

                  Query Registry

                  2
                  T1012

                  System Information Discovery

                  2
                  T1082

                  System Location Discovery

                  1
                  T1614

                  System Language Discovery

                  1
                  T1614.001

                  System Network Configuration Discovery

                  1
                  T1016

                  Lateral Movement

                  Collection

                  Data from Local System

                  1
                  T1005

                  Command and Control

                  Exfiltration

                  Impact

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  IDMGetAll.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll.dll
                  • Size 73KB
                  • SHA256 33a8a6b9413d60a38237bafc4c331dfebf0bf64f8057abc335b4a6a6b95c9381
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IDMGetAll64.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\IDMGetAll64.dll
                  • Size 93KB
                  • SHA256 117abaeb27451944c72ffee804e674046c58d769bd2e940c71e66edec0725bd1
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IDMIECC.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC.dll
                  • Size 463KB
                  • SHA256 9a9989644213043f2cfff177b907ef2bdd496c2f65803d8f158eae9034918878
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IDMIECC64.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\IDMIECC64.dll
                  • Size 656KB
                  • SHA256 d0c6d455d067e8717efe2cfb9bdcbeae27b48830fe77e9d45c351fbfb164716d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IDMNetMon64.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\IDMNetMon64.dll
                  • Size 440KB
                  • SHA256 1011616fd21493f23dafd882cb1289f54c5155179ba6139559583303775b6f2a
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IDMShellExt64.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\IDMShellExt64.dll
                  • Size 36KB
                  • SHA256 48e5c5916f100880e68c9e667c4457eb0065c5c7ab40fb6d85028fd23d3e4838
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IDMan.exe
                  • Path C:\Program Files (x86)\Internet Download Manager\IDMan.exe
                  • Size 5.6MB
                  • SHA256 7dd8e51b9b67e6f2a40e5ea5d46d465ba56af54490b7a6d302e77751b9bfa8b7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IEMonitor.exe
                  • Path C:\Program Files (x86)\Internet Download Manager\IEMonitor.exe
                  • Size 375KB
                  • SHA256 c8fd8860e9a05cc61684ca7a4fea22eda721e701ee717dc039f52312d8d21be6
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  MediumILStart.exe
                  • Path C:\Program Files (x86)\Internet Download Manager\MediumILStart.exe
                  • Size 56KB
                  • SHA256 4e291c4e124b1962ae5f2de5f6bf7892f8a1eaa33a27fd167f547038b4508b2e
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  downlWithIDM.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM.dll
                  • Size 197KB
                  • SHA256 38ac192d707f3ec697dd5fe01a0c6fc424184793df729f427c0cf5dfab6705fe
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  downlWithIDM64.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\downlWithIDM64.dll
                  • Size 155KB
                  • SHA256 8a51ece1c4c8bcb8c56ca10cb9d97bff0dfe75052412a8d8d970a5eb6933427b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  idmBroker.exe
                  • Path C:\Program Files (x86)\Internet Download Manager\idmBroker.exe
                  • Size 153KB
                  • SHA256 97810e0b3838a7dca94d73a8b9e170107642b064713c084c231de6632cb68a9c
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  idmfsa.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\idmfsa.dll
                  • Size 94KB
                  • SHA256 6f0ed0a7a21e73811675e8a13d35c7daa6309214477296a07fe52a3d477578ad
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  idmftype.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\idmftype.dll
                  • Size 42KB
                  • SHA256 3a47dbb1f86f2c51f3f8fb9c3a8b1309f5e182ab9af55179959104d262ce985d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  idmindex.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\idmindex.dll
                  • Size 427KB
                  • SHA256 1fdb0d5b31e080084c82e0b773dafc7860fa860938b8baef6a4d7f5bde659f73
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  idmmkb.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\idmmkb.dll
                  • Size 33KB
                  • SHA256 8a10c135de47b2f143f97a5c472c2e4cc0256b278304803aeca5f419b0a00494
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  idmvs.dll
                  • Path C:\Program Files (x86)\Internet Download Manager\idmvs.dll
                  • Size 37KB
                  • SHA256 1c55021653c37390b3f4f519f7680101d7aaf0892aef5457fe656757632b2e10
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  ExplorerStartupLog_RunOnce.etl
                  • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl
                  • Size 8KB
                  • SHA256 1ccafff12068270bb35fe3017f3afcf38c5fe3708f81ce88e7afd0cd71554c14
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  2026-10-20_e2f6f66c7bb84ed744b5136389f82fef_elex_glassworm_hijackloader_wannacry.exe 
                  • Path C:\Users\Admin\AppData\Local\Temp\2026-10-20_e2f6f66c7bb84ed744b5136389f82fef_elex_glassworm_hijackloader_wannacry.exe 
                  • Size 10.8MB
                  • SHA256 e3f599ddfddd248d8c94dd88297b69166860c722b9a2b1e6fdc40c34ff367ab0
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IDM1.tmp
                  • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDM1.tmp
                  • Size 167KB
                  • SHA256 fc805d03f73c28aaee359811e046ff9fd39febbc80fc6bf01843d5fca9104a74
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IDMSetup2.log
                  • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                  • Size 4KB
                  • SHA256 2a15c9016d94450381ce04646eb7407bdcff3f0435ad3d079d1c7308b6ced65b
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  IDMSetup2.log
                  • Path C:\Users\Admin\AppData\Local\Temp\IDM_Setup_Temp\IDMSetup2.log
                  • Size 2KB
                  • SHA256 5c31fafc67030a7030516740d70435b426f37cd7ca0dd138fd53ea3969de2da0
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  icsys.icn.exe
                  • Path C:\Users\Admin\AppData\Local\icsys.icn.exe
                  • Size 207KB
                  • SHA256 5949501e405debb07e929ac46faf3f5617927ad1a1ae093c3beb07be13224490
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  log_1.log
                  • Path C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\www_internetdownload_1\log_1.log
                  • Size 359B
                  • SHA256 fed1a15a3c73a84634300165ed7cdd89300382a5dfaf1c276d2e8dd7d1d0a7a3
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  www_internetdownload
                  • Path C:\Users\Admin\AppData\Roaming\IDM\DwnlData\Admin\www_internetdownload_1\www_internetdownload
                  • Size 9KB
                  • SHA256 005aa00e86b7553a314615598065a51f524d8d97425e3d85cb40f3fb7b3c2808
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  s_1.dt
                  • Path C:\Users\Admin\AppData\Roaming\IDM\Scheduler\s_1.dt
                  • Size 316B
                  • SHA256 6d059e9c4670699aaa1b1594917d1be5fe752517d7c7e505f227e8dd181dcebb
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  defextmap.dat
                  • Path C:\Users\Admin\AppData\Roaming\IDM\defextmap.dat
                  • Size 3KB
                  • SHA256 d86ffe5e9b0025d0305f70137e0930c1c4da76df6dc0f07585df48fc6f83798e
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  urlexclist.dat
                  • Path C:\Users\Admin\AppData\Roaming\IDM\urlexclist.dat
                  • Size 3KB
                  • SHA256 6a7901a0117f5ad4f876545cd632f7f7ac3cd0f1df393bb59d23b1b72521fa92
                  • MD5 SHA1 SHA512 TLSH
                  Submit Download

                  mrsys.exe
                  • Path C:\Users\Admin\AppData\Roaming\mrsys.exe
                  • Size 207KB
                  • SHA256 77104b06b4f519452e3a0c07d9b72f2cfa415785d566014687965833008bafd7
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  explorer.exe
                  • Path C:\Windows\System\explorer.exe
                  • Size 206KB
                  • SHA256 5eec50869be7029b416781c19b138bafe5be509384b3286d69a9be37ff599967
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  svchost.exe
                  • Path C:\Windows\System\svchost.exe
                  • Size 206KB
                  • SHA256 e2c4f0b9a2f0e78c1ae0d94a02277f3c4179db50234d42ca35e14fd82e179904
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  spoolsv.exe
                  • Path \??\c:\windows\system\spoolsv.exe
                  • Size 206KB
                  • SHA256 97a2f6f97a325636887573796cf5b9a02479eaacdd19c88177d02f2c99fa70b9
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/4828-551-0x0000000000400000-0x0000000000429000-memory.dmp
                  Download

                  memory/5068-26-0x0000000000400000-0x000000000040C000-memory.dmp
                  Download

                  memory/5068-8-0x0000000000400000-0x000000000040C000-memory.dmp
                  Download

                  memory/5224-530-0x0000000000400000-0x0000000000429000-memory.dmp
                  Download

                  memory/5872-483-0x0000000000400000-0x0000000000429000-memory.dmp
                  Download

                  memory/5872-25-0x0000000000400000-0x0000000000429000-memory.dmp
                  Download