Overview

overview

8

Static

static

8

WindowsDri....0.exe

windows10-2004-x64

7

WindowsDri....0.exe

windows11-21h2-x64

7

Analysis

  • max time kernel
    149s
  • max time network
    127s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/04/2026, 12:36

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    WindowsDriver4PAU0F-v1.0.exe
  • Size 9.7MB
  • Sample260428-ps182sdv4m
  • SHA256 e8c27d2cf6587f7d79ad2b88e9bd963812993794ce7329834b4341f4001c44ea
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryransomware

Malware Config

Signatures

  • Executes dropped EXE 14 IoCs
  • Loads dropped DLL 10 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Indicator Removal: File Deletion 1 TTPs

    Adversaries may delete files left behind by the actions of their intrusion activity.

    defense_evasion
  • Drops file in System32 directory 35 IoCs
  • Drops file in Program Files directory 31 IoCs
  • Drops file in Windows directory 17 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 31 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 53 IoCs
  • Modifies registry class 26 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\WindowsDriver4PAU0F-v1.0.exe
    "C:\Users\Admin\AppData\Local\Temp\WindowsDriver4PAU0F-v1.0.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}\WindowsDriver4PAU0F-v1.0.exe
      C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}\WindowsDriver4PAU0F-v1.0.exe /q"C:\Users\Admin\AppData\Local\Temp\WindowsDriver4PAU0F-v1.0.exe" /tempdisk1folder"C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}" /IS_temp
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Enumerates connected drives
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:4592
      • C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{ECD19082-24CA-427E-B48B-D7A3D57D7869}
        3⤵
        • Executes dropped EXE
        PID:3256
      • C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4E86DDBE-4A2E-459B-84FE-610715100C5F}
        3⤵
        • Executes dropped EXE
        PID:4180
      • C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{8500FC03-531E-4A4F-B33C-88D51A10BD81}
        3⤵
        • Executes dropped EXE
        PID:3416
      • C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{971165C3-2851-42D4-B142-3211C917AE3A}
        3⤵
        • Executes dropped EXE
        PID:1628
      • C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{CD66686B-5233-4A6F-96E1-75906226CEAE}
        3⤵
        • Executes dropped EXE
        PID:1792
      • C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A9601C8D-68DD-4052-9A31-E6CD5D57B784}
        3⤵
        • Executes dropped EXE
        PID:3096
      • C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{3A5A41AE-B174-4E5C-9B10-911C490BFCB7}
        3⤵
        • Executes dropped EXE
        PID:1572
      • C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{517D809F-18A1-4466-8BD6-10946A07E84B}
        3⤵
        • Executes dropped EXE
        PID:3892
      • C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{6799DB71-3CBE-45A1-8975-4E45B8B0A364}
        3⤵
        • Executes dropped EXE
        PID:2472
      • C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
        C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{459A7F2C-08E8-49EA-A4B6-75279F6F2D79}
        3⤵
        • Executes dropped EXE
        PID:3932
      • C:\Program Files (x86)\PandaWireless\X64\InstallDriverApp.exe
        "C:\Program Files (x86)\PandaWireless\X64\InstallDriverApp.exe" install mtkwl6eux.inf W
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:2804
        • C:\Program Files (x86)\PandaWireless\X64\DEVCON.exe
          "DEVCON.exe" rescan
          4⤵
          • Executes dropped EXE
          PID:4156
        • C:\Program Files (x86)\PandaWireless\X64\DEVCON.exe
          "DEVCON.exe" rescan
          4⤵
          • Executes dropped EXE
          PID:816
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c rmdir /s /q "C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4880
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1588
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5F57C2D1737FDCE7240BEBF57795A659 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:3696
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 6ADB2776F3374BC4B3B1010DA9850BA6
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      PID:220
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    PID:2484
  • C:\Windows\system32\srtasks.exe
    C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
    1⤵
      PID:3456
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of WriteProcessMemory
      PID:3256
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{4e0f6103-4a2b-7b40-99ef-7a2b04c8fc44}\mtkwl6eux.inf" "9" "492a1b003" "0000000000000148" "WinSta0\Default" "000000000000015C" "208" "C:\Program Files (x86)\PandaWireless\X64"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:4448

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e58be2c.rbs
          • Path C:\Config.Msi\e58be2c.rbs
          • Size 10KB
          • SHA256 fd78929f9d52b35dea658e44df2076503985ed9231864d52e12b432c7ab1464e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MTKWL6~1.CAT
          • Path C:\PROGRA~2\PANDAW~1\X64\MTKWL6~1.CAT
          • Size 13KB
          • SHA256 506051d9087b9e0a8b479f86ff89363f5902b93b3e33e855019748100c98e61e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MTKWL6~1.SYS
          • Path C:\PROGRA~2\PANDAW~1\X64\MTKWL6~1.SYS
          • Size 1.3MB
          • SHA256 a261b4d4c7307cb12907673a440498088cd6f3b42fc2bd273e4a13766fcbdbb8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WIFI_M~1.BIN
          • Path C:\PROGRA~2\PANDAW~1\X64\WIFI_M~1.BIN
          • Size 90KB
          • SHA256 85bc315c371ddc5310bf6d6a30d692fe7ae9b0c1c01e77e3792fa39ba89b15b3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WIFI_R~1.BIN
          • Path C:\PROGRA~2\PANDAW~1\X64\WIFI_R~1.BIN
          • Size 644KB
          • SHA256 2418aa26a576f037336559d208af133672bc1cb345b7b9819018e04c0c26fd78
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mtkihvux.dll
          • Path C:\PROGRA~2\PANDAW~1\X64\mtkihvux.dll
          • Size 535KB
          • SHA256 7aa010bee5030f2897a2793d5d2654860274d387459a29573b0b47aebac8ccea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mtkwl1u.dat
          • Path C:\PROGRA~2\PANDAW~1\X64\mtkwl1u.dat
          • Size 1.2MB
          • SHA256 5e7e41b74cd1c17d74b1be0a8a6c3002f402d5d7c4a9430a35b34fdbaba27a90
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.exe
          • Path C:\Program Files (x86)\InstallShield Installation Information\{6EB3F0F0-370C-4525-BFE7-96726DC87230}\setup.exe
          • Size 1.1MB
          • SHA256 3b2af69f604600ac11b33feca876ec4198661949298f1c2760112b2ab51b9592
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          setup.ini
          • Path C:\Program Files (x86)\InstallShield Installation Information\{6EB3F0F0-370C-4525-BFE7-96726DC87230}\setup.ini
          • Size 5KB
          • SHA256 876ad6334a3576c843c70894183ea23302eb4edf136af8d6f2f2e7794af5ca43
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          InstallDriverApp.exe
          • Path C:\Program Files (x86)\PandaWireless\X64\InstallDriverApp.exe
          • Size 18KB
          • SHA256 85ed3fcb78901d59627c5b45669d991e9718e80c50066491671c20bad359e28c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          devcon.exe
          • Path C:\Program Files (x86)\PandaWireless\X64\devcon.exe
          • Size 80KB
          • SHA256 75f087b047bf870c25ff26ae059e888355f11b3cee72818cedc02586316b73ba
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mtkwl6eux.inf
          • Path C:\Program Files (x86)\PandaWireless\X64\mtkwl6eux.inf
          • Size 127KB
          • SHA256 d7283169ca97391d344b976f1ddb8baf362f5bc3600b9fa60d2782e250f68eb8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSI66C6.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\MSI66C6.tmp
          • Size 171KB
          • SHA256 b8fa7aa425e4084ea3721780a13d11e08b8d53d1c5414b73f22faeca1bfd314f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          mtkwl1_2u.dat
          • Path C:\Users\Admin\AppData\Local\Temp\{4e0f6103-4a2b-7b40-99ef-7a2b04c8fc44}\mtkwl1_2u.dat
          • Size 877KB
          • SHA256 998c98bc1d8a08baf550dc1acaeedb123895ff830b0f1bcf1f7c2fa6cb29591f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          0x0409.ini
          • Path C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}\0x0409.ini
          • Size 21KB
          • SHA256 8b76df0ffc9a226b532b60936765b852b89780c6e475c152f7c320e085e43948
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ISSetup.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}\ISSetup.dll
          • Size 3.0MB
          • SHA256 156f7d26947c013666469075b97e99a83580c0ef1cfb87f3c78d183f8c158e5d
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Panda Wireless Driver.msi
          • Path C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}\Panda Wireless Driver.msi
          • Size 7.0MB
          • SHA256 96678d80fa926f943a8394a920e410b0e2536c8973cc9ae5179ccb317c514814
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          WindowsDriver4PAU0F-v1.0.exe
          • Path C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}\WindowsDriver4PAU0F-v1.0.exe
          • Size 9.7MB
          • SHA256 e8c27d2cf6587f7d79ad2b88e9bd963812993794ce7329834b4341f4001c44ea
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ISMSIDEL.INI
          • Path C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}\_ISMSIDEL.INI
          • Size 668B
          • SHA256 d17675d0956530dfd617b7235a11729ad018a6cb84a6257b287901309d783799
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          _ISMSIDEL.INI
          • Path C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}\_ISMSIDEL.INI
          • Size 2B
          • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
          • MD5 SHA1 SHA512
          Submit Download

          _ISMSIDEL.INI
          • Path C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}\_ISMSIDEL.INI
          • Size 20B
          • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
          • MD5 SHA1 SHA512
          Submit Download

          setup.isn
          • Path C:\Users\Admin\AppData\Local\Temp\{52092936-45F0-4AC6-8A80-C36B85BA93A7}\setup.isn
          • Size 253KB
          • SHA256 ab1ddb8870b410a6db38f02a8d7763dd3a1fa393b7d617cc11392b25bafd6175
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ISBEW64.exe
          • Path C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISBEW64.exe
          • Size 178KB
          • SHA256 561f14cdece85b38617403e1c525ff0b1b752303797894607a4615d0bd66f97f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ISRT.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\ISRT.dll
          • Size 426KB
          • SHA256 58a724d23c63387a2dda27ccfdbc8ca87fd4db671bea8bb636247667f6a5a11e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _isres_0x0409.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\_isres_0x0409.dll
          • Size 1.4MB
          • SHA256 eb7a1d2ae7c7991e634154694567d52864e3d00c35f29714de5f8493101a12e2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _isuser_0x0409.dll
          • Path C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\_isuser_0x0409.dll
          • Size 40KB
          • SHA256 20d6e818e053919177e9b44b1ce468cc8afd7d6065a2e00da0738e23719cc580
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          english.rtf
          • Path C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\english.rtf
          • Size 46KB
          • SHA256 7dc50ae97845f661b4f13b728bb45f8b90634e7ba89488807ee25a11979ff13f
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          logo.png
          • Path C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\logo.png
          • Size 22KB
          • SHA256 c719005d48febcd807dde42e3cd6f724d14db3b10d17f74d54bc5d4083316965
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          skin6954.rra
          • Path C:\Users\Admin\AppData\Local\Temp\{BFD66718-582E-4C26-969D-C9284D0F8B4B}\skin6954.rra
          • Size 25KB
          • SHA256 e9ccebc18123b09ad7ec2ee208cb795a5dfbdbba9e60b31ccdd409636c5cf1c0
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          ~5EF6.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\~5EF6.tmp
          • Size 5KB
          • SHA256 170c45b1eafa50d099e9da51e3f27961162a51ea11707438615810ba01b4120e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          memory/2804-5289-0x0000000000670000-0x000000000067A000-memory.dmp
          Download

          memory/4592-106-0x0000000010000000-0x0000000010114000-memory.dmp
          Download

          memory/4592-5194-0x0000000010000000-0x0000000010114000-memory.dmp
          Download