c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992

Analysis

max time kernel
148s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe
Size 118KB
Sample260710-2d36bacy6q
SHA256 c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992
MD5 163d538457dd0098982758971ad82c77
SHA1 a583719408f8fc1d1e2dedcdd65f8c97a5847eeb
SHA512 d8ada8e1edb2adfa5e88d2411488a7406169fc397270c8089225203aecb838d044eb53dce468ed3ee9eb4e158606d18e7558ab95f08badd62ab3b94cde29c11b
SSDEEP 768:0rRWFl9JOHFHBBe90ZzttgqGTsvqVyIl0F6kNUpUMlVsGw0J:2RklGwOtgqGLOYJn
TLSH
T115C3D52BFF6258ECC671DE38B8E5A26B6A237DD44860AB7C774C4A101F237684D3C585
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

persistence ransomware

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SFPractice_80ad55a5 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe"	c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SFPractice_80ad55a5 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe"	c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Opens file in notepad (likely ransom note) 2 IoCs

ransomware

pid	Process
4284	notepad.exe
3412	notepad.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 2264	3912	c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe	88
PID 2700 wrote to memory of 5340	2700	c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe	91
PID 2700 wrote to memory of 3412	2700	c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe	92
PID 3912 wrote to memory of 4284	3912	c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe	93

C:\Users\Admin\AppData\Local\Temp\c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe
"C:\Users\Admin\AppData\Local\Temp\c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Windows\SYSTEM32\notepad.exe
  notepad.exe
  2⤵
  PID:2264
- C:\Windows\System32\notepad.exe
  "C:\Windows\System32\notepad.exe" C:\Users\Admin\AppData\Local\Temp\sf_note_80ad55.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4284

C:\Users\Admin\AppData\Local\Temp\c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe
C:\Users\Admin\AppData\Local\Temp\c83d96eab968cd9958cdcb4bedb155e7b8dff0d7e8acfa3ef64c061a2dbfc992.exe
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\notepad.exe
  notepad.exe
  2⤵
  PID:5340
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" C:\Users\Admin\AppData\Local\Temp\sf_note_80ad55.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

sf_note_80ad55.txt

Path C:\Users\Admin\AppData\Local\Temp\sf_note_80ad55.txt
Size 209B
SHA256 e0d539fa7b75c5561a8e05e22c3104bd8f337b202586992213b8bf8df4a5bfb1
MD5 7ef1a0efea040242dfb942acf3d8ef0f
SHA1 f2ee7aff970108cd3bb8b83380947dfb01dd481a
SHA512 247daa7a95ae14ad58a6b7dd718d24b33758b4afba8cf20218fcd3544f3d90dc2303c39a18569e11a046df6c752d7ec029b10bbf605a7768f239c978446515f6
TLSH
T18ED02302D5E6789E457E0DD574E10351D508CB044BC4603CB466C60D7309178C02F73C
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2700-5-0x00000000006D0000-0x00000000006EE000-memory.dmp

Download

memory/3912-0-0x00000256AF6C0000-0x00000256AF6C2000-memory.dmp

Download

memory/3912-7-0x00000000006D0000-0x00000000006EE000-memory.dmp

Download

memory/3912-9-0x00000000006D0000-0x00000000006EE000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads