ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5

Analysis

max time kernel
147s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Size 410KB
Sample260802-vtd3ssdk3w
SHA256 ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5
MD5 79e9b642aba9895a60da1fc11ed3b36a
SHA1 7fa03f2af30b67b5db07fb045e11f1362d97dd63
SHA512 f092dffc4b154f6399ac1ebec88ba6574b7e59214dcee7116e95aed35c9af9731fd339aa0b24a4680b350ded890cab5a9302cc51ed91c24fc9b867fcf6d1e9b7
SSDEEP 6144:/SSFpNp8GtpWWyi73p8a/33+MvnGkhbQr+wvr/6En+tNAnFU0iyOOjwp6:/SE38Gtpd7Z8c3+Mvn7hcrsfNkfO2
TLSH
T177945C03E7D206FCF4BBD630DABA92325933BC505934E91E25588A252F71E109E3DF66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

ransomware

Malware Config

Signatures

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_receiptprinter.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\ts_generic.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_monitor.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_scmdisk.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fsreplication.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fsundelete.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_mcx.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_swcomponent.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_camera.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_smrdisk.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\eyegazeioctl.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\oposdrv.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fshsm.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_i3c.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\wsdprint.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_ucm.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\xusb22.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_apo.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_display.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_volume.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_diskdrive.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_firmware.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_proximity.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_extension.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_netdriver.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_ramdisk.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\rawsilo.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_processor.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fscompression.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fsencryption.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_primitive.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_fssystem.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_linedisplay.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_nvmedisk.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_scmvolume.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\miradisp.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\rdcameradriver.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_generic.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_smrvolume.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\dc1-controller.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_media.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\c_sslaccel.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
File created	C:\Windows\INF\remoteposdrv.PNF	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
2612	notepad.exe
4312	notepad.exe
252	notepad.exe
4116	notepad.exe
4292	notepad.exe
4648	notepad.exe
4316	notepad.exe
4448	notepad.exe
2840	notepad.exe
2688	notepad.exe
4688	notepad.exe
3016	notepad.exe
1464	notepad.exe
3116	notepad.exe
1328	notepad.exe
1380	notepad.exe
1780	notepad.exe
5248	notepad.exe
3044	notepad.exe
2968	notepad.exe
5524	notepad.exe
2000	notepad.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4448	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	89
PID 4136 wrote to memory of 1780	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	90
PID 4136 wrote to memory of 5248	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	91
PID 4136 wrote to memory of 2612	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	92
PID 4136 wrote to memory of 1380	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	94
PID 4136 wrote to memory of 2840	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	95
PID 4136 wrote to memory of 4312	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	96
PID 4136 wrote to memory of 2688	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	97
PID 4136 wrote to memory of 252	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	98
PID 4136 wrote to memory of 3044	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	99
PID 4136 wrote to memory of 4688	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	100
PID 4136 wrote to memory of 3016	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	101
PID 4136 wrote to memory of 2968	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	102
PID 4136 wrote to memory of 1464	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	103
PID 4136 wrote to memory of 4116	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	104
PID 4136 wrote to memory of 4292	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	105
PID 4136 wrote to memory of 4648	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	106
PID 4136 wrote to memory of 3116	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	107
PID 4136 wrote to memory of 5524	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	108
PID 4136 wrote to memory of 1328	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	109
PID 4136 wrote to memory of 4316	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	110
PID 4136 wrote to memory of 2000	4136	ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe	111

C:\Users\Admin\AppData\Local\Temp\ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe
"C:\Users\Admin\AppData\Local\Temp\ae92c8133c7f1198ebf0b3c4671cedd37213ae01244ba6066f15a2252c9900e5.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4448
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1780
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5248
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2612
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1380
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2840
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4312
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2688
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:252
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3044
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4688
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3016
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2968
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1464
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4116
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4292
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4648
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3116
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5524
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1328
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4316
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 f85bb03872760784ce54441d77023253646522aedc15d2860c3dbd3ddd0e8cfc
MD5 d5b6aa4d70c2673ebc87e2bc69e66312
SHA1 27e127ff993c7eb92274d0139b6fa3ad306ba130
SHA512 b5d99fb245e8d02266318281f3bdafdc91423109d0f0c3d47ce36611a377b93463e2421d237c04d58bb1d7da132c1de0118219d22c98dd918a641276ab8d7148
TLSH
T14AD0A90052E80109B2F38B122BFB00020776FCD08930E18E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 a10fc1f12c41cdde336ab25aeee12013cfa7845114184b1ef77015867742b3a3
MD5 fa27b90a0c2524e25978a8f06cbaf299
SHA1 a780e0c89498225a92ee007d3f971b8e25ceb57b
SHA512 bc89582e5d298bb908bca065d6f88f1fc42c7cde920f4b24393893379267f0b4fe110a8f1458dec9a240c83ef883c779ee1d2c49007ee48d9426de362bd00b1d
SSDEEP 96:oalWHRvQGW8J/9J/Weqe+3eYjRuzUNxmHQw7hpXv3211Lh:dlcT/q5j5P4b/32F
TLSH
T1D0D1C091B7D98B28F1BA8D31ADF560EE45657C825C02DE5F7118330D2872E84E7F172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 3d47f74e7314819f09e19d8068c4396f9899be41544666bb77e3bbb83d74ca31
MD5 75de296ade19c8f6d25cebe33884cf8d
SHA1 191d8fdd2b3c4e36a5a2a3662761321f1314fe8f
SHA512 1526e76953e4ee1f31e0457830c71bb8e2c82f5a626cee48f017d5dc3ba06b232085b672a5a2804d73e38b7ed390fdcb47954bd1d537d3585d474533be735bae
SSDEEP 96:tHj5XgRfWWzl64VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdaU4Zvo3KRUmWR:0f5GEAqLjXvF1Nnujkvo3R
TLSH
T1A5028825B7E58B24F2B65970DDF0A0DA45757CC11C81DA9F3628730E7C72F8496B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 da233c63a0a6b0311c191e9e8852d2bc45bbc2c22c8f577a4fa28165296f5bd4
MD5 e1874f241a1244cc0bd2849f3ceb26d7
SHA1 54536e7696d8d561f5fd7e2eb65d50ba2d40993e
SHA512 26e0a02e1fb1f03426bf986c699b6e536e3aedecbdefa2a88a0776c19b797a70a7c204b809e7c817098a41abbca69fe20a0ed43232a8621fb67cb705530e9094
SSDEEP 192:aTf31oagX35QwGNogEvxsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw4ExsCaX
TLSH
T118526413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 9KB
SHA256 57f16a3a27f67eede7638347df700fe7227aa03813a1da934c7964b9a1b69a07
MD5 2a85bd5534739a7d28db4bb8ebab4816
SHA1 e093204bc54d2b706bf4fb7e3c2729159bb6a4b3
SHA512 61d9cb837b5654f87f7174141c36c222c465d83c36ad833e22422cd5ccbbae38d265657bd361968349606c412f77b620509a0904fd49e7b5a66b1d3c08d6f70b
SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5M4+I8wuCXDH//FujVGBSSrM:J5fn2j3V+cZU6S5swu0Yv
TLSH
T15212DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 aeec1ac2be2806837b7aac316186d7e95de6a2ae75495d05cba475d467730420
MD5 275d8b57248fb43efe6133e1b8e07349
SHA1 e3a41dcef2a09c395b229bd6e22ed0c1f3f65679
SHA512 5ffcc0e4ac98cb7123f0eeacecc49a5d1badba23a597c894b11fa66b9f9bc825345976d6db7dc66be9ec538b7bc262cfab93b5de5aa94397212c00630038d6ba
SSDEEP 96:toMRiOA6iSeYGHOhth5KbyTc8VzE8S0RupQ:u6fMg5KuTc8REBVQ
TLSH
T1F7B17A56B3E99A58F17B4E70BCB890F681B5BC525C01CA5F3248731D1C71A88EBB072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 f96da3374c24c3ce1f98ffb8592521e55a41032f54c95d7b7019d7dbaecf8473
MD5 9dd0eec7c752bb1591bc2fb4ec33c02f
SHA1 4e460139b5a3feda7b9e6d383636792b9d3b2a82
SHA512 019a377658ffbc74f945b078a86b3b157e0612b42006d1414013a3cd0109c9c5495b05840cea1be398aa05bf02812fc55d07eb0d29873e7484adb5a085708669
SSDEEP 48:FQ9AgrNDt7/Wyki5m6MRu3owYWeaIDbsRbXcVMRTplqEEt45a/U:FQ93rht7/Wy3owY0usNXl3OKP
TLSH
T128A14445B7E88E24F27A9935BCF060E64266BC924C15DA5F3384730D5CB3794E7B071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4136-504-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-880-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-441-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-253-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-629-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-692-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-817-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-316-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-1005-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-1068-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-1193-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-1318-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-1381-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

memory/4136-1505-0x00007FF7E9900000-0x00007FF7E9989000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads