c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b

Analysis

max time kernel
147s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Size 437KB
Sample260804-gl353adh85
SHA256 c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b
MD5 2504d1b1a789a5435cc868df9b361080
SHA1 263fedd128306c8a453de9f59c46dc8cbb711e15
SHA512 68879544f7c75733d6b2b3743ccb524c1bb32f238f93826ecebee8869a4b1e9a14a01373db7694cb2032c92aff4c4eacfa144bec1e084c4a39cfb0b39ed9852a
SSDEEP 12288:zMFfnk6wgC78CtZeNC02kpz8x4Nk1JDT:kfnkZgC7PtZf0xzivj
TLSH
T1FD944A08BFCA11F5FAB749705EA6E26F0A367930AC79CC4DC2085F099973D644B29727
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery ransomware

Malware Config

Signatures

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_proximity.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_smrdisk.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\ts_generic.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\miradisp.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_media.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_apo.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_nvmedisk.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_sslaccel.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_extension.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fsencryption.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\remoteposdrv.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_display.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_firmware.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_scmvolume.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fshsm.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_i3c.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_primitive.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_smrvolume.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_ramdisk.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_scmdisk.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_processor.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_diskdrive.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_netdriver.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_swcomponent.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fscompression.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_generic.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\eyegazeioctl.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\oposdrv.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\rdcameradriver.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fsreplication.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\xusb22.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fssystem.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_mcx.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_ucm.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_linedisplay.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\dc1-controller.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\wsdprint.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_monitor.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_volume.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\rawsilo.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_camera.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
File created	C:\Windows\INF\c_fsundelete.PNF	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	notepad.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
1144	notepad.exe
3728	notepad.exe
1812	notepad.exe
4884	notepad.exe
3252	notepad.exe
1636	notepad.exe
4248	notepad.exe
4256	notepad.exe
5560	notepad.exe
2248	notepad.exe
4976	notepad.exe
3056	notepad.exe
1104	notepad.exe
3280	notepad.exe
2032	notepad.exe
1304	notepad.exe
5972	notepad.exe
3248	notepad.exe
3144	notepad.exe
1936	notepad.exe
4944	notepad.exe
5740	notepad.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2248	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	88
PID 2496 wrote to memory of 4976	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	89
PID 2496 wrote to memory of 1636	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	90
PID 2496 wrote to memory of 5972	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	91
PID 2496 wrote to memory of 4248	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	93
PID 2496 wrote to memory of 4256	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	94
PID 2496 wrote to memory of 3248	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	95
PID 2496 wrote to memory of 5560	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	96
PID 2496 wrote to memory of 3144	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	97
PID 2496 wrote to memory of 1936	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	98
PID 2496 wrote to memory of 3056	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	99
PID 2496 wrote to memory of 1104	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	100
PID 2496 wrote to memory of 3280	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	101
PID 2496 wrote to memory of 1144	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	102
PID 2496 wrote to memory of 4944	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	103
PID 2496 wrote to memory of 5740	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	104
PID 2496 wrote to memory of 3728	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	105
PID 2496 wrote to memory of 1812	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	106
PID 2496 wrote to memory of 4884	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	107
PID 2496 wrote to memory of 2032	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	108
PID 2496 wrote to memory of 3252	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	109
PID 2496 wrote to memory of 1304	2496	c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe	110

C:\Users\Admin\AppData\Local\Temp\c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe
"C:\Users\Admin\AppData\Local\Temp\c01f105caa15323ee0b39129840f9828cee3466869c37b616b3b24636bf2784b.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2248
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4976
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1636
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5972
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4248
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4256
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3248
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5560
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3144
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1936
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3056
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1104
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3280
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1144
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4944
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5740
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3728
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1812
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:4884
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2032
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:3252
- C:\Windows\SysWOW64\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:1304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
MD5 3f586f0da4b12a5eeb04ab03bc3a0831
SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
TLSH
T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 f85bb03872760784ce54441d77023253646522aedc15d2860c3dbd3ddd0e8cfc
MD5 d5b6aa4d70c2673ebc87e2bc69e66312
SHA1 27e127ff993c7eb92274d0139b6fa3ad306ba130
SHA512 b5d99fb245e8d02266318281f3bdafdc91423109d0f0c3d47ce36611a377b93463e2421d237c04d58bb1d7da132c1de0118219d22c98dd918a641276ab8d7148
TLSH
T14AD0A90052E80109B2F38B122BFB00020776FCD08930E18E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 cef3fc12db7396b2d19f66513fd12f9f571369b1aaf2d0d549c025248e06203b
MD5 c9c4d51d30d09a161013292cb667b1e1
SHA1 a63867da184393edd54b2c427c428e1d8371cb92
SHA512 290e4a5141eddc680e7769e0df8a85ddb7a425a12b79e5bf635f35bc3ff1615c6d3523e9888ef1e1df6e4ee10bf636fe2cc7d7e48363d8de524caf4d1b1cc488
SSDEEP 96:oalWHRvQGW8J/90eqVY/dubNuyJPEp7hpXv3211Lh:dlcKuLiPGb/32F
TLSH
T15ED1D091B7D58B28F1BA8D31ADF560EA45657C825C02CE5F7118330D2872A84E7F172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 a5da1472a6161a6a9fffc2815d00d6886f2d6bf2fb92da1acdf851d070d8c0fb
MD5 b41a65a9b33f70302c861da2a5225b5b
SHA1 d37ffd31b8e44993ea0d3664938642e193e7a0fc
SHA512 c1fb6285e485d8e303cd1bec242243a763823f9d19233e83f8ec005308002dd4c4b57df55c37f310aeaf932c478effd8a32b0bbd565fd28375547dd376a6a9ad
SSDEEP 96:tHj5XgRfWWzlH4VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdaU4Zvo3KRUmWR:0f5LEAqLjXvF1Nnujkvo3R
TLSH
T10D028825B7E58B24F2B65970DDF0A0DA45757CC21C81DA9F3628730E7C72F8496B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 e0ea5f9b78162f0301f4df4fc31bc1d305bb570c246f86f562f2eae7ff921475
MD5 a35904b63102b265d2b43a88a70c46f0
SHA1 dee1259d09796b513e7ffd2dfd579866fa0c20b2
SHA512 be74f14fca235546b33a04c9f7a1efbf79738d9dcf53a57e46fec8adf708a824e2c2f88f8c2cc227280c47aeabf323fdd2626709e8861a0215235e4756a1df82
SSDEEP 192:aTf31oagX35QwGNogEixsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw4hxsCaX
TLSH
T1AB526413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 9KB
SHA256 15c483441828ae26af0640a79025268b6db416c2bc311a8349629d2402e6dece
MD5 3c946f3698239e06dfd759d7a79b65d2
SHA1 85260d94cd4ea89ea25b8e9fd8d6be3032e2b685
SHA512 5793c6f6418dd4420982ec0dfc364435d117cac599cd25a81e2a3592b08a125f8b23aadbd78ef89754534278280c18c9f2b724651fe1d57100902b0f3d50f297
SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5M4+I8wuCXDH//6ujVGBSSrM:J5fn2j3V+cZU6S5swurYv
TLSH
T1DE12DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 70eaa1e92e0a72bc44c6a210a7bbfecec69eaa615f3e502bf41c95e5df4c912f
MD5 96450bfb220933e189a90025827bdee4
SHA1 e17152b2b61d4b1de939336d9f41ae35064bfc8b
SHA512 382b010150c5e3379a6a1890d8bb694c0c520ee52f2f29cc3c1cb214f98c8e1a452df62de170440a8c65d832dddfeef98aa24bfffb6bfd66ab012543c63d237d
SSDEEP 96:toMRidfWASiSxqOwth0myDc8VzE8S0RupQ:efJSfG07Dc8REBVQ
TLSH
T110B16956B3E99A58F17B4E707DB890F641B1BC925C01CA5F3244731D1C71A88EBB071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 ad1fb616bcd99d3533400a6e453944d2f31ffe19f59d5dacadcedcb880f88488
MD5 834acb2d4798ef0fc53ddb72d3154c0c
SHA1 ed41816fe773944059ab1021def16a8e9aa48548
SHA512 e2461409b7b61bd918af5d6a23bcb38eab9d89dfb5aadb8c38511b44792d69e75075ace01b06fe6c803ba33ef9dec5b322d3907b9d4e166ade84181c60f43a5e
SSDEEP 48:FQ9AgrNDt7/WyRb65mElMRDe8/YPeaIDbJRbBcVMRTplqEEt45a/U:FQ93rht7/WyRKl8/YNuJNBl3OKP
TLSH
T1AEA15545B7E88E24F27A9935BCF060E64166BC524C15DA5F3388730D0CB3784E7B072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2496-507-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-1023-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-286-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-581-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-728-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-802-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-949-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-360-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-1170-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-1309-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-1391-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-1536-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-1612-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

memory/2496-1759-0x00000000005A0000-0x000000000062F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads