f3b532a2299a80f5dcdc6f92b4355636f3da12512b4a03e64a2070de8639582b

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DriverVideo.exe
Size 561KB
Sample260809-r5c34azelf
SHA256 f3b532a2299a80f5dcdc6f92b4355636f3da12512b4a03e64a2070de8639582b
MD5 c1ecefd73da47b4885bb1909369bc2e6
SHA1 08ceb8c1a63cb685d18e7e287adf0b791c491702
SHA512 cb298813f0c1f4fe346017a42d69f17d6af48445191482a4c93b30bae7ca0dc281dd8d0987ead0e55445b8b180121a48d959850602f892811d9990b3d871afd5
SSDEEP 12288:H8a3cfznmJIdeIuTfEv5tsytqzyHqIPBo3Ng9f/o:UfznyIuLYtsyYzCqI5odg9f/
TLSH
T134C4D1023BA4C92FEABE17B5E4B2130067B5F14B9552DB8A78CC15F96B5330099523BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3932	powershell.exe
5808	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
3104	DriverVideo.exe
1428	DriverVideo.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3932	powershell.exe
3932	powershell.exe
3932	powershell.exe
5808	powershell.exe
5808	powershell.exe
5808	powershell.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	DriverVideo.exe
Token: SeBackupPrivilege	3548	vssvc.exe
Token: SeRestorePrivilege	3548	vssvc.exe
Token: SeAuditPrivilege	3548	vssvc.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeIncreaseQuotaPrivilege	3932	powershell.exe
Token: SeSecurityPrivilege	3932	powershell.exe
Token: SeTakeOwnershipPrivilege	3932	powershell.exe
Token: SeLoadDriverPrivilege	3932	powershell.exe
Token: SeSystemProfilePrivilege	3932	powershell.exe
Token: SeSystemtimePrivilege	3932	powershell.exe
Token: SeProfSingleProcessPrivilege	3932	powershell.exe
Token: SeIncBasePriorityPrivilege	3932	powershell.exe
Token: SeCreatePagefilePrivilege	3932	powershell.exe
Token: SeBackupPrivilege	3932	powershell.exe
Token: SeRestorePrivilege	3932	powershell.exe
Token: SeShutdownPrivilege	3932	powershell.exe
Token: SeDebugPrivilege	3932	powershell.exe
Token: SeSystemEnvironmentPrivilege	3932	powershell.exe
Token: SeRemoteShutdownPrivilege	3932	powershell.exe
Token: SeUndockPrivilege	3932	powershell.exe
Token: SeManageVolumePrivilege	3932	powershell.exe
Token: 33	3932	powershell.exe
Token: 34	3932	powershell.exe
Token: 35	3932	powershell.exe
Token: 36	3932	powershell.exe
Token: SeDebugPrivilege	5808	powershell.exe
Token: SeIncreaseQuotaPrivilege	5808	powershell.exe
Token: SeSecurityPrivilege	5808	powershell.exe
Token: SeTakeOwnershipPrivilege	5808	powershell.exe
Token: SeLoadDriverPrivilege	5808	powershell.exe
Token: SeSystemProfilePrivilege	5808	powershell.exe
Token: SeSystemtimePrivilege	5808	powershell.exe
Token: SeProfSingleProcessPrivilege	5808	powershell.exe
Token: SeIncBasePriorityPrivilege	5808	powershell.exe
Token: SeCreatePagefilePrivilege	5808	powershell.exe
Token: SeBackupPrivilege	5808	powershell.exe
Token: SeRestorePrivilege	5808	powershell.exe
Token: SeShutdownPrivilege	5808	powershell.exe
Token: SeDebugPrivilege	5808	powershell.exe
Token: SeSystemEnvironmentPrivilege	5808	powershell.exe
Token: SeRemoteShutdownPrivilege	5808	powershell.exe
Token: SeUndockPrivilege	5808	powershell.exe
Token: SeManageVolumePrivilege	5808	powershell.exe
Token: 33	5808	powershell.exe
Token: 34	5808	powershell.exe
Token: 35	5808	powershell.exe
Token: 36	5808	powershell.exe
Token: SeDebugPrivilege	3104	DriverVideo.exe
Token: SeDebugPrivilege	1428	DriverVideo.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 3932	4352	DriverVideo.exe	94
PID 4352 wrote to memory of 5808	4352	DriverVideo.exe	97

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\DriverVideo.exe
"C:\Users\Admin\AppData\Local\Temp\DriverVideo.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\DriverVideo.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3932
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'DriverVideo.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5808

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3548

C:\Users\Admin\AppData\Local\DriverVideo.exe
C:\Users\Admin\AppData\Local\DriverVideo.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3104

C:\Users\Admin\AppData\Local\DriverVideo.exe
"C:\Users\Admin\AppData\Local\DriverVideo.exe"
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverVideo.exe

Path C:\Users\Admin\AppData\Local\DriverVideo.exe
Size 561KB
SHA256 f3b532a2299a80f5dcdc6f92b4355636f3da12512b4a03e64a2070de8639582b
MD5 c1ecefd73da47b4885bb1909369bc2e6
SHA1 08ceb8c1a63cb685d18e7e287adf0b791c491702
SHA512 cb298813f0c1f4fe346017a42d69f17d6af48445191482a4c93b30bae7ca0dc281dd8d0987ead0e55445b8b180121a48d959850602f892811d9990b3d871afd5
SSDEEP 12288:H8a3cfznmJIdeIuTfEv5tsytqzyHqIPBo3Ng9f/o:UfznyIuLYtsyYzCqI5odg9f/
TLSH
T134C4D1023BA4C92FEABE17B5E4B2130067B5F14B9552DB8A78CC15F96B5330099523BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 749aaba736648e246b89ae3a6987b644bd1a90bcc2e9f73bfbf9eb03a77c32e9
MD5 0dce6d83f83e969fe1fdc72a9a725044
SHA1 7d2c7e5be785b06fc9c922c924c7436d3b8cfd7a
SHA512 bb1f033d5c7e7d56518c5e8e038075d98ce1151d05f6f219a7b04661ae7c36b2c4b5cd2ec8ddf758f401543db7673381f1d657e6537b82d22f5e04bcc6f7d31c
TLSH
T1D1216833F3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_v1j5sbrp.o4d.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v1j5sbrp.o4d.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1428-43-0x000000001BD80000-0x000000001BE60000-memory.dmp

Download

memory/1428-42-0x00000000030E0000-0x0000000003142000-memory.dmp

Download

memory/3932-26-0x0000024379F10000-0x0000024379FC2000-memory.dmp

Download

memory/3932-20-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-29-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-8-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-11-0x00000243618D0000-0x00000243618F2000-memory.dmp

Download

memory/3932-12-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-13-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-14-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-15-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-16-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-17-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-18-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-19-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-27-0x0000024379FD0000-0x0000024379FDA000-memory.dmp

Download

memory/3932-21-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/3932-25-0x0000024379EF0000-0x0000024379F0E000-memory.dmp

Download

memory/4352-0-0x00007FFE3558F000-0x00007FFE35590000-memory.dmp

Download

memory/4352-22-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4352-6-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4352-7-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4352-5-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4352-4-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4352-3-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4352-41-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4352-2-0x00007FFE35400000-0x00007FFE35DA4000-memory.dmp

Download

memory/4352-1-0x0000000000AB0000-0x0000000000B42000-memory.dmp

Download