5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf

Analysis

max time kernel
149s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/08/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Size 428KB
Sample260811-2ssccstejf
SHA256 5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf
MD5 ed82f0bbcc259c2a3c0fa7c931a819a6
SHA1 2958bc34d06a016bf3c34422c1358ab9991f4aed
SHA512 72c20c39fcbb1858fb1c6c7e55f7d6ca1cb151e2dde6a02036335e3175cf56d52ae33a1d8f6bda19f1b80748e2aaf797d33e4f9c928f89f25f58f869688374d8
SSDEEP 12288:VpXaUQVwH5irGw7J+emP7pJh+boNkyS6:VpXafdGws7Dh+r8
TLSH
T13A943B13F7D201ECF4BBC6709A7B9632A9337C505934FA1E15588A252EB1E109F38F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

ransomware

Malware Config

Signatures

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_volume.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\xusb22.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_processor.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_extension.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsreplication.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fssystem.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_scmvolume.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_diskdrive.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fscompression.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_apo.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_display.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_linedisplay.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_smrdisk.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\miradisp.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fshsm.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_holographic.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\ts_generic.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_firmware.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_proximity.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_scmdisk.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsencryption.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsundelete.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_monitor.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_sslaccel.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_swcomponent.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\remoteposdrv.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_smrvolume.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\dc1-controller.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\oposdrv.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\rdcameradriver.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_media.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\wsdprint.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_camera.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_ucm.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_mcx.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\rawsilo.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_netdriver.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
1744	notepad.exe
3416	notepad.exe
1780	notepad.exe
4200	notepad.exe
1368	notepad.exe
2892	notepad.exe
2932	notepad.exe
4988	notepad.exe
4948	notepad.exe
3832	notepad.exe
4380	notepad.exe
760	notepad.exe
1068	notepad.exe
4232	notepad.exe
3956	notepad.exe
2556	notepad.exe
3528	notepad.exe
4892	notepad.exe
1236	notepad.exe
4440	notepad.exe
3976	notepad.exe
4396	notepad.exe

Suspicious behavior: LoadsDriver 44 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 4396	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	91
PID 1596 wrote to memory of 2932	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	95
PID 1596 wrote to memory of 1068	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	96
PID 1596 wrote to memory of 1744	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	97
PID 1596 wrote to memory of 3416	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	99
PID 1596 wrote to memory of 3528	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	100
PID 1596 wrote to memory of 4988	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	101
PID 1596 wrote to memory of 4948	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	102
PID 1596 wrote to memory of 4892	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	104
PID 1596 wrote to memory of 3832	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	105
PID 1596 wrote to memory of 1780	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	106
PID 1596 wrote to memory of 4232	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	107
PID 1596 wrote to memory of 4200	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	108
PID 1596 wrote to memory of 4380	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	109
PID 1596 wrote to memory of 3956	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	110
PID 1596 wrote to memory of 1368	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	111
PID 1596 wrote to memory of 1236	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	112
PID 1596 wrote to memory of 760	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	113
PID 1596 wrote to memory of 4440	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	114
PID 1596 wrote to memory of 3976	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	115
PID 1596 wrote to memory of 2892	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	116
PID 1596 wrote to memory of 2556	1596	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	117

C:\Users\Admin\AppData\Local\Temp\5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
"C:\Users\Admin\AppData\Local\Temp\5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4396
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2932
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1068
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1744
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3416
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3528
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4988
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4948
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4892
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3832
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1780
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4232
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4200
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4380
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3956
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1368
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1236
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:760
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4440
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3976
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2892
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2556

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
MD5 3f586f0da4b12a5eeb04ab03bc3a0831
SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
TLSH
T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 f85bb03872760784ce54441d77023253646522aedc15d2860c3dbd3ddd0e8cfc
MD5 d5b6aa4d70c2673ebc87e2bc69e66312
SHA1 27e127ff993c7eb92274d0139b6fa3ad306ba130
SHA512 b5d99fb245e8d02266318281f3bdafdc91423109d0f0c3d47ce36611a377b93463e2421d237c04d58bb1d7da132c1de0118219d22c98dd918a641276ab8d7148
TLSH
T14AD0A90052E80109B2F38B122BFB00020776FCD08930E18E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 0f0833a24954ed761ec32fbbe779895ce8d732bce89dd0e9742b9fcf496edc00
MD5 64ba20bc368dd34db33e5a168cf975ed
SHA1 9d81494c95d37670cec5a9eda130e4d1cdfc092a
SHA512 96ba23017677ef14d81efc1e5beac4b03b65dd5d619ddfa21c617501966c8dfe09d82a24125efb79ca8ef73059717b8d1253b171174052cb6b7daceb4a8fa827
SSDEEP 48:s6j4xIiupQ/sHBTflU/Weqn774QE5iqjYDEwEFeaIDbsRbXkMx86xQ4SVNdcOEZT:xj4xFuKeBTfW/WeqWYgDusNXeDcbcqJ
TLSH
T13FD1AC11B7D88B24F1764930AEF5A1EA8665BC824C05EE5F3518330E2872E95DBF172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 9e337c181bc7fd80b08cd97d263bd416445d062dff31ce4a852b99d58ffef15c
MD5 4d9ebec439d42f5a51f07a94fe0cba76
SHA1 0976f589e9eeee58dcbe9f852e5c0c58ad1f7d4b
SHA512 54039438946be839eac1aec6f761ea3239ae799a0bbc13223bf5633b91ce3985d3c82cfa6e5f40d347d262df151e31b761909cd79ac6d12f57d13140ac1a5de2
SSDEEP 96:q/cw3dCMNyLifWOlNR4/1OrtO7RWuG3vuZt/Y0BnuOTITd47VGpR2b8jN:VwEMYOfRN67FZ1NnuH6i
TLSH
T14C026736B7D5EAA4F1BF59B0EDF850E946367D825C01CE5F3128734E1C72A8486A072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8
MD5 d6f787534eea52824abfef940379b071
SHA1 b200fb5e314de41c743ac84fc973584dee668946
SHA512 7ba2d3f0858a5aea61486ba8eb96fed621384258b5055e97a314d9cde71081545d881059d9bcd5bce4f5cb2d7cc341090d2cc419cac44302708b8bef17e4beca
SSDEEP 96:QyOzh59kjf3WSkEFRcpXyY3q0xPOQlf88GcNy1/HC3T6gYq2hwyvVATCG5qylmqG:o0f3woapXQXQ1HNogE3lJSZmXx7p
TLSH
T197427C56B7D9C919F1BA8E70EDF851D948B57C821D01CE1F3168B34E1872E84EBB072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 6KB
SHA256 8175f3000d31f9afadbbba3149b647da59b30712668751cd04216bbbbc9897ee
MD5 29f6df5957016e418fbd0f2407e3575e
SHA1 0ffdc37e214ad11658b1732a8448eab853713b6b
SHA512 e5916dfd44a4456d0f8c7f42b993426c1196059c053a46ac324104edc674944f622b43c7ecb652e1904dd11932d98b87216e7860f5ce193bcd8899162dcbcc8a
SSDEEP 96:K3P2tl44AX7cWfWOMnVj3yjNMGULTcRXqE18O8t746Efv3VfANNWuyfJ:Offn2j3ExULohRp6WqNWus
TLSH
T198E1865577D98A24F1765931AFF5B0EB82657CC24C42DB5F3208731E18B3A84D3A1B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 6040b942d0887f914a296e8ae0cc67300c479d4d0bb24bd07dde54ee142c4161
MD5 b9fc29f586c7a0abdb7f33a173bd4518
SHA1 8a6386314e2b0dac9e57874164e865a6a94a0ba9
SHA512 b44ea31a19c30c6b1fa4ee964284bc05e6d373d2c22a5012aec388465eb96b84a071804e49d2be577cf07ed24b535bd19e39c30b9a191a140f0c3875682cbfe3
SSDEEP 96:VF7RG+gmXfWAoeS1HOwthgmyDc8Vze8SWtpJO1:zXXfJozJg7Dc8ReBWlc
TLSH
T183B17B45F7F68A18F17B5D30ACF4A4F685B2BC826D01CA5F3248731D1872A94EBB071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 fc755ab5bc41958bef0f37e07fc9d55a2257db77c0d983b080c16d294e7316d0
MD5 94c4f5856d0747c9d6d7fe25e19cebbc
SHA1 c5488c11816a04fcd948dbf43de9bc0579a2f6b8
SHA512 c702bda92807aa983da6a777150705bc250e0dbea385b779d2830a13ffe7d1a7c640208731e45772add00c6e8936d2e3510985fe5c7151a7086c3dd957c20578
SSDEEP 48:+j5CyGz7ElZd/WyH0s5K9MROdYO8IDbYRb0a6KVMRGGLp7tVCCHr6mv7C:Y5RGzY/WygdYVuYNj6DLpxV3r6mvG
TLSH
T1A691495A7BD58E24F27A9D35BDF460E746A2BC428C09CA5F3248331D0C72784E7B162B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1596-431-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-863-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-246-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-493-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-616-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-678-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-801-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-308-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-986-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-1048-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-1170-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-1232-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-1355-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

memory/1596-1417-0x00007FF7AE680000-0x00007FF7AE70E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads