5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf

Analysis

max time kernel
147s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 22:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Size 428KB
Sample260811-2ssccstejf
SHA256 5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf
MD5 ed82f0bbcc259c2a3c0fa7c931a819a6
SHA1 2958bc34d06a016bf3c34422c1358ab9991f4aed
SHA512 72c20c39fcbb1858fb1c6c7e55f7d6ca1cb151e2dde6a02036335e3175cf56d52ae33a1d8f6bda19f1b80748e2aaf797d33e4f9c928f89f25f58f869688374d8
SSDEEP 12288:VpXaUQVwH5irGw7J+emP7pJh+boNkyS6:VpXafdGws7Dh+r8
TLSH
T13A943B13F7D201ECF4BBC6709A7B9632A9337C505934FA1E15588A252EB1E109F38F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

ransomware

Malware Config

Signatures

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_fsinfrastructure.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_extension.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_ramdisk.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_netdriver.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_proximity.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_ucm.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\dc1-controller.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_primitive.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_sslaccel.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_nvmedisk.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_i3c.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\rawsilo.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\ts_generic.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\rdcameradriver.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_apo.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_mcx.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_scmdisk.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_media.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_processor.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_camera.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_diskdrive.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_firmware.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_smrvolume.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fscompression.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsundelete.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_linedisplay.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsreplication.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fssystem.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\xusb22.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_display.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_swcomponent.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_scmvolume.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\eyegazeioctl.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_generic.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_monitor.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_volume.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\oposdrv.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsencryption.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_smrdisk.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\remoteposdrv.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\miradisp.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\wsdprint.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
File created	C:\Windows\INF\c_fshsm.PNF	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
5376	notepad.exe
1568	notepad.exe
3376	notepad.exe
2660	notepad.exe
1532	notepad.exe
5276	notepad.exe
2864	notepad.exe
1640	notepad.exe
4944	notepad.exe
2900	notepad.exe
108	notepad.exe
3760	notepad.exe
2808	notepad.exe
1876	notepad.exe
52	notepad.exe
3008	notepad.exe
1028	notepad.exe
1472	notepad.exe
4328	notepad.exe
2436	notepad.exe
4840	notepad.exe
4528	notepad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe

Suspicious behavior: LoadsDriver 44 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 1472	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	89
PID 2420 wrote to memory of 2808	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	90
PID 2420 wrote to memory of 4944	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	91
PID 2420 wrote to memory of 4328	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	92
PID 2420 wrote to memory of 2660	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	94
PID 2420 wrote to memory of 2436	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	95
PID 2420 wrote to memory of 1876	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	96
PID 2420 wrote to memory of 52	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	97
PID 2420 wrote to memory of 4840	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	98
PID 2420 wrote to memory of 4528	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	99
PID 2420 wrote to memory of 5376	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	100
PID 2420 wrote to memory of 1568	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	101
PID 2420 wrote to memory of 1532	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	102
PID 2420 wrote to memory of 3008	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	103
PID 2420 wrote to memory of 5276	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	104
PID 2420 wrote to memory of 3376	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	105
PID 2420 wrote to memory of 2900	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	106
PID 2420 wrote to memory of 1028	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	107
PID 2420 wrote to memory of 2864	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	108
PID 2420 wrote to memory of 108	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	109
PID 2420 wrote to memory of 1640	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	110
PID 2420 wrote to memory of 3760	2420	5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe	111

C:\Users\Admin\AppData\Local\Temp\5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe
"C:\Users\Admin\AppData\Local\Temp\5151bfc37a9256bf2d40f9ef837cd467f6f99a78e00867a012d0c8b416016acf.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1472
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2808
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4944
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4328
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2660
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2436
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1876
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:52
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4840
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4528
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5376
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1568
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1532
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3008
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5276
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3376
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2900
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1028
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2864
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:108
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1640
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 f85bb03872760784ce54441d77023253646522aedc15d2860c3dbd3ddd0e8cfc
MD5 d5b6aa4d70c2673ebc87e2bc69e66312
SHA1 27e127ff993c7eb92274d0139b6fa3ad306ba130
SHA512 b5d99fb245e8d02266318281f3bdafdc91423109d0f0c3d47ce36611a377b93463e2421d237c04d58bb1d7da132c1de0118219d22c98dd918a641276ab8d7148
TLSH
T14AD0A90052E80109B2F38B122BFB00020776FCD08930E18E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 7b1568a54679cf1ec09b4eff3c5186e5d128e8eee69a44a03b95c3de647939bd
MD5 ddfbfafab018df955eff822248fb0c56
SHA1 e980b947d0039b1ae4f4337cd2c551fad4ef75c1
SHA512 1c4442e6079cc4b83efdb20e7982e53ba07c6df888790b3e4654aba91941f3e572006f4429c4153e8610b6ac525f89d9c2fd731c285f9011c630ca3e1a35f4c0
SSDEEP 96:oalWHRvQGW8J/9J/WeqQ/LaY/dusNXe2c87hpXv3211Lh:dlcT/qC7riMb/32F
TLSH
T1E2D1CF91B7D58B28F1BA8D31ADF560EA45657C825C02CE5F3118330D2872E84E7F172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 571c1edf9abdb69829bc5e9d41e049dfff33f03ee6639433ac65478e0aad60c9
MD5 afdd4c5fdeda4f78bf143c1ac55593ae
SHA1 e48611fbd8c83d142a0fb8ce892c59a16c4e402b
SHA512 e86a8918b1a568bf3bde503e83886e4844511b3516fa1ee73b88b6dc088731a5ae889662c29643474b0ec461a413077faacb92ee761027c3f8472d3d96763db7
SSDEEP 96:tHj5XgRfWWzlH4VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdWU4Zvo3KRUmWR:0f5LEAqLjXvF1Nnu3kvo3R
TLSH
T188029825B7E58B24F2B65970DDF0A0DA45757CC11C81DA9F3628730E7C72F8496B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 da233c63a0a6b0311c191e9e8852d2bc45bbc2c22c8f577a4fa28165296f5bd4
MD5 e1874f241a1244cc0bd2849f3ceb26d7
SHA1 54536e7696d8d561f5fd7e2eb65d50ba2d40993e
SHA512 26e0a02e1fb1f03426bf986c699b6e536e3aedecbdefa2a88a0776c19b797a70a7c204b809e7c817098a41abbca69fe20a0ed43232a8621fb67cb705530e9094
SSDEEP 192:aTf31oagX35QwGNogEvxsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw4ExsCaX
TLSH
T118526413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 9KB
SHA256 57f16a3a27f67eede7638347df700fe7227aa03813a1da934c7964b9a1b69a07
MD5 2a85bd5534739a7d28db4bb8ebab4816
SHA1 e093204bc54d2b706bf4fb7e3c2729159bb6a4b3
SHA512 61d9cb837b5654f87f7174141c36c222c465d83c36ad833e22422cd5ccbbae38d265657bd361968349606c412f77b620509a0904fd49e7b5a66b1d3c08d6f70b
SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5M4+I8wuCXDH//FujVGBSSrM:J5fn2j3V+cZU6S5swu0Yv
TLSH
T15212DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 014c38810ca33d3dba39a212e8898a26cb2f7922cd03c11899cb683d2cad8d5f
MD5 b57d6d2a4d5eeb8c834049acbeb913c8
SHA1 118919d2fdde23ea9a470b6c980096f975064207
SHA512 34980678418cac66408d98332ae859de646710df8c873e81a448ca2e7125f171c47b5b1286dd95c4ccc2253c4ecf3ba8687eec1378240e92e5513c98c9e69329
SSDEEP 96:toMRiLAniS3CZA3OxtwEiyhc8VzE8S0RupQ:TnfkcEfhc8REBVQ
TLSH
T1E4B17816B3E99A58F17B4E707DB890E641B5BC525C01CA5F3248731D0C71A88EBB072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 9b85f3df243b46b97d349412a925139879d5030b968897e5e78109cc678dcd80
MD5 d8ef04166632f23286a53c84115891ec
SHA1 db623bbcfff0e70586315861f22e0f23e6194682
SHA512 38f0cc1048f6be55d054947153833934b282c7467b63dbd7605d2b61ef4d56c89519c6f0083e21d1d2980a4dc206acf7427f14de0dfd1c6846f494ab38aab749
SSDEEP 48:FQ9AgrNDtaxyo45mOMRZgqwYoOaIDbXRbocVMRTplqEEt45a/U:FQ93rht0yfqwY/auXNol3OKP
TLSH
T14CA14445B7E88E24F27A8935BCF0A0E64166BC524C15DA5F3384730D1C73794E7B071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2420-623-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-1101-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-543-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-304-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-782-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-862-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-1021-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-384-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-1260-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-1340-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-1499-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-1579-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-1738-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

memory/2420-1897-0x00007FF7C91B0000-0x00007FF7C923E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads