Analysis
- max time kernel
149s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
15/08/2026, 11:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
- Size 441KB
- Sample260815-ngdg6sar21
- SHA256 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a
- MD5 42b59cd4947dcd583e298610afe85816
- SHA1 86e956bc0705a64c148b5f2da24ef067c8d03e33
- SHA512 fcfea70c536473b83391506009a475106fa419bc1e4b55082527c8767f161cf08739c6a7e3675a19331c97cffd73f38365699a44ed1b1b1c2c2995e60a16863d
- SSDEEP 12288:nJwBYX9pE8w7jj3+5J67bS9sBeNkbb2y:qykH57u9sBlWy
- TLSH T1DCA44C03E7D201ECF4BBC670CAB69632A9337C505934FA5E15588A252EB1F509F38F66
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 57 IoCs
description ioc Process File created C:\Windows\INF\c_media.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_computeaccelerator.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_scmvolume.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\xusb22.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_barcodescanner.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_cashdrawer.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\digitalmediadevice.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_processor.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fsundelete.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_monitor.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\ts_generic.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_volume.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\oposdrv.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\wsdprint.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_firmware.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fsinfrastructure.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fsvirtualization.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fscopyprotection.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_ucm.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_diskdrive.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fsencryption.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fsreplication.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fssystem.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_linedisplay.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_smrvolume.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\remoteposdrv.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_apo.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_holographic.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_receiptprinter.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\miradisp.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_camera.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_extension.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fsantivirus.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_sslaccel.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_mcx.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_smrdisk.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fscontentscreener.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fsquotamgmt.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_proximity.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\rdcameradriver.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_display.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fssystemrecovery.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_scmdisk.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fshsm.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_netdriver.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_swcomponent.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\dc1-controller.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fscompression.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\c_magneticstripereader.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\rawsilo.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe File created C:\Windows\INF\PerceptionSimulationSixDof.PNF 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe - Checks SCSI registry key(s) 3 TTPs 28 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe - Opens file in notepad (likely ransom note) 11 IoCs
pid Process 1840 notepad.exe 1440 notepad.exe 2476 notepad.exe 4628 notepad.exe 4996 notepad.exe 1172 notepad.exe 2480 notepad.exe 464 notepad.exe 3396 notepad.exe 2436 notepad.exe 2588 notepad.exe - Suspicious behavior: LoadsDriver 22 IoCs
pid Process 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found 664 Process not Found - Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2568 wrote to memory of 2588 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 89 PID 2568 wrote to memory of 2476 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 91 PID 2568 wrote to memory of 4628 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 92 PID 2568 wrote to memory of 4996 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 100 PID 2568 wrote to memory of 1172 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 103 PID 2568 wrote to memory of 2480 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 106 PID 2568 wrote to memory of 464 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 107 PID 2568 wrote to memory of 3396 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 109 PID 2568 wrote to memory of 1840 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 111 PID 2568 wrote to memory of 1440 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 112 PID 2568 wrote to memory of 2436 2568 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe 113
Processes
-
C:\Users\Admin\AppData\Local\Temp\866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe"C:\Users\Admin\AppData\Local\Temp\866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe"1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2588
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2476
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4628
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4996
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:1172
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2480
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:464
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:3396
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:1840
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:1440
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2436
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p1⤵PID:4328
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
- Size 242B
- SHA256 f85bb03872760784ce54441d77023253646522aedc15d2860c3dbd3ddd0e8cfc
- MD5 d5b6aa4d70c2673ebc87e2bc69e66312
- SHA1 27e127ff993c7eb92274d0139b6fa3ad306ba130
- SHA512 b5d99fb245e8d02266318281f3bdafdc91423109d0f0c3d47ce36611a377b93463e2421d237c04d58bb1d7da132c1de0118219d22c98dd918a641276ab8d7148
- TLSH T14AD0A90052E80109B2F38B122BFB00020776FCD08930E18E31C0A21D0AB1F8488B1333
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\INF\c_diskdrive.PNF
- Size 6KB
- SHA256 0f0833a24954ed761ec32fbbe779895ce8d732bce89dd0e9742b9fcf496edc00
- MD5 64ba20bc368dd34db33e5a168cf975ed
- SHA1 9d81494c95d37670cec5a9eda130e4d1cdfc092a
- SHA512 96ba23017677ef14d81efc1e5beac4b03b65dd5d619ddfa21c617501966c8dfe09d82a24125efb79ca8ef73059717b8d1253b171174052cb6b7daceb4a8fa827
- SSDEEP 48:s6j4xIiupQ/sHBTflU/Weqn774QE5iqjYDEwEFeaIDbsRbXkMx86xQ4SVNdcOEZT:xj4xFuKeBTfW/WeqWYgDusNXeDcbcqJ
- TLSH T13FD1AC11B7D88B24F1764930AEF5A1EA8665BC824C05EE5F3518330E2872E95DBF172E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_display.PNF
- Size 8KB
- SHA256 268a4ae2750678ecbe8087eb0b811a440087080e35e69582ac0fe49a89cf8521
- MD5 2e3de907bada370fec7216cc018a72f3
- SHA1 8ad6330429a58d4e79d112bed8fb8967f2f3dd7b
- SHA512 ad126c97127d77eb7476bba365d264c0db260b9e264961edaaf9e8c6fef4855192642d3553eb5fbf65e0312fe9ade938bd56e5155af0f4871f4e0c13469be2aa
- SSDEEP 96:q/cw3dCMNyLqClXU4VfOrtlBARv7Li+XT7+uZt/Y0BnuOTITd47VGpR2b8jN:VwEMYVX4BA9LjXvZ1NnuH6i
- TLSH T1C5026736B7D5AAA4F1BF59B0EDF850E946367D815C01CE4F3128734E5C72A8496A032B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_media.PNF
- Size 12KB
- SHA256 feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8
- MD5 d6f787534eea52824abfef940379b071
- SHA1 b200fb5e314de41c743ac84fc973584dee668946
- SHA512 7ba2d3f0858a5aea61486ba8eb96fed621384258b5055e97a314d9cde71081545d881059d9bcd5bce4f5cb2d7cc341090d2cc419cac44302708b8bef17e4beca
- SSDEEP 96:QyOzh59kjf3WSkEFRcpXyY3q0xPOQlf88GcNy1/HC3T6gYq2hwyvVATCG5qylmqG:o0f3woapXQXQ1HNogE3lJSZmXx7p
- TLSH T197427C56B7D9C919F1BA8E70EDF851D948B57C821D01CE1F3168B34E1872E84EBB072A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_monitor.PNF
- Size 6KB
- SHA256 8175f3000d31f9afadbbba3149b647da59b30712668751cd04216bbbbc9897ee
- MD5 29f6df5957016e418fbd0f2407e3575e
- SHA1 0ffdc37e214ad11658b1732a8448eab853713b6b
- SHA512 e5916dfd44a4456d0f8c7f42b993426c1196059c053a46ac324104edc674944f622b43c7ecb652e1904dd11932d98b87216e7860f5ce193bcd8899162dcbcc8a
- SSDEEP 96:K3P2tl44AX7cWfWOMnVj3yjNMGULTcRXqE18O8t746Efv3VfANNWuyfJ:Offn2j3ExULohRp6WqNWus
- TLSH T198E1865577D98A24F1765931AFF5B0EB82657CC24C42DB5F3208731E18B3A84D3A1B2E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_processor.PNF
- Size 5KB
- SHA256 6040b942d0887f914a296e8ae0cc67300c479d4d0bb24bd07dde54ee142c4161
- MD5 b9fc29f586c7a0abdb7f33a173bd4518
- SHA1 8a6386314e2b0dac9e57874164e865a6a94a0ba9
- SHA512 b44ea31a19c30c6b1fa4ee964284bc05e6d373d2c22a5012aec388465eb96b84a071804e49d2be577cf07ed24b535bd19e39c30b9a191a140f0c3875682cbfe3
- SSDEEP 96:VF7RG+gmXfWAoeS1HOwthgmyDc8Vze8SWtpJO1:zXXfJozJg7Dc8ReBWlc
- TLSH T183B17B45F7F68A18F17B5D30ACF4A4F685B2BC826D01CA5F3248731D1872A94EBB071A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 fc755ab5bc41958bef0f37e07fc9d55a2257db77c0d983b080c16d294e7316d0
- MD5 94c4f5856d0747c9d6d7fe25e19cebbc
- SHA1 c5488c11816a04fcd948dbf43de9bc0579a2f6b8
- SHA512 c702bda92807aa983da6a777150705bc250e0dbea385b779d2830a13ffe7d1a7c640208731e45772add00c6e8936d2e3510985fe5c7151a7086c3dd957c20578
- SSDEEP 48:+j5CyGz7ElZd/WyH0s5K9MROdYO8IDbYRb0a6KVMRGGLp7tVCCHr6mv7C:Y5RGzY/WygdYVuYNj6DLpxV3r6mvG
- TLSH T1A691495A7BD58E24F27A9D35BDF460E746A2BC428C09CA5F3248331D0C72784E7B162B
- MD5 SHA1 SHA512 SSDEEP TLSH