866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Size 441KB
Sample260815-ngdg6sar21
SHA256 866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a
MD5 42b59cd4947dcd583e298610afe85816
SHA1 86e956bc0705a64c148b5f2da24ef067c8d03e33
SHA512 fcfea70c536473b83391506009a475106fa419bc1e4b55082527c8767f161cf08739c6a7e3675a19331c97cffd73f38365699a44ed1b1b1c2c2995e60a16863d
SSDEEP 12288:nJwBYX9pE8w7jj3+5J67bS9sBeNkbb2y:qykH57u9sBlWy
TLSH
T1DCA44C03E7D201ECF4BBC670CAB69632A9337C505934FA5E15588A252EB1F509F38F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

ransomware

Malware Config

Signatures

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_i3c.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_proximity.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\wsdprint.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_extension.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fssystem.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_nvmedisk.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_mcx.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_primitive.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\rawsilo.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\eyegazeioctl.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_scmdisk.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\dc1-controller.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\miradisp.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fscompression.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_monitor.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fshsm.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_smrdisk.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_sslaccel.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_smrvolume.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_media.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_swcomponent.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_netdriver.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_scmvolume.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_camera.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\remoteposdrv.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\ts_generic.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_apo.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_linedisplay.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_volume.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fsencryption.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_ramdisk.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fsreplication.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fsundelete.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_ucm.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\rdcameradriver.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_processor.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_generic.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\oposdrv.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_display.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_firmware.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_diskdrive.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
File created	C:\Windows\INF\xusb22.PNF	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
3160	notepad.exe
3624	notepad.exe
4704	notepad.exe
1984	notepad.exe
5476	notepad.exe
3632	notepad.exe
1548	notepad.exe
1112	notepad.exe
836	notepad.exe
4196	notepad.exe
4084	notepad.exe
5128	notepad.exe
5064	notepad.exe
1988	notepad.exe
4708	notepad.exe
236	notepad.exe
2172	notepad.exe
1928	notepad.exe
2088	notepad.exe
5352	notepad.exe
5592	notepad.exe
2592	notepad.exe

Suspicious behavior: LoadsDriver 44 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 4704	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	89
PID 3480 wrote to memory of 1112	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	90
PID 3480 wrote to memory of 836	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	91
PID 3480 wrote to memory of 1984	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	92
PID 3480 wrote to memory of 4196	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	94
PID 3480 wrote to memory of 4084	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	95
PID 3480 wrote to memory of 236	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	96
PID 3480 wrote to memory of 5592	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	97
PID 3480 wrote to memory of 2172	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	98
PID 3480 wrote to memory of 5128	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	99
PID 3480 wrote to memory of 5476	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	100
PID 3480 wrote to memory of 5064	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	101
PID 3480 wrote to memory of 1928	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	102
PID 3480 wrote to memory of 2592	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	103
PID 3480 wrote to memory of 1988	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	104
PID 3480 wrote to memory of 4708	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	105
PID 3480 wrote to memory of 2088	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	106
PID 3480 wrote to memory of 3160	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	107
PID 3480 wrote to memory of 3632	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	108
PID 3480 wrote to memory of 3624	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	109
PID 3480 wrote to memory of 5352	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	110
PID 3480 wrote to memory of 1548	3480	866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe	111

C:\Users\Admin\AppData\Local\Temp\866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe
"C:\Users\Admin\AppData\Local\Temp\866e2813add90be78475ef68929b5e09413e93fb24d9242a6fab3e890ad1610a.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4704
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1112
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:836
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1984
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4196
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4084
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:236
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5592
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2172
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5128
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5476
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5064
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1928
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2592
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1988
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4708
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2088
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3160
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3632
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3624
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5352
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 f85bb03872760784ce54441d77023253646522aedc15d2860c3dbd3ddd0e8cfc
MD5 d5b6aa4d70c2673ebc87e2bc69e66312
SHA1 27e127ff993c7eb92274d0139b6fa3ad306ba130
SHA512 b5d99fb245e8d02266318281f3bdafdc91423109d0f0c3d47ce36611a377b93463e2421d237c04d58bb1d7da132c1de0118219d22c98dd918a641276ab8d7148
TLSH
T14AD0A90052E80109B2F38B122BFB00020776FCD08930E18E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 190740a2677d22183d3147a44cd642b6f6e5b8f36aff4016694428f743116d09
MD5 9bc9d4f4ea498239c21c9c92fff19558
SHA1 2f771c4333719006327993ed2cb412608a7bfc69
SHA512 099e3d2fd6f4469949a464016cc9982f8d68e4104b9b662b8e890e6bcad2553f459429bd65b8d6a28cfb7217a06eb34387673ec5c39336e039b1dcb58a9a2efb
SSDEEP 96:oalWHRvQGW8J/9J/WeqsYtuusNXeICc87hpXv3211Lh:dlcT/qZA5Mb/32F
TLSH
T18AD1BF95B7D98B28F1BA8D31ADF560EA85657C825C06CE5F3118330D2872E84E7F172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 a5da1472a6161a6a9fffc2815d00d6886f2d6bf2fb92da1acdf851d070d8c0fb
MD5 b41a65a9b33f70302c861da2a5225b5b
SHA1 d37ffd31b8e44993ea0d3664938642e193e7a0fc
SHA512 c1fb6285e485d8e303cd1bec242243a763823f9d19233e83f8ec005308002dd4c4b57df55c37f310aeaf932c478effd8a32b0bbd565fd28375547dd376a6a9ad
SSDEEP 96:tHj5XgRfWWzlH4VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdaU4Zvo3KRUmWR:0f5LEAqLjXvF1Nnujkvo3R
TLSH
T10D028825B7E58B24F2B65970DDF0A0DA45757CC21C81DA9F3628730E7C72F8496B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 549391f40f1decb43753e6a78047939c48a7a74b3eed49c4adb1bc08a0ad7166
MD5 77ed0dcb6d75748c62be0c8ad5dfa280
SHA1 87e6728031038298e74cf752d63107ef9ff0f2a8
SHA512 3cad222db24f2894fd56528e8a38363362814283db23518e4d30571dc151d1db04669cfba68cc330d06b30cb7bcccd2272e3b9ff3385956de6658be63be6b090
SSDEEP 192:aTf31oagX3aQwGNogEvxsCDa/HlR1VpRhJElAEm:Cf31oaOaQw4ExsCaX
TLSH
T139526413B7D88919F1F74A70EDBD21D64CA57C821D11DA4F3258B34E1872E84FBA072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 9KB
SHA256 57f16a3a27f67eede7638347df700fe7227aa03813a1da934c7964b9a1b69a07
MD5 2a85bd5534739a7d28db4bb8ebab4816
SHA1 e093204bc54d2b706bf4fb7e3c2729159bb6a4b3
SHA512 61d9cb837b5654f87f7174141c36c222c465d83c36ad833e22422cd5ccbbae38d265657bd361968349606c412f77b620509a0904fd49e7b5a66b1d3c08d6f70b
SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5M4+I8wuCXDH//FujVGBSSrM:J5fn2j3V+cZU6S5swu0Yv
TLSH
T15212DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 70eaa1e92e0a72bc44c6a210a7bbfecec69eaa615f3e502bf41c95e5df4c912f
MD5 96450bfb220933e189a90025827bdee4
SHA1 e17152b2b61d4b1de939336d9f41ae35064bfc8b
SHA512 382b010150c5e3379a6a1890d8bb694c0c520ee52f2f29cc3c1cb214f98c8e1a452df62de170440a8c65d832dddfeef98aa24bfffb6bfd66ab012543c63d237d
SSDEEP 96:toMRidfWASiSxqOwth0myDc8VzE8S0RupQ:efJSfG07Dc8REBVQ
TLSH
T110B16956B3E99A58F17B4E707DB890F641B1BC925C01CA5F3244731D1C71A88EBB071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 b7a3507c33ce47c464ecebbd201257cf2dfc0d6f20bbc806f687758ce1db2771
MD5 0b82e9019aede9d82320e14384942e10
SHA1 08134c7c8dc2a4a328f24f59b9f76269a0489841
SHA512 08e11bd4c8e6fd77f5cd3f314a9942832b1f13cb166bd8d6d12589e9823a46c2292f4adae5cd4db7b07a527983602d061ed7790dcad785771d0ec6c7e2137781
SSDEEP 48:FQ9AgrNDt4yvZ5mcMR1pwYKkIDbsRbh9cVMRTplqEEt45a/U:FQ93rht4y0pwYxusNh9l3OKP
TLSH
T1ECA14345B7E88E24F2BA9935BCF0A0E64266BC524C15EA5F3384730D0C73694E7B061A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3480-644-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-1140-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-561-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-313-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-809-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-892-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-1057-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-396-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-1305-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-1388-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-1553-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-1636-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-1801-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-1966-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

memory/3480-2049-0x00007FF7A0D00000-0x00007FF7A0D93000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads