Overview

overview

10

Static

static

10

ptcAAAD.exe

windows11-ltsc_2024-x64

6

Resubmissions

10/09/2026, 12:49

260910-p2cxtaxtfv10

09/09/2026, 21:52

260909-1rdxxa1fkd10

09/09/2026, 21:50

260909-1qah4a1fje10

09/09/2026, 21:45

260909-1l86vss1gx10

Analysis

  • user interaction
    yes
  • max time kernel
    70s
  • max time network
    74s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    10/09/2026, 12:49

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ptcAAAD.exe
  • Size 234KB
  • Sample260910-p2cxtaxtfv
  • SHA256 9fb468a79f88d9a250180749bfae97d4f310c8510f1f98cae359d95c2a62b4af
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoveryexecutionransomware

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
    ransomware
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 32 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 4 IoCs
  • Modifies registry class 11 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of SetWindowsHookEx 18 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ptcAAAD.exe
    "C:\Users\Admin\AppData\Local\Temp\ptcAAAD.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3312
    • C:\Users\Admin\AppData\Local\Temp\ptcAAAD.exe
      "C:\Users\Admin\AppData\Local\Temp\ptcAAAD.exe" -detached
      2⤵
      • Enumerates connected drives
      • Drops file in System32 directory
      • Sets desktop wallpaper using registry
      • System Location Discovery: System Language Discovery
      • Checks SCSI registry key(s)
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2412
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /c vssadmin delete shadows /all /quiet
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        PID:1892
      • C:\Windows\SysWOW64\cmd.exe
        cmd.exe /C ping 127.0.0.7 -n 3 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\ptcAAAD.exe"
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:4268
        • C:\Windows\SysWOW64\PING.EXE
          ping 127.0.0.7 -n 3
          4⤵
          • System Location Discovery: System Language Discovery
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:4760
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
    1⤵
      PID:2116
    • C:\Windows\system32\printfilterpipelinesvc.exe
      C:\Windows\system32\printfilterpipelinesvc.exe -Embedding
      1⤵
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of WriteProcessMemory
      PID:4324
      • C:\Program Files\Microsoft Office\root\Office16\ONENOTE.EXE
        /insertdoc "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\{D6B6D653-2DBC-43F6-BC4B-1FEF962549BB}.xps" 134335181548140000
        2⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:1988
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4612
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\WLQWINKU-20260709-1433a.log
        1⤵
          PID:5700
        • C:\Windows\system32\mspaint.exe
          "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\zynthxhu.nZASJgT.jpg"
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:2100
        • C:\Windows\system32\svchost.exe
          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
          1⤵
          • Checks SCSI registry key(s)
          PID:5048
        • C:\Windows\system32\SecurityHealthService.exe
          C:\Windows\system32\SecurityHealthService.exe
          1⤵
          • Modifies data under HKEY_USERS
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4472
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Pictures\README.nZASJgT.txt
          1⤵
          • Modifies registry class
          • Opens file in notepad (likely ransom note)
          PID:4688

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              Open Notebook.onetoc2
              • Path C:\Users\Admin\Documents\OneNote Notebooks\My Notebook\Open Notebook.onetoc2
              • Size 4KB
              • SHA256 3664ac8e7930e898620e42f7f46473c906871f70a2616872d9d36ddf474eb1ff
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              zynthxhu.nZASJgT.jpg
              • Path C:\Users\Admin\Pictures\zynthxhu.nZASJgT.jpg
              • Size 868KB
              • SHA256 ac07eb4dec7052224c4f8f3b01c2409a68b44e4686ea68eef5d65f0229c43029
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              README.nZASJgT.txt
              • Path F:\README.nZASJgT.txt
              • Size 1KB
              • SHA256 14025dd3ddbb3979513b7599ff0a95f9a36e7adaa56e5ee7276fabea19f99d5c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              memory/1988-267-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp
              Download

              memory/1988-269-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp
              Download

              memory/1988-268-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp
              Download

              memory/1988-271-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp
              Download

              memory/1988-270-0x00007FFBA2020000-0x00007FFBA2030000-memory.dmp
              Download

              memory/1988-272-0x00007FFB9FC00000-0x00007FFB9FC10000-memory.dmp
              Download

              memory/1988-273-0x00007FFB9FC00000-0x00007FFB9FC10000-memory.dmp
              Download