Analysis
- max time kernel
149s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/09/2026, 08:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe
- Size 419KB
- Sample260916-kpyarsv1cx
- SHA256 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda
- MD5 dccfabda5bbcb50977bc1fe1cfbd979f
- SHA1 225b405cbcc78ca7c9f42041df2dc41668421e64
- SHA512 77a0bb3afba1872ef4a8549d0caaba6808e6e4aa7e73c24ba51b69e6cdb654738e59fdfdeeea892e538b0480398f66669180743fd3dd02859235acd026b3c392
- SSDEEP 12288:qmp2SrsANXsXUN/BF/gpTMvo+I8ISn3NkTNWB:Lrsc8q/ooo+I8Ita
- TLSH T1A8944B02EBE101ECF4BAD670DE7A923259337C905D38FA5E21588E152EB1F509F38B56
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 61 IoCs
description ioc Process File created C:\Windows\INF\c_fscontentscreener.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_nvmedisk.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_monitor.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\miradisp.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_processor.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_diskdrive.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fssystemrecovery.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_i3c.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_smrdisk.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\xusb22.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_media.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_computeaccelerator.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\eyegazeioctl.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fsencryption.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_swcomponent.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\digitalmediadevice.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_camera.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fssystem.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_generic.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_linedisplay.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_magneticstripereader.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\remoteposdrv.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fsquotamgmt.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fsreplication.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_scmvolume.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\oposdrv.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_mcx.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_volume.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\wsdprint.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fsvirtualization.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_receiptprinter.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_smrvolume.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_ucm.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fsinfrastructure.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fsundelete.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fscompression.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fscopyprotection.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fshsm.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\rawsilo.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_barcodescanner.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_primitive.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_apo.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_netdriver.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\dc1-controller.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\rdcameradriver.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_cashdrawer.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_display.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_extension.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_firmware.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_sslaccel.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_fsantivirus.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_proximity.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_ramdisk.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\c_scmdisk.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe File created C:\Windows\INF\ts_generic.PNF 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe - Checks SCSI registry key(s) 3 TTPs 28 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe - Opens file in notepad (likely ransom note) 22 IoCs
pid Process 4292 notepad.exe 4956 notepad.exe 5452 notepad.exe 1880 notepad.exe 4080 notepad.exe 3536 notepad.exe 1384 notepad.exe 1212 notepad.exe 3160 notepad.exe 6048 notepad.exe 124 notepad.exe 4316 notepad.exe 4812 notepad.exe 2572 notepad.exe 5140 notepad.exe 2648 notepad.exe 2732 notepad.exe 3772 notepad.exe 3856 notepad.exe 2492 notepad.exe 4492 notepad.exe 120 notepad.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe - Suspicious behavior: LoadsDriver 42 IoCs
pid Process 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found 812 Process not Found - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3044 wrote to memory of 1212 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 88 PID 3044 wrote to memory of 4292 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 89 PID 3044 wrote to memory of 4956 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 90 PID 3044 wrote to memory of 2732 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 92 PID 3044 wrote to memory of 3160 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 93 PID 3044 wrote to memory of 124 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 94 PID 3044 wrote to memory of 3772 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 95 PID 3044 wrote to memory of 4316 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 96 PID 3044 wrote to memory of 5452 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 97 PID 3044 wrote to memory of 4812 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 98 PID 3044 wrote to memory of 3856 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 99 PID 3044 wrote to memory of 2572 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 100 PID 3044 wrote to memory of 2492 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 101 PID 3044 wrote to memory of 1880 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 102 PID 3044 wrote to memory of 4492 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 103 PID 3044 wrote to memory of 4080 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 104 PID 3044 wrote to memory of 5140 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 105 PID 3044 wrote to memory of 120 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 106 PID 3044 wrote to memory of 3536 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 107 PID 3044 wrote to memory of 2648 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 108 PID 3044 wrote to memory of 6048 3044 2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe"C:\Users\Admin\AppData\Local\Temp\2dfb93f9b395db6321fe31f6e88f1c8f4ab0206f0d3be5ca85cf11dfe5213cda.exe"1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:3044 -
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:1212
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4292
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4956
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2732
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:3160
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:124
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:3772
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4316
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:5452
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4812
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:3856
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2572
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2492
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:1880
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4492
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4080
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:5140
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:120
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:3536
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2648
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:6048
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:1384
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
- Size 242B
- SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
- MD5 3f586f0da4b12a5eeb04ab03bc3a0831
- SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
- SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
- TLSH T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
- Size 242B
- SHA256 2fe23b4612eb3b134ecc98ff66ec700c25bcdb0586dc8e89fe0e22aac2c4c488
- MD5 e6b4618e0cd2fbdb9ed1a5e58990d40a
- SHA1 fbee2c5851c6c7bf7e19d280eafe607385c17ddd
- SHA512 a9c7a17c03ec264bdc5b3e8f454eb661c056031b0450df56585ed0612a3e634c85ed0f197c7b3f8f6f9ebe89e6d1d7beebf92e2d65aab0ce430c9b0220e08b36
- TLSH T188D0A90052E80509B2F38B122BFB0002077AFCD08530E14E31C0A2190AB1F8488B1333
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
- Size 242B
- SHA256 7d5ed5e3d24b2c4b35059361112caa01709332efda89302345765c6a04f54ec9
- MD5 5edb51eea1eaf57d6fdd20fd525db455
- SHA1 51c387a4c7db209e9ae6be1f55cc3a101b85e061
- SHA512 102ed090abac8a57ab28a6483caa44b84ec23c6dd498217f7bd7d638954ed300ac70bc1f65a6125a09e11eb664d512348f4a5d9fb40ffe040d428e367cb5de9a
- TLSH T1A1D0A90052E80109B2F38B122BFB00020776FCD18630E54E31C0A2190AB1F8488B1333
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\INF\c_diskdrive.PNF
- Size 6KB
- SHA256 14e7c73c86c73c7db7626bd6f74b445216b10d5338bbe7b05c70ee3ff5d6aff0
- MD5 7f77789fe0706578cf5b3b36e5aa844d
- SHA1 985c990739ca5628a9b2a69496e5cad8b6f07346
- SHA512 71e0aa263b6ef3d2af0158bee5692ed2fec1f00118c15dd1f0167801ca4091590d0a670cf0b8390dfd54ce564cba136b6326cbb5f973079bf14add131f6a35e4
- SSDEEP 96:oalWHRvQGW8J/9GeqQ/LaY/duYNsbyuRl7hpXv3211Lh:dlcgC7c1b/32F
- TLSH T135D1C091B7D58B28F1BA8E31ADF560EA45657C825C02DE5F7118330D2873E84E7F172A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_display.PNF
- Size 8KB
- SHA256 ea0ed11eedb318f0d70dd2e14a8958f5e6ae6cc1b2285971138b7f8161e3280c
- MD5 e21b2f413c2f73aab5b94696ce2c1fd6
- SHA1 5de3eb63f4d7f40a02069f1c4e688f5a2db60230
- SHA512 72a6140c8213b6c4715b28cd6e3042c8c0453cc148fb71547878ced01ff47885bf04f80950a5aade8c469d8c5a3a30eaff366ddc2246bf594d19e943328aad22
- SSDEEP 96:tHj5Xg3WOl7W8To4nRSOrtcsR+gZTRlzKW56JVBCAIYpJyYU4Zvo3KRUmWR:87W8BRAsnl3ctlqkvo3R
- TLSH T177029765B7E58B64F2B65970DDF0A0EA45757CC11C81DE5F3628330E3C72F8496A0B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_media.PNF
- Size 12KB
- SHA256 da233c63a0a6b0311c191e9e8852d2bc45bbc2c22c8f577a4fa28165296f5bd4
- MD5 e1874f241a1244cc0bd2849f3ceb26d7
- SHA1 54536e7696d8d561f5fd7e2eb65d50ba2d40993e
- SHA512 26e0a02e1fb1f03426bf986c699b6e536e3aedecbdefa2a88a0776c19b797a70a7c204b809e7c817098a41abbca69fe20a0ed43232a8621fb67cb705530e9094
- SSDEEP 192:aTf31oagX35QwGNogEvxsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw4ExsCaX
- TLSH T118526413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_monitor.PNF
- Size 9KB
- SHA256 7d67670ee73833b5b6e3cbefce9e883d2f3f59c0e9cf0e89a19efc57c2b1a23f
- MD5 381b17bb481a8b1b314ed3a91b0c7959
- SHA1 39782c1dfb2b7d52ccbbd9d25de7ff1fdd62ac10
- SHA512 50f4763beba8b33fac908cd88a8e630d90e406e241438d1645c27ee9874079c674242f225ccc9c95b7c8bee6a406b6247bde84980454dc757ed446abc56d1b33
- SSDEEP 96:JwrKkR/TtOMEVw3aMxwVOiE18O8tR6Efv1Qc5M4+I8wuCXDH//FujVGBSSrSIp1O:JDtw3a+jZU6S5swu0Yv
- TLSH T1E212DB55BBE98914F1B65930EFF560E686793C825C02DA8F3168730E1872B90D7B173E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_processor.PNF
- Size 5KB
- SHA256 e2a7dce83cf9d082c5f7b927e7131569003730d96f8e9149148c0c6a89f9aff8
- MD5 aaca4d158d734e6e7532d6f9cf5aa5c1
- SHA1 c76af2e7d45ecb967a5fb6e993084e343febf917
- SHA512 6ae7996fea17609987f46422cde4c9731b4e2aa3542809c0ab29aeea4d49b78d76b34387bec11171e28d20f13923ed061a7e94bd0d36bcd48cdf0d46669f1572
- SSDEEP 96:toMRiQAGiSAcPO/tZlBy3c8VzE8S0RupQ:MGfA7lk3c8REBVQ
- TLSH T13DB16956B3E99A58F17B8D707DB8A4FA41B1BC525C01CA5F3248731D1C72A88EBB071B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 dd641512812573862e4c2e3c646218d99cac89b53056d87b43d23b7ea8fbc496
- MD5 eb8050b962e122bff1b843f1773fc2fd
- SHA1 ef6e8f87bc124a64ff1d5889b71954ddb4468989
- SHA512 57fb96d5c909b01295878f7448583a8d773cbc8e3bf89a200e57a8ef2fac3d6bd6af70ec5c001a3c822295277a42603af290f93a7a2df921c0709b1574e434d1
- SSDEEP 48:FQ9AgrNDt7/Wyk65m6vMRgK/0YU4kIDbqRbHcVMRTplqEEt45a/U:FQ93rht7/WyNc0YUDuqNHl3OKP
- TLSH T124A17544B7E88E24F27A9935BCF060E64266BC924C15EA5F3284730D0C73794E7F071A
- MD5 SHA1 SHA512 SSDEEP TLSH