bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/09/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Size 557KB
Sample260919-snytxasdnd
SHA256 bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816
MD5 8489fb9bcdf17b48895aee0acf3ae2ae
SHA1 e43cfb115fc54f4d0609c3143e52df945babcc52
SHA512 99557211214423c1e50162fbea60eca07534d7fb6a28e5bf2a3534479aab1c19030b0786cda2dc921e8e186366886d48c0939eedc12ef619eeafdbe98563cd82
SSDEEP 12288:yBrK643BsHfwZXr5a95ujyPAQYiE2LaAe0gO1VcGarHDF:8rmK/wZX1a+yHA2Lle0gOItF
TLSH
T16FC44B03F7E321FCE1B7D5309AB75632B972785019346E3E4190DA362E71E51AA38F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

ransomware

Malware Config

Signatures

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\rawsilo.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\miradisp.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fssystem.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\remoteposdrv.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_processor.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_smrvolume.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fscompression.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_sslaccel.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_volume.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\wsdprint.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\ts_generic.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsreplication.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsundelete.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\dc1-controller.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_proximity.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_swcomponent.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_diskdrive.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_scmvolume.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\rdcameradriver.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fshsm.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_scmdisk.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_display.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_extension.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_mcx.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\xusb22.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_holographic.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_linedisplay.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_monitor.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_netdriver.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_ucm.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_firmware.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\oposdrv.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_camera.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsencryption.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_smrdisk.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_media.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_apo.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe

Opens file in notepad (likely ransom note) 21 IoCs

ransomware

pid	Process
656	notepad.exe
3136	notepad.exe
4348	notepad.exe
2376	notepad.exe
1420	notepad.exe
1192	notepad.exe
392	notepad.exe
1920	notepad.exe
2944	notepad.exe
1196	notepad.exe
3544	notepad.exe
1408	notepad.exe
1672	notepad.exe
1476	notepad.exe
5960	notepad.exe
1016	notepad.exe
3092	notepad.exe
2832	notepad.exe
5192	notepad.exe
4796	notepad.exe
1732	notepad.exe

Suspicious behavior: LoadsDriver 42 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 656	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	91
PID 1488 wrote to memory of 4348	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	95
PID 1488 wrote to memory of 5960	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	96
PID 1488 wrote to memory of 1196	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	100
PID 1488 wrote to memory of 3544	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	105
PID 1488 wrote to memory of 2376	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	107
PID 1488 wrote to memory of 1016	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	115
PID 1488 wrote to memory of 3092	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	119
PID 1488 wrote to memory of 2832	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	120
PID 1488 wrote to memory of 1408	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	121
PID 1488 wrote to memory of 5192	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	122
PID 1488 wrote to memory of 4796	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	123
PID 1488 wrote to memory of 1420	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	125
PID 1488 wrote to memory of 1192	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	126
PID 1488 wrote to memory of 1732	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	127
PID 1488 wrote to memory of 392	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	128
PID 1488 wrote to memory of 1672	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	129
PID 1488 wrote to memory of 1476	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	130
PID 1488 wrote to memory of 1920	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	131
PID 1488 wrote to memory of 2944	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	132
PID 1488 wrote to memory of 3136	1488	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	133

C:\Users\Admin\AppData\Local\Temp\bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
"C:\Users\Admin\AppData\Local\Temp\bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:656
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4348
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5960
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1196
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3544
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2376
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1016
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3092
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2832
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1408
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5192
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4796
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1420
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1192
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1732
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:392
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1672
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1476
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1920
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2944
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3136

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 7d5ed5e3d24b2c4b35059361112caa01709332efda89302345765c6a04f54ec9
MD5 5edb51eea1eaf57d6fdd20fd525db455
SHA1 51c387a4c7db209e9ae6be1f55cc3a101b85e061
SHA512 102ed090abac8a57ab28a6483caa44b84ec23c6dd498217f7bd7d638954ed300ac70bc1f65a6125a09e11eb664d512348f4a5d9fb40ffe040d428e367cb5de9a
TLSH
T1A1D0A90052E80109B2F38B122BFB00020776FCD18630E54E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
MD5 3f586f0da4b12a5eeb04ab03bc3a0831
SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
TLSH
T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 6aa675739e4e154859956f5f651c918762772d0a3e5a6dde52092161fadba81b
MD5 477f7b54d0ac886d4fd5d69aea19c5e7
SHA1 2af466242a8732077c49d7fda657776f72fb3ab5
SHA512 1dfac1e219f2976c3926682f18dac46854ffcea0a444d17bb1fd74b0ff9117830ef9862599b517685116102499e0982f23a80f0f73b092822d1a48c46d74c061
TLSH
T1DCD0A90092E9010AB2F38B222BFB00020776FCD08530E14E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 3904eb8e395cbb8af714d276aa4a74d0e34c62df3176e91cdb196cb38c7a9ca9
MD5 4245b5fa3bb97180fadf6fb92b6fcbf9
SHA1 1c602e304a522f11cf21ff5b14f2eba6a5884926
SHA512 5fc3b2470af035d99c609d321bd426bb5259daa068faa5f44953bc467e777415f6d04ac39db019cabf3fe290a7665bbaa533ef8a55068c5a69cc1d8aac9d640c
TLSH
T170D0A90062E8010AB2F38B222BFB00024776FCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 2fe23b4612eb3b134ecc98ff66ec700c25bcdb0586dc8e89fe0e22aac2c4c488
MD5 e6b4618e0cd2fbdb9ed1a5e58990d40a
SHA1 fbee2c5851c6c7bf7e19d280eafe607385c17ddd
SHA512 a9c7a17c03ec264bdc5b3e8f454eb661c056031b0450df56585ed0612a3e634c85ed0f197c7b3f8f6f9ebe89e6d1d7beebf92e2d65aab0ce430c9b0220e08b36
TLSH
T188D0A90052E80509B2F38B122BFB0002077AFCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 64123455487a3622864303f891f89fe6951af38eab20ab5675baf7a165aee55b
MD5 b9575475fea0eb34b5eb8e040f3e3200
SHA1 fac3efa7d177112c6e925f03b110b52cb4104125
SHA512 1b030b0deebdabcaeb5ccdd68b46a52f52025b2fff818eba37d98150d79edbf532cefddbf5b44eb396986a017172140bfce7f6249e33fbdf2069d2e31dcc9a2a
SSDEEP 48:s6j4xIiupQ/sHBTfldeqn774QE5iqjYDEwEFeaIDbsRbXkMx86xQ4SVNdcOEZvpR:xj4xFuKeBTffeqWYgDusNXeDcbcqJ
TLSH
T154D1AC11B7D88B24F1764930AEF5A1EA8665BC824C05EE5F3518330E2872E95DBF172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 e3170e44d159d924bd7884c4e0fd6b590ffd93b0ce2c1eebd0d68606039f7df5
MD5 716a1b21d16beae0405cc08d35d137cd
SHA1 a013a0d39efd59a831edfe5194dd182af25109aa
SHA512 bf6664be664c1675b1038afe91d108a0d0f487f158cf6d0b183ab5ac5cf10836270c71687b69a220bd7ef8383bd2aa1cc9715edcedd4fde1735c7af50ac103f8
SSDEEP 96:q/cw3dCMNyLifW5laU4VfOrtlBARv7Li+XT7+uZt/Y0BnuOTITd47VGpR2b8jN:VwEMYOfGa4BA9LjXvZ1NnuH6i
TLSH
T1B7026736B7D5EAA4F1BF59B0DDF850E946367D815C01CE4F3128734E5C72A8496A032B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8
MD5 d6f787534eea52824abfef940379b071
SHA1 b200fb5e314de41c743ac84fc973584dee668946
SHA512 7ba2d3f0858a5aea61486ba8eb96fed621384258b5055e97a314d9cde71081545d881059d9bcd5bce4f5cb2d7cc341090d2cc419cac44302708b8bef17e4beca
SSDEEP 96:QyOzh59kjf3WSkEFRcpXyY3q0xPOQlf88GcNy1/HC3T6gYq2hwyvVATCG5qylmqG:o0f3woapXQXQ1HNogE3lJSZmXx7p
TLSH
T197427C56B7D9C919F1BA8E70EDF851D948B57C821D01CE1F3168B34E1872E84EBB072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 6KB
SHA256 8175f3000d31f9afadbbba3149b647da59b30712668751cd04216bbbbc9897ee
MD5 29f6df5957016e418fbd0f2407e3575e
SHA1 0ffdc37e214ad11658b1732a8448eab853713b6b
SHA512 e5916dfd44a4456d0f8c7f42b993426c1196059c053a46ac324104edc674944f622b43c7ecb652e1904dd11932d98b87216e7860f5ce193bcd8899162dcbcc8a
SSDEEP 96:K3P2tl44AX7cWfWOMnVj3yjNMGULTcRXqE18O8t746Efv3VfANNWuyfJ:Offn2j3ExULohRp6WqNWus
TLSH
T198E1865577D98A24F1765931AFF5B0EB82657CC24C42DB5F3208731E18B3A84D3A1B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 6040b942d0887f914a296e8ae0cc67300c479d4d0bb24bd07dde54ee142c4161
MD5 b9fc29f586c7a0abdb7f33a173bd4518
SHA1 8a6386314e2b0dac9e57874164e865a6a94a0ba9
SHA512 b44ea31a19c30c6b1fa4ee964284bc05e6d373d2c22a5012aec388465eb96b84a071804e49d2be577cf07ed24b535bd19e39c30b9a191a140f0c3875682cbfe3
SSDEEP 96:VF7RG+gmXfWAoeS1HOwthgmyDc8Vze8SWtpJO1:zXXfJozJg7Dc8ReBWlc
TLSH
T183B17B45F7F68A18F17B5D30ACF4A4F685B2BC826D01CA5F3248731D1872A94EBB071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 c3d6343c58e3d34ef38631cf5479dea4f7bcfa8a9ef1743ce2970758745e6001
MD5 e6f67f0d3fb3f8bbdac24b51f539a5c9
SHA1 a1e6cd835f5c17afb3121ba779a4c16d72528286
SHA512 43227b8ae94f7dfe73b217d34bc6c100d0f71eb3c4ed0f5ee3272ef52128a1f9346df3a36e36e3508198ef5825addcad5364c6f607f312032729c8a588f570a9
SSDEEP 48:+j5CyGz7ElZ6WyoG5KFMRURsyYTddWIDbXRbFKVMRGGLp7tVCCHr6mv7C:Y5RGz3WyER1YTuuXNFDLpxV3r6mvG
TLSH
T1D5916A59BBD58E24F27A9D35BDF460E746A6BC428C05DA5F3248331E0C72784E7B062B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1488-2123-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-3564-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-1197-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-2740-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-888-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-3116-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-373-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-1814-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-3975-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-4592-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-4901-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-5518-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-5929-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

memory/1488-6444-0x00007FF6D0560000-0x00007FF6D0610000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads