bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816

Analysis

max time kernel
149s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/09/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Size 557KB
Sample260919-snytxasdnd
SHA256 bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816
MD5 8489fb9bcdf17b48895aee0acf3ae2ae
SHA1 e43cfb115fc54f4d0609c3143e52df945babcc52
SHA512 99557211214423c1e50162fbea60eca07534d7fb6a28e5bf2a3534479aab1c19030b0786cda2dc921e8e186366886d48c0939eedc12ef619eeafdbe98563cd82
SSDEEP 12288:yBrK643BsHfwZXr5a95ujyPAQYiE2LaAe0gO1VcGarHDF:8rmK/wZX1a+yHA2Lle0gOItF
TLSH
T16FC44B03F7E321FCE1B7D5309AB75632B972785019346E3E4190DA362E71E51AA38F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

ransomware

Malware Config

Signatures

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_media.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_proximity.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_ucm.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\miradisp.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fscompression.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\rdcameradriver.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_generic.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_mcx.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\dc1-controller.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\eyegazeioctl.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_camera.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fshsm.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_monitor.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_netdriver.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\xusb22.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_nvmedisk.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_ramdisk.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_firmware.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_scmvolume.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\rawsilo.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\wsdprint.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsreplication.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_diskdrive.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_scmdisk.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\oposdrv.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsundelete.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_volume.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_apo.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fssystem.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_smrvolume.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_processor.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_primitive.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_display.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsencryption.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_i3c.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_swcomponent.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_sslaccel.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_smrdisk.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\ts_generic.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_extension.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_linedisplay.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
File created	C:\Windows\INF\remoteposdrv.PNF	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
5608	notepad.exe
3844	notepad.exe
1512	notepad.exe
4768	notepad.exe
4444	notepad.exe
1336	notepad.exe
2432	notepad.exe
1132	notepad.exe
3348	notepad.exe
4836	notepad.exe
3708	notepad.exe
3376	notepad.exe
936	notepad.exe
2908	notepad.exe
5832	notepad.exe
2704	notepad.exe
4484	notepad.exe
2072	notepad.exe
4228	notepad.exe
3716	notepad.exe
1224	notepad.exe
4572	notepad.exe

Suspicious behavior: LoadsDriver 42 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4264 wrote to memory of 4836	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	89
PID 4264 wrote to memory of 3844	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	90
PID 4264 wrote to memory of 3708	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	91
PID 4264 wrote to memory of 4484	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	93
PID 4264 wrote to memory of 2072	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	94
PID 4264 wrote to memory of 1512	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	95
PID 4264 wrote to memory of 1336	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	96
PID 4264 wrote to memory of 4768	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	97
PID 4264 wrote to memory of 3376	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	98
PID 4264 wrote to memory of 936	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	99
PID 4264 wrote to memory of 4228	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	100
PID 4264 wrote to memory of 3716	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	101
PID 4264 wrote to memory of 2908	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	102
PID 4264 wrote to memory of 3348	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	103
PID 4264 wrote to memory of 2432	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	104
PID 4264 wrote to memory of 1224	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	105
PID 4264 wrote to memory of 4572	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	106
PID 4264 wrote to memory of 1132	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	107
PID 4264 wrote to memory of 5832	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	108
PID 4264 wrote to memory of 2704	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	109
PID 4264 wrote to memory of 5608	4264	bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe	110

C:\Users\Admin\AppData\Local\Temp\bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe
"C:\Users\Admin\AppData\Local\Temp\bc1161b34d0e08c5da451f9f94cd0f6a50a22b33a7954c9f3b94e17d71d56816.exe"
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:4264
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4836
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3844
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3708
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4484
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2072
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1512
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1336
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4768
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3376
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:936
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4228
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3716
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2908
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3348
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2432
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1224
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4572
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1132
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5832
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2704
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5608
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
MD5 3f586f0da4b12a5eeb04ab03bc3a0831
SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
TLSH
T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 f85bb03872760784ce54441d77023253646522aedc15d2860c3dbd3ddd0e8cfc
MD5 d5b6aa4d70c2673ebc87e2bc69e66312
SHA1 27e127ff993c7eb92274d0139b6fa3ad306ba130
SHA512 b5d99fb245e8d02266318281f3bdafdc91423109d0f0c3d47ce36611a377b93463e2421d237c04d58bb1d7da132c1de0118219d22c98dd918a641276ab8d7148
TLSH
T14AD0A90052E80109B2F38B122BFB00020776FCD08930E18E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 9cbc84b8e872d90b5fde0693806e567ae993ce21bbe73d25b9380fd851a9407f
MD5 85630bdb16302d5ca2b6433a801ca1ed
SHA1 f085176b200e99152d898d2c2d23809c61874a70
SHA512 fd4cfe1157358373b6524285415873d053a9ca7ceb53d572b22c2334366ff73a73ec3cb41e4ea277a92695cb555b9743ac72a84b00f2136866c75930904ee4da
SSDEEP 96:oalWHRvQGW8J/9J/WeqsYtDusNXe2c87hpXv3211Lh:dlcT/qZniMb/32F
TLSH
T114D1B095B7D98B28F1BA8D31ADF560EE85657C825C02CE5F3118330D2872E84E7F172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 a5da1472a6161a6a9fffc2815d00d6886f2d6bf2fb92da1acdf851d070d8c0fb
MD5 b41a65a9b33f70302c861da2a5225b5b
SHA1 d37ffd31b8e44993ea0d3664938642e193e7a0fc
SHA512 c1fb6285e485d8e303cd1bec242243a763823f9d19233e83f8ec005308002dd4c4b57df55c37f310aeaf932c478effd8a32b0bbd565fd28375547dd376a6a9ad
SSDEEP 96:tHj5XgRfWWzlH4VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdaU4Zvo3KRUmWR:0f5LEAqLjXvF1Nnujkvo3R
TLSH
T10D028825B7E58B24F2B65970DDF0A0DA45757CC21C81DA9F3628730E7C72F8496B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 da233c63a0a6b0311c191e9e8852d2bc45bbc2c22c8f577a4fa28165296f5bd4
MD5 e1874f241a1244cc0bd2849f3ceb26d7
SHA1 54536e7696d8d561f5fd7e2eb65d50ba2d40993e
SHA512 26e0a02e1fb1f03426bf986c699b6e536e3aedecbdefa2a88a0776c19b797a70a7c204b809e7c817098a41abbca69fe20a0ed43232a8621fb67cb705530e9094
SSDEEP 192:aTf31oagX35QwGNogEvxsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw4ExsCaX
TLSH
T118526413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 9KB
SHA256 57f16a3a27f67eede7638347df700fe7227aa03813a1da934c7964b9a1b69a07
MD5 2a85bd5534739a7d28db4bb8ebab4816
SHA1 e093204bc54d2b706bf4fb7e3c2729159bb6a4b3
SHA512 61d9cb837b5654f87f7174141c36c222c465d83c36ad833e22422cd5ccbbae38d265657bd361968349606c412f77b620509a0904fd49e7b5a66b1d3c08d6f70b
SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5M4+I8wuCXDH//FujVGBSSrM:J5fn2j3V+cZU6S5swu0Yv
TLSH
T15212DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 70eaa1e92e0a72bc44c6a210a7bbfecec69eaa615f3e502bf41c95e5df4c912f
MD5 96450bfb220933e189a90025827bdee4
SHA1 e17152b2b61d4b1de939336d9f41ae35064bfc8b
SHA512 382b010150c5e3379a6a1890d8bb694c0c520ee52f2f29cc3c1cb214f98c8e1a452df62de170440a8c65d832dddfeef98aa24bfffb6bfd66ab012543c63d237d
SSDEEP 96:toMRidfWASiSxqOwth0myDc8VzE8S0RupQ:efJSfG07Dc8REBVQ
TLSH
T110B16956B3E99A58F17B4E707DB890F641B1BC925C01CA5F3244731D1C71A88EBB071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 2572bae650db8c49d13358ad203087e533be91b0e9f5e1d75934093878548f18
MD5 a3a32ac7f01b59222d9e8e7bb4f3d266
SHA1 1e5258dca658c320d4d78ab6b40286499603bd60
SHA512 9d11767f5a9077f0987a5c1761713c8e2124258e8430b3bdc49d799c2d7515f278d941f2430e95115644b4fb0117dd965835f91162ff1ef051d46eb50bb49fa2
SSDEEP 48:FQ9AgrNDtUWyof5mVMRUVoKmYnddWIDbXRb0cVMRTplqEEt45a/U:FQ93rhtUWyPVoKmYnuuXN0l3OKP
TLSH
T1D7A13455B7E88E24F27A9935BCF060E64176BC524C15DA5F3284730E1C73794E7B061A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4264-871-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-2620-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-287-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-1308-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-1599-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-1964-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-2329-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-652-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-2985-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-3276-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-3641-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-3932-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-4297-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

memory/4264-4588-0x00007FF785480000-0x00007FF785530000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads