8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Size 503KB
Sample260928-hypnwahd39
SHA256 8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb
MD5 1f8429fba973b5801b0f87a10facefdf
SHA1 6ab9c51fcae83d8681fd0b97cdc8d34f4aa619f6
SHA512 5471ab5ceaf6a677f11dff877f73cfa90826b537a895c1ac90d697a2fe58db8e478dc94ef02944aa9739f0eea106a8702952bdd4e2d53977b11ecc66aea8a950
SSDEEP 6144:tKZGbjlau/0fi/ToXN0XET34a5hpjSnTBUXIYuatgjfQxNAnFU0iP75G/:tK2n/0fi/TsNW0hUntUXLuQgyNku7Q
TLSH
T1EFB45D12E3E311ECE177D530DAB65632AA7278904934FF2E4594CA352F71E11AE38F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\R:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\X:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\Z:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\Q:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\D:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\F:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\J:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\S:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\V:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\E:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\P:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\Y:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\H:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\I:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\K:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\N:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\O:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\T:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\U:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\W:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\G:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\L:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\M:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_apo.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_proximity.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_camera.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsreplication.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_scmdisk.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_ucm.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\dc1-controller.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_processor.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_netdriver.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\miradisp.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_extension.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\rawsilo.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\oposdrv.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\remoteposdrv.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\ts_generic.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_display.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_mcx.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\xusb22.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_media.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_holographic.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_smrvolume.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\wsdprint.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_diskdrive.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fscompression.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsundelete.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_monitor.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_smrdisk.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_volume.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\rdcameradriver.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_swcomponent.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_firmware.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsencryption.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_linedisplay.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_scmvolume.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fshsm.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_sslaccel.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fssystem.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe

Opens file in notepad (likely ransom note) 19 IoCs

ransomware

pid	Process
3076	notepad.exe
4688	notepad.exe
3212	notepad.exe
3836	notepad.exe
1072	notepad.exe
3800	notepad.exe
3500	notepad.exe
3980	notepad.exe
2112	notepad.exe
4756	notepad.exe
1304	notepad.exe
3968	notepad.exe
1604	notepad.exe
3700	notepad.exe
2772	notepad.exe
2596	notepad.exe
4624	notepad.exe
3772	notepad.exe
5020	notepad.exe

Suspicious behavior: LoadsDriver 38 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3076	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	96
PID 1524 wrote to memory of 3212	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	98
PID 1524 wrote to memory of 3836	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	99
PID 1524 wrote to memory of 2772	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	101
PID 1524 wrote to memory of 1072	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	105
PID 1524 wrote to memory of 2596	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	109
PID 1524 wrote to memory of 3800	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	110
PID 1524 wrote to memory of 3980	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	111
PID 1524 wrote to memory of 2112	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	112
PID 1524 wrote to memory of 4756	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	113
PID 1524 wrote to memory of 1304	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	114
PID 1524 wrote to memory of 3968	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	117
PID 1524 wrote to memory of 1604	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	118
PID 1524 wrote to memory of 3700	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	119
PID 1524 wrote to memory of 4688	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	120
PID 1524 wrote to memory of 4624	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	121
PID 1524 wrote to memory of 3772	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	123
PID 1524 wrote to memory of 5020	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	124
PID 1524 wrote to memory of 3500	1524	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	125

C:\Users\Admin\AppData\Local\Temp\8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
"C:\Users\Admin\AppData\Local\Temp\8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3076
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3212
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3836
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2772
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1072
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2596
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3800
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3980
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2112
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4756
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1304
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3968
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1604
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3700
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4688
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4624
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3772
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5020
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:1740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 f85bb03872760784ce54441d77023253646522aedc15d2860c3dbd3ddd0e8cfc
MD5 d5b6aa4d70c2673ebc87e2bc69e66312
SHA1 27e127ff993c7eb92274d0139b6fa3ad306ba130
SHA512 b5d99fb245e8d02266318281f3bdafdc91423109d0f0c3d47ce36611a377b93463e2421d237c04d58bb1d7da132c1de0118219d22c98dd918a641276ab8d7148
TLSH
T14AD0A90052E80109B2F38B122BFB00020776FCD08930E18E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 2fe23b4612eb3b134ecc98ff66ec700c25bcdb0586dc8e89fe0e22aac2c4c488
MD5 e6b4618e0cd2fbdb9ed1a5e58990d40a
SHA1 fbee2c5851c6c7bf7e19d280eafe607385c17ddd
SHA512 a9c7a17c03ec264bdc5b3e8f454eb661c056031b0450df56585ed0612a3e634c85ed0f197c7b3f8f6f9ebe89e6d1d7beebf92e2d65aab0ce430c9b0220e08b36
TLSH
T188D0A90052E80509B2F38B122BFB0002077AFCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
MD5 3f586f0da4b12a5eeb04ab03bc3a0831
SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
TLSH
T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 0f0833a24954ed761ec32fbbe779895ce8d732bce89dd0e9742b9fcf496edc00
MD5 64ba20bc368dd34db33e5a168cf975ed
SHA1 9d81494c95d37670cec5a9eda130e4d1cdfc092a
SHA512 96ba23017677ef14d81efc1e5beac4b03b65dd5d619ddfa21c617501966c8dfe09d82a24125efb79ca8ef73059717b8d1253b171174052cb6b7daceb4a8fa827
SSDEEP 48:s6j4xIiupQ/sHBTflU/Weqn774QE5iqjYDEwEFeaIDbsRbXkMx86xQ4SVNdcOEZT:xj4xFuKeBTfW/WeqWYgDusNXeDcbcqJ
TLSH
T13FD1AC11B7D88B24F1764930AEF5A1EA8665BC824C05EE5F3518330E2872E95DBF172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 84b7eead4e0e5f9e94ae364252d4f163287d8b2a2d336c54c19a3f24f003e153
MD5 14bfb153ad442006020f34f30021a565
SHA1 0b939a9d17d96f33dc4a9ed5aa024ad685fe0d00
SHA512 57ee54e9a2fe4dbdabe7ae196255312b277498293f82cc56ae74b965a0ddd274b5f87862de6c0d147a602114aede54dc5cdf968fae491621da3908e18935eab5
SSDEEP 96:q/cw3dCMNyLifWdlSM+FnROrtvaR+RRLK+58+uV6WYIBETIS8w7VGpR2b8jN:VwEMYOfKSGaQHLKbVLRF6i
TLSH
T16D026636B7D5EAA4F1BF59B0EDF850E946767D811C01CE4F3128734E1C72A8496A072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8
MD5 d6f787534eea52824abfef940379b071
SHA1 b200fb5e314de41c743ac84fc973584dee668946
SHA512 7ba2d3f0858a5aea61486ba8eb96fed621384258b5055e97a314d9cde71081545d881059d9bcd5bce4f5cb2d7cc341090d2cc419cac44302708b8bef17e4beca
SSDEEP 96:QyOzh59kjf3WSkEFRcpXyY3q0xPOQlf88GcNy1/HC3T6gYq2hwyvVATCG5qylmqG:o0f3woapXQXQ1HNogE3lJSZmXx7p
TLSH
T197427C56B7D9C919F1BA8E70EDF851D948B57C821D01CE1F3168B34E1872E84EBB072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 6KB
SHA256 455c0225ea8ade38609986abee022c9affe6f4e507400812dd15781612b8f371
MD5 9c8778e089c781c293884322f8bdfd0d
SHA1 c18c0ef7d985abe6da1f78491d12da9ed276bdcd
SHA512 41bb14fd5df81aae4f8f4594c21df5f34886077d708ef15e869c4a2e00d3178bcd01502ae14822322cf358f2166fd5c01fd001fe0105e9b9841bb2cf8460efa8
SSDEEP 96:K3P2tl44AX7cWfWOMZV63iMGUmTvMXqE18O8t746Efv3VfANNWuyfJ:Offnk63ixUmruRp6WqNWus
TLSH
T18BE1971177DA8A24F1765930AFF5B0EB82657CC21C42DB5F3208731E18B3A84D3A1B2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 6040b942d0887f914a296e8ae0cc67300c479d4d0bb24bd07dde54ee142c4161
MD5 b9fc29f586c7a0abdb7f33a173bd4518
SHA1 8a6386314e2b0dac9e57874164e865a6a94a0ba9
SHA512 b44ea31a19c30c6b1fa4ee964284bc05e6d373d2c22a5012aec388465eb96b84a071804e49d2be577cf07ed24b535bd19e39c30b9a191a140f0c3875682cbfe3
SSDEEP 96:VF7RG+gmXfWAoeS1HOwthgmyDc8Vze8SWtpJO1:zXXfJozJg7Dc8ReBWlc
TLSH
T183B17B45F7F68A18F17B5D30ACF4A4F685B2BC826D01CA5F3248731D1872A94EBB071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 f917295c162dc216cf438280a4931e668ce74bb38b92290be5b91cbe071380b1
MD5 7f68e961007f096d2b7a62ffa3aaa296
SHA1 93b6fed422ff7a0e3c1ebf1730d812c7e67d00c3
SHA512 99020d29e99b6f888b41f0f1d6927602e1afbb4f708eda103ba894b6b032b386124e320db9cc13ea2438407c6bcadb56ccec43ca14a7e0ed14f9441053541bd4
SSDEEP 48:+j5CyGz7ElZd/WyGl5KgMRjsYKrbIDbJRb6KVMRGGLp7tVCCHr6mv7C:Y5RGzY/WyhsY6uJN6DLpxV3r6mvG
TLSH
T1BF9179567BD58E24F27A9D35BDF460E746A6BC428C06DA5F3244330D0C72784E7B062B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1524-834-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-2511-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-1253-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-274-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-1603-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-1882-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-2190-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-624-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-2860-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-3140-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-3490-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-3769-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-4119-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

memory/1524-4189-0x00007FF7788C0000-0x00007FF778963000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads