8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Size 503KB
Sample260928-hypnwahd39
SHA256 8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb
MD5 1f8429fba973b5801b0f87a10facefdf
SHA1 6ab9c51fcae83d8681fd0b97cdc8d34f4aa619f6
SHA512 5471ab5ceaf6a677f11dff877f73cfa90826b537a895c1ac90d697a2fe58db8e478dc94ef02944aa9739f0eea106a8702952bdd4e2d53977b11ecc66aea8a950
SSDEEP 6144:tKZGbjlau/0fi/ToXN0XET34a5hpjSnTBUXIYuatgjfQxNAnFU0iP75G/:tK2n/0fi/TsNW0hUntUXLuQgyNku7Q
TLSH
T1EFB45D12E3E311ECE177D530DAB65632AA7278904934FF2E4594CA352F71E11AE38F26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\K:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\P:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\R:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\T:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\X:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\Y:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\D:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\E:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\H:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\M:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\N:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\O:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\F:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\G:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\I:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\Q:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\U:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\V:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\W:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\Z:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\J:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\L:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
\??\S:\	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_computeaccelerator.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fscompression.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\ts_generic.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\xusb22.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_firmware.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsencryption.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_i3c.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_mcx.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_apo.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fshsm.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\miradisp.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_processor.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_sslaccel.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\oposdrv.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_proximity.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_ramdisk.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\dc1-controller.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\remoteposdrv.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_ucm.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\rawsilo.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_diskdrive.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_primitive.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_media.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_display.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fssystem.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_linedisplay.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\wsdprint.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsreplication.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_netdriver.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_scmdisk.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_extension.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsundelete.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_volume.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\eyegazeioctl.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_scmvolume.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_smrdisk.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_camera.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_monitor.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_nvmedisk.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_generic.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_smrvolume.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\c_swcomponent.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
File created	C:\Windows\INF\rdcameradriver.PNF	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
5976	notepad.exe
3096	notepad.exe
2756	notepad.exe
1504	notepad.exe
4720	notepad.exe
4272	notepad.exe
720	notepad.exe
3960	notepad.exe
4656	notepad.exe
1260	notepad.exe
5836	notepad.exe
1632	notepad.exe
3052	notepad.exe
3912	notepad.exe
3740	notepad.exe
3928	notepad.exe
2932	notepad.exe
4820	notepad.exe
3328	notepad.exe
1444	notepad.exe
5748	notepad.exe
5840	notepad.exe

Suspicious behavior: LoadsDriver 42 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 5748	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	89
PID 2564 wrote to memory of 3052	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	90
PID 2564 wrote to memory of 3912	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	91
PID 2564 wrote to memory of 5840	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	93
PID 2564 wrote to memory of 4720	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	95
PID 2564 wrote to memory of 3740	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	96
PID 2564 wrote to memory of 4272	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	97
PID 2564 wrote to memory of 720	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	98
PID 2564 wrote to memory of 3928	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	99
PID 2564 wrote to memory of 5976	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	100
PID 2564 wrote to memory of 3960	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	101
PID 2564 wrote to memory of 3096	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	102
PID 2564 wrote to memory of 2932	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	103
PID 2564 wrote to memory of 4820	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	104
PID 2564 wrote to memory of 4656	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	105
PID 2564 wrote to memory of 3328	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	106
PID 2564 wrote to memory of 1444	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	107
PID 2564 wrote to memory of 2756	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	108
PID 2564 wrote to memory of 1504	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	109
PID 2564 wrote to memory of 1260	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	110
PID 2564 wrote to memory of 5836	2564	8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe	111

C:\Users\Admin\AppData\Local\Temp\8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe
"C:\Users\Admin\AppData\Local\Temp\8e869d8139654a682e9001ffa0fa0f82f6a572ea4ad081a5299a9bde604075bb.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5748
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3052
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3912
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5840
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4720
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3740
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4272
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:720
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3928
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5976
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3960
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3096
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2932
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4820
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4656
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3328
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1444
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2756
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1504
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1260
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5836
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 7d5ed5e3d24b2c4b35059361112caa01709332efda89302345765c6a04f54ec9
MD5 5edb51eea1eaf57d6fdd20fd525db455
SHA1 51c387a4c7db209e9ae6be1f55cc3a101b85e061
SHA512 102ed090abac8a57ab28a6483caa44b84ec23c6dd498217f7bd7d638954ed300ac70bc1f65a6125a09e11eb664d512348f4a5d9fb40ffe040d428e367cb5de9a
TLSH
T1A1D0A90052E80109B2F38B122BFB00020776FCD18630E54E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
MD5 3f586f0da4b12a5eeb04ab03bc3a0831
SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
TLSH
T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 6aa675739e4e154859956f5f651c918762772d0a3e5a6dde52092161fadba81b
MD5 477f7b54d0ac886d4fd5d69aea19c5e7
SHA1 2af466242a8732077c49d7fda657776f72fb3ab5
SHA512 1dfac1e219f2976c3926682f18dac46854ffcea0a444d17bb1fd74b0ff9117830ef9862599b517685116102499e0982f23a80f0f73b092822d1a48c46d74c061
TLSH
T1DCD0A90092E9010AB2F38B222BFB00020776FCD08530E14E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 2fe23b4612eb3b134ecc98ff66ec700c25bcdb0586dc8e89fe0e22aac2c4c488
MD5 e6b4618e0cd2fbdb9ed1a5e58990d40a
SHA1 fbee2c5851c6c7bf7e19d280eafe607385c17ddd
SHA512 a9c7a17c03ec264bdc5b3e8f454eb661c056031b0450df56585ed0612a3e634c85ed0f197c7b3f8f6f9ebe89e6d1d7beebf92e2d65aab0ce430c9b0220e08b36
TLSH
T188D0A90052E80509B2F38B122BFB0002077AFCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 73bfaac78c13812cca31ec86e943df632573cce8429d85475d25ea006f167aba
MD5 0fd20ab7e8bb7a91c7b62a827a8e1c0a
SHA1 ac55b99240faf3f7aacdcfeba01c077c5b8e12b4
SHA512 0195152a3645b25aef2473105d523be205838d44d479c62cdf90674f17e83777006828a7427f7c7b21f22819081e3a6632333b122f2a421e17271fb058216b74
SSDEEP 96:oalWHRvQGW8J/9J/WeqvY4YY7usNTAcU7hpXv3211Lh:dlcT/qkAmb/32F
TLSH
T133D1EF91B7D98B28F1BA8D31ADF560EE85657C825C06DE5F3118330D2872E84E7F172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 a5da1472a6161a6a9fffc2815d00d6886f2d6bf2fb92da1acdf851d070d8c0fb
MD5 b41a65a9b33f70302c861da2a5225b5b
SHA1 d37ffd31b8e44993ea0d3664938642e193e7a0fc
SHA512 c1fb6285e485d8e303cd1bec242243a763823f9d19233e83f8ec005308002dd4c4b57df55c37f310aeaf932c478effd8a32b0bbd565fd28375547dd376a6a9ad
SSDEEP 96:tHj5XgRfWWzlH4VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdaU4Zvo3KRUmWR:0f5LEAqLjXvF1Nnujkvo3R
TLSH
T10D028825B7E58B24F2B65970DDF0A0DA45757CC21C81DA9F3628730E7C72F8496B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 da233c63a0a6b0311c191e9e8852d2bc45bbc2c22c8f577a4fa28165296f5bd4
MD5 e1874f241a1244cc0bd2849f3ceb26d7
SHA1 54536e7696d8d561f5fd7e2eb65d50ba2d40993e
SHA512 26e0a02e1fb1f03426bf986c699b6e536e3aedecbdefa2a88a0776c19b797a70a7c204b809e7c817098a41abbca69fe20a0ed43232a8621fb67cb705530e9094
SSDEEP 192:aTf31oagX35QwGNogEvxsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw4ExsCaX
TLSH
T118526413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 9KB
SHA256 6a9b092cc89e9a400d81fbfa69f1eea90136468211b9310e1b80fbee39087ea4
MD5 138b20ba57ee8c43149509486dcc9f83
SHA1 ceedc3da1a5c1b346e6449096613cb3fee63ff5a
SHA512 1176b95183d388c290c6e71666bceb01abfd158b6e24e3b7ce8bfbcb3ad31836caf9b66b9d8244ff3f5500741bd04935503ecff6d1bd0ffd6669780a2644f583
SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5MN+I8wuCXDH//FujVGBSSrM:J5fn2j3V+cZU6S5rwu0Yv
TLSH
T17A12DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 70eaa1e92e0a72bc44c6a210a7bbfecec69eaa615f3e502bf41c95e5df4c912f
MD5 96450bfb220933e189a90025827bdee4
SHA1 e17152b2b61d4b1de939336d9f41ae35064bfc8b
SHA512 382b010150c5e3379a6a1890d8bb694c0c520ee52f2f29cc3c1cb214f98c8e1a452df62de170440a8c65d832dddfeef98aa24bfffb6bfd66ab012543c63d237d
SSDEEP 96:toMRidfWASiSxqOwth0myDc8VzE8S0RupQ:efJSfG07Dc8REBVQ
TLSH
T110B16956B3E99A58F17B4E707DB890F641B1BC925C01CA5F3244731D1C71A88EBB071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 25a8674b9849005336faf03723414c31a8512ea7c9cfa7c2e6148883996dc197
MD5 0ce35dbbac43cf19947738a83541c6dc
SHA1 23200dfe43bb326ae2754a80e3579da008800aac
SHA512 2454c234e81997e9f844ee7b70d3d52c39084ff7dbe0c6cc48f8babbe419831b39fbd313afa85447baa7ccc6ac6222fc13c2fe1dbeea03b2e388f7a1002e114f
SSDEEP 48:FQ9AgrNDt7/WyS3G5mdMRnYKTLY5kIDbJRbHcVMRTplqEEt45a/U:FQ93rht7/WyeALYiuJNHl3OKP
TLSH
T118A15445B7E88E24F27A9D35BCF060E64266BC924C15EA5F3284730E0C73794E7B171A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2564-941-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-1308-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-1599-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-1964-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-2329-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-2620-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-2985-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-3276-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-3641-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-652-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-4297-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-4588-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

memory/2564-215-0x00007FF68AEF0000-0x00007FF68AF93000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads