a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Size 459KB
Sample260928-jprybahe92
SHA256 a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0
MD5 34fe44cf39ab425df7ca271be0252177
SHA1 07731c2d73933f56c1df94ea15fe7f3e809bc139
SHA512 75efb6150a0cc3303c5d73c855382a49fd01e37f8851672620896058626b4758c351b81b8f9f6165a48d95ea52c330e323abb45dbf816f1d3d6c149eda57c5b0
SSDEEP 12288:8BDgkC7tqu2F+m5bqURyCfg9gKNk8LuD:8BDkt++sR5x8i
TLSH
T172A44C13E7D201ECE4BBC6308ABA9232A9737C505934EA1E555CCA252E71E119F3CF66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\G:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\J:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\N:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\O:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\P:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\R:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\U:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\Q:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\T:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\V:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\E:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\K:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\M:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\W:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\X:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\D:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\F:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\H:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\I:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\L:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\S:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\Y:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
\??\Z:\	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_diskdrive.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fsundelete.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_processor.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fscompression.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_mcx.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_primitive.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_sslaccel.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\miradisp.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\wsdprint.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_media.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_monitor.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_netdriver.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_ramdisk.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_smrdisk.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_volume.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_apo.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_scmvolume.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_linedisplay.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_ucm.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fsreplication.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_camera.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_scmdisk.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_generic.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_extension.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fsencryption.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_i3c.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_nvmedisk.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_smrvolume.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\dc1-controller.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_firmware.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\remoteposdrv.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_proximity.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\rawsilo.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\eyegazeioctl.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fssystem.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\oposdrv.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\xusb22.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_display.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\ts_generic.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_fshsm.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\c_swcomponent.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
File created	C:\Windows\INF\rdcameradriver.PNF	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
3620	notepad.exe
2472	notepad.exe
492	notepad.exe
6104	notepad.exe
4676	notepad.exe
3740	notepad.exe
1372	notepad.exe
4716	notepad.exe
2408	notepad.exe
5836	notepad.exe
3500	notepad.exe
2804	notepad.exe
3156	notepad.exe
4940	notepad.exe
1844	notepad.exe
5112	notepad.exe
4252	notepad.exe
5404	notepad.exe
3364	notepad.exe
3596	notepad.exe
1108	notepad.exe
5544	notepad.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe

Suspicious behavior: LoadsDriver 44 IoCs

pid	Process
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found
828	Process not Found

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 5404	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	89
PID 2888 wrote to memory of 3620	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	90
PID 2888 wrote to memory of 3156	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	91
PID 2888 wrote to memory of 2408	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	93
PID 2888 wrote to memory of 3364	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	94
PID 2888 wrote to memory of 3596	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	95
PID 2888 wrote to memory of 2472	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	96
PID 2888 wrote to memory of 492	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	97
PID 2888 wrote to memory of 6104	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	98
PID 2888 wrote to memory of 5836	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	99
PID 2888 wrote to memory of 3500	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	100
PID 2888 wrote to memory of 4676	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	101
PID 2888 wrote to memory of 4940	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	102
PID 2888 wrote to memory of 3740	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	103
PID 2888 wrote to memory of 1108	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	104
PID 2888 wrote to memory of 1844	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	105
PID 2888 wrote to memory of 1372	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	106
PID 2888 wrote to memory of 2804	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	107
PID 2888 wrote to memory of 4716	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	108
PID 2888 wrote to memory of 5112	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	109
PID 2888 wrote to memory of 4252	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	110
PID 2888 wrote to memory of 5544	2888	a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe	111

C:\Users\Admin\AppData\Local\Temp\a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe
"C:\Users\Admin\AppData\Local\Temp\a43af432284181a0da583ccdd81a7b949ae06d521f092a8ea2e40f5f7283c8e0.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5404
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3620
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3156
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2408
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3364
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3596
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2472
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:492
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6104
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5836
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3500
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4676
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4940
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3740
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1108
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1844
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1372
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2804
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4716
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5112
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4252
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
MD5 3f586f0da4b12a5eeb04ab03bc3a0831
SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
TLSH
T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 f85bb03872760784ce54441d77023253646522aedc15d2860c3dbd3ddd0e8cfc
MD5 d5b6aa4d70c2673ebc87e2bc69e66312
SHA1 27e127ff993c7eb92274d0139b6fa3ad306ba130
SHA512 b5d99fb245e8d02266318281f3bdafdc91423109d0f0c3d47ce36611a377b93463e2421d237c04d58bb1d7da132c1de0118219d22c98dd918a641276ab8d7148
TLSH
T14AD0A90052E80109B2F38B122BFB00020776FCD08930E18E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 9cbc84b8e872d90b5fde0693806e567ae993ce21bbe73d25b9380fd851a9407f
MD5 85630bdb16302d5ca2b6433a801ca1ed
SHA1 f085176b200e99152d898d2c2d23809c61874a70
SHA512 fd4cfe1157358373b6524285415873d053a9ca7ceb53d572b22c2334366ff73a73ec3cb41e4ea277a92695cb555b9743ac72a84b00f2136866c75930904ee4da
SSDEEP 96:oalWHRvQGW8J/9J/WeqsYtDusNXe2c87hpXv3211Lh:dlcT/qZniMb/32F
TLSH
T114D1B095B7D98B28F1BA8D31ADF560EE85657C825C02CE5F3118330D2872E84E7F172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 a5da1472a6161a6a9fffc2815d00d6886f2d6bf2fb92da1acdf851d070d8c0fb
MD5 b41a65a9b33f70302c861da2a5225b5b
SHA1 d37ffd31b8e44993ea0d3664938642e193e7a0fc
SHA512 c1fb6285e485d8e303cd1bec242243a763823f9d19233e83f8ec005308002dd4c4b57df55c37f310aeaf932c478effd8a32b0bbd565fd28375547dd376a6a9ad
SSDEEP 96:tHj5XgRfWWzlH4VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdaU4Zvo3KRUmWR:0f5LEAqLjXvF1Nnujkvo3R
TLSH
T10D028825B7E58B24F2B65970DDF0A0DA45757CC21C81DA9F3628730E7C72F8496B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 da233c63a0a6b0311c191e9e8852d2bc45bbc2c22c8f577a4fa28165296f5bd4
MD5 e1874f241a1244cc0bd2849f3ceb26d7
SHA1 54536e7696d8d561f5fd7e2eb65d50ba2d40993e
SHA512 26e0a02e1fb1f03426bf986c699b6e536e3aedecbdefa2a88a0776c19b797a70a7c204b809e7c817098a41abbca69fe20a0ed43232a8621fb67cb705530e9094
SSDEEP 192:aTf31oagX35QwGNogEvxsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw4ExsCaX
TLSH
T118526413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 9KB
SHA256 57f16a3a27f67eede7638347df700fe7227aa03813a1da934c7964b9a1b69a07
MD5 2a85bd5534739a7d28db4bb8ebab4816
SHA1 e093204bc54d2b706bf4fb7e3c2729159bb6a4b3
SHA512 61d9cb837b5654f87f7174141c36c222c465d83c36ad833e22422cd5ccbbae38d265657bd361968349606c412f77b620509a0904fd49e7b5a66b1d3c08d6f70b
SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5M4+I8wuCXDH//FujVGBSSrM:J5fn2j3V+cZU6S5swu0Yv
TLSH
T15212DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 70eaa1e92e0a72bc44c6a210a7bbfecec69eaa615f3e502bf41c95e5df4c912f
MD5 96450bfb220933e189a90025827bdee4
SHA1 e17152b2b61d4b1de939336d9f41ae35064bfc8b
SHA512 382b010150c5e3379a6a1890d8bb694c0c520ee52f2f29cc3c1cb214f98c8e1a452df62de170440a8c65d832dddfeef98aa24bfffb6bfd66ab012543c63d237d
SSDEEP 96:toMRidfWASiSxqOwth0myDc8VzE8S0RupQ:efJSfG07Dc8REBVQ
TLSH
T110B16956B3E99A58F17B4E707DB890F641B1BC925C01CA5F3244731D1C71A88EBB071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 bc2886a9d0428dbc00dc0b422b556e4b190662a5a3ee63a78217f884897b8c30
MD5 68be020e242f2c9f91b710191e85e06c
SHA1 630e2f30d8fd440b551e495d2623d8418926dce9
SHA512 2310ce8edcc51b4e85f2b4996ae05e269e5e6762f10a4a28f01c023a8f9a39e119363cb22233eba65ba7e75eb7b1a5ee8ba5dbf7b09e0d97ae27be8819fc76a9
SSDEEP 48:FQ9AgrNDt4yS3G5mdMRnYKTLY5kIDbJRbHcVMRTplqEEt45a/U:FQ93rht4yeALYiuJNHl3OKP
TLSH
T159A14345B7E88E24F27A9D35BCF060E64266BC924C15EA5F3284730E0C73698E7B161A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2888-835-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-2305-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-197-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-1155-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-1475-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-1730-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-2050-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-580-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-2625-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-2880-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-3200-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-3455-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-3785-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

memory/2888-4030-0x00007FF66E190000-0x00007FF66E227000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads