226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d

Analysis

max time kernel
149s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/09/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Size 449KB
Sample260928-llbs2a11ex
SHA256 226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d
MD5 84fa81714a68ecdb15382b4bb8e5e3fc
SHA1 d054cc355d0e5ae6464b36f2e91b2194e4f885d6
SHA512 e549522fd1e4d3aed5affe19f628eaa68a067942a1b55b18c6493190c4a9bba53ac61cf2d3bfa4a36ceb250e1e4dea0918979e78b35f1def628b381ab03848a4
SSDEEP 12288:MfcJ4bs4n7dm44vphIaa+tiBw2/RGygONkChW:MfcKI4dYcpU4wlLVv
TLSH
T172A44C13F7E201ECF4BBC670CABA923299737C505934EA1E1658CA252E71E119F38F65
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\E:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\G:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\Q:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\S:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\T:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\V:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\D:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\M:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\P:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\Z:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\I:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\K:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\L:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\O:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\R:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\U:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\W:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\X:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\F:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\H:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\J:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\N:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
\??\Y:\	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\INF\miradisp.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fsencryption.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_generic.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_volume.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\rdcameradriver.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_monitor.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_scmvolume.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_smrvolume.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\dc1-controller.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_apo.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_diskdrive.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_extension.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fshsm.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_linedisplay.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\rawsilo.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_swcomponent.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\eyegazeioctl.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\xusb22.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_i3c.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_mcx.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_smrdisk.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_nvmedisk.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_scmdisk.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_processor.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fssystem.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_ucm.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\remoteposdrv.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\oposdrv.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_camera.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_display.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fsreplication.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\wsdprint.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_primitive.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\ts_generic.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_firmware.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_media.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fsundelete.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_ramdisk.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_fscompression.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_sslaccel.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_proximity.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
File created	C:\Windows\INF\c_netdriver.PNF	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
3972	notepad.exe
4948	notepad.exe
2964	notepad.exe
5788	notepad.exe
5052	notepad.exe
2912	notepad.exe
1116	notepad.exe
2280	notepad.exe
3456	notepad.exe
5028	notepad.exe
1588	notepad.exe
4004	notepad.exe
4832	notepad.exe
300	notepad.exe
3252	notepad.exe
4384	notepad.exe
2092	notepad.exe
3000	notepad.exe
2168	notepad.exe
988	notepad.exe
6060	notepad.exe
4728	notepad.exe

Suspicious behavior: LoadsDriver 42 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 5784 wrote to memory of 4948	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	88
PID 5784 wrote to memory of 2168	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	89
PID 5784 wrote to memory of 2280	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	90
PID 5784 wrote to memory of 988	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	92
PID 5784 wrote to memory of 2964	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	93
PID 5784 wrote to memory of 4832	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	94
PID 5784 wrote to memory of 300	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	95
PID 5784 wrote to memory of 6060	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	96
PID 5784 wrote to memory of 3456	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	97
PID 5784 wrote to memory of 5788	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	98
PID 5784 wrote to memory of 3252	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	99
PID 5784 wrote to memory of 5028	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	100
PID 5784 wrote to memory of 4384	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	101
PID 5784 wrote to memory of 5052	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	102
PID 5784 wrote to memory of 2912	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	103
PID 5784 wrote to memory of 4728	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	104
PID 5784 wrote to memory of 2092	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	105
PID 5784 wrote to memory of 1588	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	106
PID 5784 wrote to memory of 3000	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	107
PID 5784 wrote to memory of 3972	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	108
PID 5784 wrote to memory of 1116	5784	226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe	109

C:\Users\Admin\AppData\Local\Temp\226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe
"C:\Users\Admin\AppData\Local\Temp\226811a56e53048463ab24c971e5bb8d8d85291470935e45b81be8b2e069fc9d.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:5784
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4948
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2168
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2280
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:988
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2964
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4832
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:300
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:6060
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3456
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5788
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3252
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5028
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4384
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5052
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2912
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4728
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2092
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1588
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3000
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3972
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1116
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
MD5 3f586f0da4b12a5eeb04ab03bc3a0831
SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
TLSH
T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 2fe23b4612eb3b134ecc98ff66ec700c25bcdb0586dc8e89fe0e22aac2c4c488
MD5 e6b4618e0cd2fbdb9ed1a5e58990d40a
SHA1 fbee2c5851c6c7bf7e19d280eafe607385c17ddd
SHA512 a9c7a17c03ec264bdc5b3e8f454eb661c056031b0450df56585ed0612a3e634c85ed0f197c7b3f8f6f9ebe89e6d1d7beebf92e2d65aab0ce430c9b0220e08b36
TLSH
T188D0A90052E80509B2F38B122BFB0002077AFCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 7d5ed5e3d24b2c4b35059361112caa01709332efda89302345765c6a04f54ec9
MD5 5edb51eea1eaf57d6fdd20fd525db455
SHA1 51c387a4c7db209e9ae6be1f55cc3a101b85e061
SHA512 102ed090abac8a57ab28a6483caa44b84ec23c6dd498217f7bd7d638954ed300ac70bc1f65a6125a09e11eb664d512348f4a5d9fb40ffe040d428e367cb5de9a
TLSH
T1A1D0A90052E80109B2F38B122BFB00020776FCD18630E54E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 e4e7cd339ce22f7db08ec18cd552318e07b770bf4b16060543323c939644a22a
MD5 9ca5ae9bf9638a4de211eb764e0b4e74
SHA1 262db9d803941ae65663797b0b5409326efcad34
SHA512 00dbe1d598b2482b8a6f2a6202aa6c4ba262baafca36dc62f2daef110b21cf5e7b31fe4fa5880621ee111515a59a3ec39883e40ad546cbeaf1865cd6b37a61a9
SSDEEP 96:oalWHRvQGW8J/9JVeqhYk3usNXe2c87hpXv3211Lh:dlcThSQiMb/32F
TLSH
T1EAD1C091B7D98B28F17A8D31ADF560EA85657C825C06CE5F3118330D2872A84E7F172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 a5da1472a6161a6a9fffc2815d00d6886f2d6bf2fb92da1acdf851d070d8c0fb
MD5 b41a65a9b33f70302c861da2a5225b5b
SHA1 d37ffd31b8e44993ea0d3664938642e193e7a0fc
SHA512 c1fb6285e485d8e303cd1bec242243a763823f9d19233e83f8ec005308002dd4c4b57df55c37f310aeaf932c478effd8a32b0bbd565fd28375547dd376a6a9ad
SSDEEP 96:tHj5XgRfWWzlH4VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdaU4Zvo3KRUmWR:0f5LEAqLjXvF1Nnujkvo3R
TLSH
T10D028825B7E58B24F2B65970DDF0A0DA45757CC21C81DA9F3628730E7C72F8496B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 da233c63a0a6b0311c191e9e8852d2bc45bbc2c22c8f577a4fa28165296f5bd4
MD5 e1874f241a1244cc0bd2849f3ceb26d7
SHA1 54536e7696d8d561f5fd7e2eb65d50ba2d40993e
SHA512 26e0a02e1fb1f03426bf986c699b6e536e3aedecbdefa2a88a0776c19b797a70a7c204b809e7c817098a41abbca69fe20a0ed43232a8621fb67cb705530e9094
SSDEEP 192:aTf31oagX35QwGNogEvxsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw4ExsCaX
TLSH
T118526413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 9KB
SHA256 a60007a587f1aedeae88d8ac3284eaba192f778ed284d703b6ffb56957585cea
MD5 ad741d9a74ef4dae1e82df1d0955b48f
SHA1 9372fa2609a9afa8e31d3b5a580f481f40804422
SHA512 9ddc51b72b15ded6db1bfc29b77b8b64980a9389ac91119b14c80d7d01ba7a7283ce468a5e89ab7f123b3120e66162951b293a674fc15d461263e3e36d4eb020
SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMxaPOiE18O8tR6Efv1Qc5M4+I8wuCXDH//FujVGBSSrM:J5fn2j3V+DZU6S5swu0Yv
TLSH
T1BA12DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 70eaa1e92e0a72bc44c6a210a7bbfecec69eaa615f3e502bf41c95e5df4c912f
MD5 96450bfb220933e189a90025827bdee4
SHA1 e17152b2b61d4b1de939336d9f41ae35064bfc8b
SHA512 382b010150c5e3379a6a1890d8bb694c0c520ee52f2f29cc3c1cb214f98c8e1a452df62de170440a8c65d832dddfeef98aa24bfffb6bfd66ab012543c63d237d
SSDEEP 96:toMRidfWASiSxqOwth0myDc8VzE8S0RupQ:efJSfG07Dc8REBVQ
TLSH
T110B16956B3E99A58F17B4E707DB890F641B1BC925C01CA5F3244731D1C71A88EBB071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 f96da3374c24c3ce1f98ffb8592521e55a41032f54c95d7b7019d7dbaecf8473
MD5 9dd0eec7c752bb1591bc2fb4ec33c02f
SHA1 4e460139b5a3feda7b9e6d383636792b9d3b2a82
SHA512 019a377658ffbc74f945b078a86b3b157e0612b42006d1414013a3cd0109c9c5495b05840cea1be398aa05bf02812fc55d07eb0d29873e7484adb5a085708669
SSDEEP 48:FQ9AgrNDt7/Wyki5m6MRu3owYWeaIDbsRbXcVMRTplqEEt45a/U:FQ93rht7/Wy3owY0usNXl3OKP
TLSH
T128A14445B7E88E24F27A9935BCF060E64266BC924C15DA5F3384730D5CB3794E7B071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5784-2081-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-2665-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-1172-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-1475-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-1756-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-588-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-2340-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-263-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-2924-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-3249-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-783-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-3508-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-3888-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

memory/5784-4092-0x00007FF738FA0000-0x00007FF739035000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads