Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe
- Size 452KB
- Sample260928-llnslaaa95
- SHA256 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b
- MD5 ac4af84c941573bb92881b161d3954d2
- SHA1 33532915311767a1ac34a3e20926edde62f04145
- SHA512 c78a400aa32ac312e9825ef651c933adafa21f3a4890c1be150b8401f6770a2249f2c12277d7af3a01dccb68fcaddd6f51732a1009ebbe94f485ffbb514eb9d9
- SSDEEP 6144:rqUo4jycc6HBg2PZc35P2fhcRXb0XsfJUQiLixNAnFU0iScZrCl:rqUH2cBBVxciiZJNkXc4
- TLSH T148A45B02F7D101ECF4B6C5345B7B9132A9737C510E70E59F429CAD292EA2E819E38F5A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\D:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\H:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\L:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\M:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\Q:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\F:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\G:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\I:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\K:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\N:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\O:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\S:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\U:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\E:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\R:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\V:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\W:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\Z:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\J:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\P:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\T:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\X:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe \??\Y:\ 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe - Drops file in Windows directory 61 IoCs
description ioc Process File created C:\Windows\INF\miradisp.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_processor.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_sslaccel.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\eyegazeioctl.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_receiptprinter.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\rawsilo.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_extension.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fshsm.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fsinfrastructure.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fssystemrecovery.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fsvirtualization.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_netdriver.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_computeaccelerator.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fsundelete.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_i3c.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_smrdisk.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_display.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_ramdisk.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_barcodescanner.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fsantivirus.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fscompression.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_ucm.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\remoteposdrv.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\ts_generic.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_diskdrive.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fsquotamgmt.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_linedisplay.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\dc1-controller.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_proximity.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_primitive.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fsreplication.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_generic.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_magneticstripereader.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_mcx.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_scmdisk.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_scmvolume.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\oposdrv.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fscontentscreener.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_cashdrawer.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\rdcameradriver.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\wsdprint.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_media.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_firmware.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\digitalmediadevice.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\xusb22.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_camera.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fsencryption.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_volume.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fscopyprotection.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fssystem.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_nvmedisk.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_smrvolume.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_swcomponent.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_apo.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe File created C:\Windows\INF\c_monitor.PNF 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe - Checks SCSI registry key(s) 3 TTPs 28 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe - Opens file in notepad (likely ransom note) 22 IoCs
pid Process 6136 notepad.exe 2144 notepad.exe 568 notepad.exe 3332 notepad.exe 2640 notepad.exe 4764 notepad.exe 2580 notepad.exe 1952 notepad.exe 4580 notepad.exe 4668 notepad.exe 4284 notepad.exe 3008 notepad.exe 4640 notepad.exe 4928 notepad.exe 2868 notepad.exe 3472 notepad.exe 1992 notepad.exe 5512 notepad.exe 4420 notepad.exe 4700 notepad.exe 1136 notepad.exe 4988 notepad.exe - Suspicious behavior: LoadsDriver 44 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 2248 wrote to memory of 568 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 89 PID 2248 wrote to memory of 4928 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 90 PID 2248 wrote to memory of 2868 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 91 PID 2248 wrote to memory of 4700 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 93 PID 2248 wrote to memory of 3472 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 94 PID 2248 wrote to memory of 1136 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 95 PID 2248 wrote to memory of 1992 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 96 PID 2248 wrote to memory of 5512 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 97 PID 2248 wrote to memory of 3332 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 98 PID 2248 wrote to memory of 4420 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 99 PID 2248 wrote to memory of 2144 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 100 PID 2248 wrote to memory of 4988 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 101 PID 2248 wrote to memory of 4640 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 102 PID 2248 wrote to memory of 4580 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 103 PID 2248 wrote to memory of 4668 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 104 PID 2248 wrote to memory of 2640 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 105 PID 2248 wrote to memory of 4284 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 106 PID 2248 wrote to memory of 6136 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 107 PID 2248 wrote to memory of 4764 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 108 PID 2248 wrote to memory of 2580 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 109 PID 2248 wrote to memory of 3008 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 110 PID 2248 wrote to memory of 1952 2248 451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe"C:\Users\Admin\AppData\Local\Temp\451bb8d448eba9dce4fa258758498708b27982fab83c36da8255a56c41b6005b.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:568
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4928
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2868
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4700
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:3472
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:1136
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:1992
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:5512
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:3332
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4420
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2144
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4988
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4640
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4580
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4668
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2640
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4284
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:6136
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4764
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2580
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:3008
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:1952
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
- Size 242B
- SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
- MD5 3f586f0da4b12a5eeb04ab03bc3a0831
- SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
- SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
- TLSH T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
- Size 242B
- SHA256 f85bb03872760784ce54441d77023253646522aedc15d2860c3dbd3ddd0e8cfc
- MD5 d5b6aa4d70c2673ebc87e2bc69e66312
- SHA1 27e127ff993c7eb92274d0139b6fa3ad306ba130
- SHA512 b5d99fb245e8d02266318281f3bdafdc91423109d0f0c3d47ce36611a377b93463e2421d237c04d58bb1d7da132c1de0118219d22c98dd918a641276ab8d7148
- TLSH T14AD0A90052E80109B2F38B122BFB00020776FCD08930E18E31C0A21D0AB1F8488B1333
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\INF\c_diskdrive.PNF
- Size 6KB
- SHA256 9cbc84b8e872d90b5fde0693806e567ae993ce21bbe73d25b9380fd851a9407f
- MD5 85630bdb16302d5ca2b6433a801ca1ed
- SHA1 f085176b200e99152d898d2c2d23809c61874a70
- SHA512 fd4cfe1157358373b6524285415873d053a9ca7ceb53d572b22c2334366ff73a73ec3cb41e4ea277a92695cb555b9743ac72a84b00f2136866c75930904ee4da
- SSDEEP 96:oalWHRvQGW8J/9J/WeqsYtDusNXe2c87hpXv3211Lh:dlcT/qZniMb/32F
- TLSH T114D1B095B7D98B28F1BA8D31ADF560EE85657C825C02CE5F3118330D2872E84E7F172A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_display.PNF
- Size 8KB
- SHA256 a5da1472a6161a6a9fffc2815d00d6886f2d6bf2fb92da1acdf851d070d8c0fb
- MD5 b41a65a9b33f70302c861da2a5225b5b
- SHA1 d37ffd31b8e44993ea0d3664938642e193e7a0fc
- SHA512 c1fb6285e485d8e303cd1bec242243a763823f9d19233e83f8ec005308002dd4c4b57df55c37f310aeaf932c478effd8a32b0bbd565fd28375547dd376a6a9ad
- SSDEEP 96:tHj5XgRfWWzlH4VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdaU4Zvo3KRUmWR:0f5LEAqLjXvF1Nnujkvo3R
- TLSH T10D028825B7E58B24F2B65970DDF0A0DA45757CC21C81DA9F3628730E7C72F8496B0B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_media.PNF
- Size 12KB
- SHA256 2b56b4ad0a5c4dc6ff86575232702aa42ac47f03498b3380b62853b948b3eb7f
- MD5 0717f3dce0039088eca69d41fd983f64
- SHA1 d7bc8343c9d53687add0e17c175fba188956b9d8
- SHA512 ff4cec88cb4d3bc1d07adadc08a4cf62b14c297dab6785f413618c416fab466e161055d7594a5fbcfd9dae871763eb0afeb5cf48fc1f887f12e306e065af4bbf
- SSDEEP 192:ami7XWFhJvhiBYrGWCDa/HlR1VpRhJElAEm:pi67Jvh4YiWCaX
- TLSH T195526313B7D88919F1F74A70EDBD21D65CA67C821D11DA5F3218B34E1872E84FBA0726
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_monitor.PNF
- Size 9KB
- SHA256 57f16a3a27f67eede7638347df700fe7227aa03813a1da934c7964b9a1b69a07
- MD5 2a85bd5534739a7d28db4bb8ebab4816
- SHA1 e093204bc54d2b706bf4fb7e3c2729159bb6a4b3
- SHA512 61d9cb837b5654f87f7174141c36c222c465d83c36ad833e22422cd5ccbbae38d265657bd361968349606c412f77b620509a0904fd49e7b5a66b1d3c08d6f70b
- SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5M4+I8wuCXDH//FujVGBSSrM:J5fn2j3V+cZU6S5swu0Yv
- TLSH T15212DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_processor.PNF
- Size 5KB
- SHA256 70eaa1e92e0a72bc44c6a210a7bbfecec69eaa615f3e502bf41c95e5df4c912f
- MD5 96450bfb220933e189a90025827bdee4
- SHA1 e17152b2b61d4b1de939336d9f41ae35064bfc8b
- SHA512 382b010150c5e3379a6a1890d8bb694c0c520ee52f2f29cc3c1cb214f98c8e1a452df62de170440a8c65d832dddfeef98aa24bfffb6bfd66ab012543c63d237d
- SSDEEP 96:toMRidfWASiSxqOwth0myDc8VzE8S0RupQ:efJSfG07Dc8REBVQ
- TLSH T110B16956B3E99A58F17B4E707DB890F641B1BC925C01CA5F3244731D1C71A88EBB071B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 51a44ac3093edf15b594820fccfcf004570d7fa94344ce1d5706fac40cb24b19
- MD5 850637014427519d684bf73de59df79f
- SHA1 a70c94789afed6675fcb82f04e85e2989471b3b1
- SHA512 f311524ae6163f6d073ff21d674bd33965db738489d8b0ef896e13fdfa85e06fa520f24c2c4b5919745254cc24aac8922585e57d13d6b0513f2a08f99a93b71b
- SSDEEP 48:FQ9AgrNDt9WyH0y5mNMR6+QwYD8IDbYRb0a6cVMRTplqEEt45a/U:FQ93rht9WyG+QwYguYNj6l3OKP
- TLSH T184A13345B7E88E24F27A9935BCF0A0E78266BC924C15DA5F3288731D1C73694E7B071A
- MD5 SHA1 SHA512 SSDEEP TLSH