Analysis
- max time kernel
149s - max time network
126s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/09/2026, 09:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe
- Size 524KB
- Sample260928-lltzlsaa98
- SHA256 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499
- MD5 ee797df97df1b7bf613caa703191aa47
- SHA1 01a2afb841c2ca0fa54c420093890450e3213b1a
- SHA512 2e62c109ad16a69bbe29396de529b02a54ce9944cf8e6065b250672c54ceb35100ab39d3671e76674834caf43cd3c9727d56f2daab0ef8aa267e3fefa151752b
- SSDEEP 6144:JR+N8Zk5APw9J/ZWjnG0oXkBvLgvPXdFMYElH5OTU3lzHxGyKFC65autcfIXuxNe:JKF9J/ZWS2DgvPlEHzRGyKFzFMNkdcO
- TLSH T1ADB46D42E7D222ECE4B6C5309777913279727C810B31ADDF41849E3A2E61EC1AE39B57
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
ioc Process \??\F:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\J:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\R:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\T:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\Y:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\E:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\H:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\P:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\S:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\U:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\V:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\Z:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\G:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\M:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\Q:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\X:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\I:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\K:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\L:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\N:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\O:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\W:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe \??\D:\ 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe - Drops file in Windows directory 61 IoCs
description ioc Process File created C:\Windows\INF\rdcameradriver.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fsencryption.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fshsm.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fssystemrecovery.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fsundelete.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_ramdisk.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\remoteposdrv.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fsantivirus.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_receiptprinter.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\eyegazeioctl.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\ts_generic.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\digitalmediadevice.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_cashdrawer.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_computeaccelerator.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_display.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fssystem.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_media.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_camera.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fsquotamgmt.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_generic.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_monitor.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\rawsilo.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_processor.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_barcodescanner.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_smrvolume.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\oposdrv.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\xusb22.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fsinfrastructure.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_i3c.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_sslaccel.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_swcomponent.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\miradisp.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_mcx.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_linedisplay.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_scmvolume.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_volume.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_diskdrive.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_firmware.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_proximity.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\dc1-controller.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_apo.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_extension.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fsreplication.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_magneticstripereader.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_primitive.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_scmdisk.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_netdriver.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\wsdprint.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fscompression.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fscopyprotection.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_smrdisk.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fsvirtualization.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_fscontentscreener.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_nvmedisk.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe File created C:\Windows\INF\c_ucm.PNF 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe - Checks SCSI registry key(s) 3 TTPs 28 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe - Opens file in notepad (likely ransom note) 22 IoCs
pid Process 3676 notepad.exe 2808 notepad.exe 4176 notepad.exe 6036 notepad.exe 260 notepad.exe 4112 notepad.exe 2500 notepad.exe 5528 notepad.exe 5236 notepad.exe 4728 notepad.exe 4120 notepad.exe 3764 notepad.exe 5768 notepad.exe 4576 notepad.exe 2088 notepad.exe 2892 notepad.exe 1416 notepad.exe 4592 notepad.exe 2264 notepad.exe 5000 notepad.exe 5684 notepad.exe 2428 notepad.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe - Suspicious behavior: LoadsDriver 44 IoCs
pid Process 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1968 wrote to memory of 2264 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 89 PID 1968 wrote to memory of 3764 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 90 PID 1968 wrote to memory of 3676 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 91 PID 1968 wrote to memory of 2808 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 93 PID 1968 wrote to memory of 5768 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 94 PID 1968 wrote to memory of 5236 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 95 PID 1968 wrote to memory of 4576 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 96 PID 1968 wrote to memory of 2088 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 97 PID 1968 wrote to memory of 5000 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 98 PID 1968 wrote to memory of 5684 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 99 PID 1968 wrote to memory of 4728 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 100 PID 1968 wrote to memory of 4176 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 101 PID 1968 wrote to memory of 6036 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 102 PID 1968 wrote to memory of 4120 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 103 PID 1968 wrote to memory of 260 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 104 PID 1968 wrote to memory of 2892 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 105 PID 1968 wrote to memory of 2428 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 106 PID 1968 wrote to memory of 1416 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 107 PID 1968 wrote to memory of 4112 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 108 PID 1968 wrote to memory of 2500 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 109 PID 1968 wrote to memory of 4592 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 110 PID 1968 wrote to memory of 5528 1968 4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe 111
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe"C:\Users\Admin\AppData\Local\Temp\4a9290e11e36d4bc7ae2d8ba84eaee70589f94045ae853706129a8ea267ec499.exe"1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2264
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:3764
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:3676
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2808
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:5768
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:5236
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4576
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2088
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:5000
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:5684
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4728
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4176
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:6036
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4120
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:260
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2892
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2428
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:1416
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4112
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:2500
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:4592
-
-
C:\Windows\system32\notepad.exe"C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"2⤵
- Opens file in notepad (likely ransom note)
PID:5528
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
- Size 242B
- SHA256 2fe23b4612eb3b134ecc98ff66ec700c25bcdb0586dc8e89fe0e22aac2c4c488
- MD5 e6b4618e0cd2fbdb9ed1a5e58990d40a
- SHA1 fbee2c5851c6c7bf7e19d280eafe607385c17ddd
- SHA512 a9c7a17c03ec264bdc5b3e8f454eb661c056031b0450df56585ed0612a3e634c85ed0f197c7b3f8f6f9ebe89e6d1d7beebf92e2d65aab0ce430c9b0220e08b36
- TLSH T188D0A90052E80509B2F38B122BFB0002077AFCD08530E14E31C0A2190AB1F8488B1333
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
- Size 242B
- SHA256 c2eefcc394068fa4824b6ee9ab84b42fbf8e880adcd51217f50373dfec11d4ed
- MD5 3f586f0da4b12a5eeb04ab03bc3a0831
- SHA1 1f941ef0aa19bb7bfdef08485576ceb0c8ee37f7
- SHA512 c2c9379f67b352b46db0b98567106c37208ff4033d64b50f4adcd56b8506e686af8c3eb51f7645107995f412a19a270ff66ddfe0e7670e8779dba6c79c8dabfb
- TLSH T1CDD0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2290AB1F8488B1333
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\INF\c_diskdrive.PNF
- Size 6KB
- SHA256 3c75410de41684e77b7d53f2c91c0b9e918f626f47290da8d7b96ff7659ce582
- MD5 cecf24c70d63fc916dfd5bb66d147318
- SHA1 1b1fb66db6286187d1e4509422ed296823a33bea
- SHA512 63cdb4d08834f57f1b0f71ed304db9ee0ba5a126883dd3325bb9dbe2044c3ddf98b062aa35260646bd8dd851abaf9dc72d69495f0d489229d8b40d4a1ddbc8d2
- SSDEEP 96:oalWHRvQGW8J/9IeqQ/LaY/duMNpyoi7hpXv3211Lh:dlcmC7Fib/32F
- TLSH T170D1C091B7D58B28F1BA8D31AEF560EA45657C825C02DE5F3118330D2872EC4E7F172A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_display.PNF
- Size 8KB
- SHA256 cbc26634bedd1459226294ae366967a1454cc4a5f1ee81346b2d6b613c79cd29
- MD5 82b1f5ef58ee635a405e72b76a688d60
- SHA1 6aa2ec638c441b2d96075d2458a0c5212685c565
- SHA512 69fb1327aa1fe3b1f963a47e83a7402c4227a529cc98ae566fb0f9826bf0a475a5789294daeae4790653d4e6c4d6764c020fd1b72da500f93e8e62a67006cc76
- SSDEEP 96:tHj5XgbWWgulniv+it/Ort1ElfRx5YH2KtINFYBIl+IGEaU4Zvo3KRUmWR:TwnivkElf4ycIl7kvo3R
- TLSH T1D5028665B7E58B64F2B65970DDF0A0DA45757CC11C81DE9F3628330E3C72F8496A0B2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_media.PNF
- Size 12KB
- SHA256 da233c63a0a6b0311c191e9e8852d2bc45bbc2c22c8f577a4fa28165296f5bd4
- MD5 e1874f241a1244cc0bd2849f3ceb26d7
- SHA1 54536e7696d8d561f5fd7e2eb65d50ba2d40993e
- SHA512 26e0a02e1fb1f03426bf986c699b6e536e3aedecbdefa2a88a0776c19b797a70a7c204b809e7c817098a41abbca69fe20a0ed43232a8621fb67cb705530e9094
- SSDEEP 192:aTf31oagX35QwGNogEvxsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw4ExsCaX
- TLSH T118526413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_monitor.PNF
- Size 9KB
- SHA256 e7d09385a83de59dc5832c610db2205b8d000fb42bec7e73e8e964e253aefbf7
- MD5 4c1d5ad83f7bda70387c74515dfacc6f
- SHA1 4b91f2098161ef66641eb1c14632a7ccca062ec4
- SHA512 53f2058e87c69906d1017e9045edf582512e4887cc904067f885b36fe4e186280b4ecf9f7c9a92a1dca8791df415b58b6ffa757187cba2a506181296dd800ee8
- SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5M4+I8wuCXDH//WujVGBSSrM:J5fn2j3V+cZU6S5swunYv
- TLSH T1BB12DB55BBE98918F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_processor.PNF
- Size 5KB
- SHA256 e2a7dce83cf9d082c5f7b927e7131569003730d96f8e9149148c0c6a89f9aff8
- MD5 aaca4d158d734e6e7532d6f9cf5aa5c1
- SHA1 c76af2e7d45ecb967a5fb6e993084e343febf917
- SHA512 6ae7996fea17609987f46422cde4c9731b4e2aa3542809c0ab29aeea4d49b78d76b34387bec11171e28d20f13923ed061a7e94bd0d36bcd48cdf0d46669f1572
- SSDEEP 96:toMRiQAGiSAcPO/tZlBy3c8VzE8S0RupQ:MGfA7lk3c8REBVQ
- TLSH T13DB16956B3E99A58F17B8D707DB8A4FA41B1BC525C01CA5F3248731D1C72A88EBB071B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\INF\c_volume.PNF
- Size 4KB
- SHA256 f96da3374c24c3ce1f98ffb8592521e55a41032f54c95d7b7019d7dbaecf8473
- MD5 9dd0eec7c752bb1591bc2fb4ec33c02f
- SHA1 4e460139b5a3feda7b9e6d383636792b9d3b2a82
- SHA512 019a377658ffbc74f945b078a86b3b157e0612b42006d1414013a3cd0109c9c5495b05840cea1be398aa05bf02812fc55d07eb0d29873e7484adb5a085708669
- SSDEEP 48:FQ9AgrNDt7/Wyki5m6MRu3owYWeaIDbsRbXcVMRTplqEEt45a/U:FQ93rht7/Wy3owY0usNXl3OKP
- TLSH T128A14445B7E88E24F27A9935BCF060E64266BC924C15DA5F3384730D5CB3794E7B071A
- MD5 SHA1 SHA512 SSDEEP TLSH