be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef

Analysis

max time kernel
144s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Size 471KB
Sample261001-rxexqaec42
SHA256 be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef
MD5 b4599a85c973b97bf5de95e147a36bda
SHA1 fcb50c83f52a9c0679532a6851e3b373560820ff
SHA512 37b4f381ecbef65660949911c32c0c7a235058543dfe325978e6192e4a86fc0344125bcd088b6c44c94e5de546b377d06121e4ca7c7b41653c8c59dbd825ccd2
SSDEEP 12288:Aw/uTr88gIAGBLbEtUoNUk2KDSBgJNiYHBA:Aw/ufGGLoNU0Sm6gA
TLSH
T1A6A45C13A7E101ECE4B7C671CABA92329A327C505934FA2E165CCD352F71E119E38F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\X:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\Z:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\R:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\W:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\E:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\H:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\J:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\K:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\M:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\O:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\D:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\G:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\Q:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\S:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\T:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\U:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\V:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\Y:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\F:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\I:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\L:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\N:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\P:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe

Drops file in Windows directory 57 IoCs

description	ioc	Process
File created	C:\Windows\INF\remoteposdrv.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_camera.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_extension.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_processor.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_apo.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsreplication.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\rawsilo.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\oposdrv.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_ucm.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\rdcameradriver.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\ts_generic.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fscompression.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_mcx.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_smrdisk.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_sslaccel.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\wsdprint.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_media.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fshsm.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_scmvolume.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_swcomponent.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\PerceptionSimulationSixDof.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_barcodescanner.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_display.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_netdriver.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_diskdrive.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_holographic.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\dc1-controller.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsundelete.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_linedisplay.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_proximity.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_scmdisk.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_firmware.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsencryption.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fssystem.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\miradisp.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_monitor.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_volume.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\xusb22.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_smrvolume.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe

Opens file in notepad (likely ransom note) 21 IoCs

ransomware

pid	Process
2128	notepad.exe
116	notepad.exe
2780	notepad.exe
4516	notepad.exe
4908	notepad.exe
4084	notepad.exe
1896	notepad.exe
2952	notepad.exe
3976	notepad.exe
4548	notepad.exe
1528	notepad.exe
4360	notepad.exe
3764	notepad.exe
1988	notepad.exe
3744	notepad.exe
3668	notepad.exe
4912	notepad.exe
2276	notepad.exe
1964	notepad.exe
2768	notepad.exe
4580	notepad.exe

Suspicious behavior: LoadsDriver 40 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 3092 wrote to memory of 1964	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	97
PID 3092 wrote to memory of 1896	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	99
PID 3092 wrote to memory of 1988	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	100
PID 3092 wrote to memory of 2952	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	102
PID 3092 wrote to memory of 4516	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	107
PID 3092 wrote to memory of 3744	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	111
PID 3092 wrote to memory of 2768	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	112
PID 3092 wrote to memory of 4580	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	113
PID 3092 wrote to memory of 3976	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	114
PID 3092 wrote to memory of 4908	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	115
PID 3092 wrote to memory of 3668	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	117
PID 3092 wrote to memory of 4548	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	118
PID 3092 wrote to memory of 2128	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	119
PID 3092 wrote to memory of 4912	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	120
PID 3092 wrote to memory of 116	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	121
PID 3092 wrote to memory of 4084	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	122
PID 3092 wrote to memory of 2780	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	123
PID 3092 wrote to memory of 1528	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	124
PID 3092 wrote to memory of 2276	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	125
PID 3092 wrote to memory of 4360	3092	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	126

C:\Users\Admin\AppData\Local\Temp\be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
"C:\Users\Admin\AppData\Local\Temp\be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3092
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1964
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1896
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1988
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2952
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4516
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3744
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2768
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4580
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3976
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4908
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3668
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4548
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2128
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4912
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:116
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4084
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2780
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1528
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2276
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4360
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3764

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p
1⤵
PID:4900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 4cac95964e927316b7825ba8b369d54cdfab9d9d408c0d4768de09815b753162
MD5 82ec0a11ee75d79e58f8b3507b6ae0e1
SHA1 c781a85c80c1acb296f4806860e2b7c861a95da7
SHA512 b14111c86ca42d4625c16ce1c3e652817c638da023cc41d52b305779a8061f60dc05ad42d7add47fb9e27c7ebc163c79bcf66a4cff14a163fbb15f70ba30b9ba
TLSH
T145D0A90052E80109B2F38B122BFB00020776FCD08530E14E31C0A2190AB2F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 3904eb8e395cbb8af714d276aa4a74d0e34c62df3176e91cdb196cb38c7a9ca9
MD5 4245b5fa3bb97180fadf6fb92b6fcbf9
SHA1 1c602e304a522f11cf21ff5b14f2eba6a5884926
SHA512 5fc3b2470af035d99c609d321bd426bb5259daa068faa5f44953bc467e777415f6d04ac39db019cabf3fe290a7665bbaa533ef8a55068c5a69cc1d8aac9d640c
TLSH
T170D0A90062E8010AB2F38B222BFB00024776FCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 973d23e48cf13a102e333830c91d5397a4dce5737caaeddcfcda2c38e5949da9
MD5 ec2f6d01890144980ad33e62a2584530
SHA1 4f4211a61ac1c46a8d89b43493a8ad5717d9b5c4
SHA512 cae3367b285e98b5821e63322f21b5e89a7cdc4e8fca120427bee058d377ad52e297e5cde672e38099086017cc930bbae00d4e03e25be7457f0c6bf79bb3db16
TLSH
T1EAD0A91052E80109B2F38B122BFB00020776FCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 74011c6f7bc5773dffaeb9255b2e6afd96d56ee5390ab7a51f3db675311a8ce1
MD5 9357e5eb54287682201ed772e7254e99
SHA1 7727334f31e28ffe28770c45cf63e2838eef1b86
SHA512 7c6a43671d04b1da51f35457bff21592dd51d3a56cd7e24cdfd5ded0f3626369e196ce17ab440019e6ef45902f2c5b09fe94b3a9daea8db0928f24129493f50d
TLSH
T1BDD0A90052E80209B2F38B122BFB00020776FCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 329454b0df508dae3dcf90836c64bb7b640ce4eaf34d4616c141fe811f3e8d75
MD5 5877ea2d33d26acba738e91eb12ab03e
SHA1 1ee2126b914026ba256f5cc958676d4a8ace3adb
SHA512 3535ba947e8a26e37a4f5d07c38281888da7f347e9c33062e951e879efe6275f9e8197caf5fd290ed893a68a989d62e43ef255dd4b462c80d4dc2ead297152ba
SSDEEP 48:s6j4xIiupQ/sHBTflU/Weqn774QE5iqjYDEwEFeaIDbsRbXkMx86xQ4SVNBBExpR:xj4xFuKeBTfW/WeqWYgDusNXePecqJ
TLSH
T1A8D1BD11B7D88B24F1764930ADF5A1EA8665BC824C05EE5F3518330E2872E94DBF172E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 e3170e44d159d924bd7884c4e0fd6b590ffd93b0ce2c1eebd0d68606039f7df5
MD5 716a1b21d16beae0405cc08d35d137cd
SHA1 a013a0d39efd59a831edfe5194dd182af25109aa
SHA512 bf6664be664c1675b1038afe91d108a0d0f487f158cf6d0b183ab5ac5cf10836270c71687b69a220bd7ef8383bd2aa1cc9715edcedd4fde1735c7af50ac103f8
SSDEEP 96:q/cw3dCMNyLifW5laU4VfOrtlBARv7Li+XT7+uZt/Y0BnuOTITd47VGpR2b8jN:VwEMYOfGa4BA9LjXvZ1NnuH6i
TLSH
T1B7026736B7D5EAA4F1BF59B0DDF850E946367D815C01CE4F3128734E5C72A8496A032B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 feedfdacbcff878dd0f877736f880b045941e25cd3c4013357d4e2a293a1e7d8
MD5 d6f787534eea52824abfef940379b071
SHA1 b200fb5e314de41c743ac84fc973584dee668946
SHA512 7ba2d3f0858a5aea61486ba8eb96fed621384258b5055e97a314d9cde71081545d881059d9bcd5bce4f5cb2d7cc341090d2cc419cac44302708b8bef17e4beca
SSDEEP 96:QyOzh59kjf3WSkEFRcpXyY3q0xPOQlf88GcNy1/HC3T6gYq2hwyvVATCG5qylmqG:o0f3woapXQXQ1HNogE3lJSZmXx7p
TLSH
T197427C56B7D9C919F1BA8E70EDF851D948B57C821D01CE1F3168B34E1872E84EBB072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 6KB
SHA256 8175f3000d31f9afadbbba3149b647da59b30712668751cd04216bbbbc9897ee
MD5 29f6df5957016e418fbd0f2407e3575e
SHA1 0ffdc37e214ad11658b1732a8448eab853713b6b
SHA512 e5916dfd44a4456d0f8c7f42b993426c1196059c053a46ac324104edc674944f622b43c7ecb652e1904dd11932d98b87216e7860f5ce193bcd8899162dcbcc8a
SSDEEP 96:K3P2tl44AX7cWfWOMnVj3yjNMGULTcRXqE18O8t746Efv3VfANNWuyfJ:Offn2j3ExULohRp6WqNWus
TLSH
T198E1865577D98A24F1765931AFF5B0EB82657CC24C42DB5F3208731E18B3A84D3A1B2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 fbcb9fb11e0c90ae202c8d907dca6d77f22972556c18eaf3c1648b29d7b7c6ac
MD5 8c92f953438dd8bbe03fc0424d6e940d
SHA1 dc166b66328dfa7271de01077566f746c93ef85c
SHA512 f1c2e37ae51a1220981e125d713195a3e0c504dffa6496cb4ffc7eb3271ed7fb7aaea55c2d931769bfcac13908dcc3c317f21b97d9056079be84563f118a5ecc
SSDEEP 96:VF7RG+gmXfWARXgeS/RHOqtTIAy2Mc8Vze8SWtpJO1:zXXfJRgzJvItjc8ReBWlc
TLSH
T17CB16B45F7E68A18F17B5D30BCF464F685B6BC816D01CA5F3208731D1872694EBB171A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 fc755ab5bc41958bef0f37e07fc9d55a2257db77c0d983b080c16d294e7316d0
MD5 94c4f5856d0747c9d6d7fe25e19cebbc
SHA1 c5488c11816a04fcd948dbf43de9bc0579a2f6b8
SHA512 c702bda92807aa983da6a777150705bc250e0dbea385b779d2830a13ffe7d1a7c640208731e45772add00c6e8936d2e3510985fe5c7151a7086c3dd957c20578
SSDEEP 48:+j5CyGz7ElZd/WyH0s5K9MROdYO8IDbYRb0a6KVMRGGLp7tVCCHr6mv7C:Y5RGzY/WygdYVuYNj6DLpxV3r6mvG
TLSH
T1A691495A7BD58E24F27A9D35BDF460E746A2BC428C09CA5F3248331D0C72784E7B162B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3092-385-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-3698-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-1241-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-2203-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-2738-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-3165-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-814-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-1776-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-4127-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-4662-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-5089-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-5624-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-6051-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

memory/3092-6478-0x00007FF6BE310000-0x00007FF6BE3AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads