be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef

Analysis

max time kernel
127s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/10/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Size 471KB
Sample261001-rxexqaec42
SHA256 be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef
MD5 b4599a85c973b97bf5de95e147a36bda
SHA1 fcb50c83f52a9c0679532a6851e3b373560820ff
SHA512 37b4f381ecbef65660949911c32c0c7a235058543dfe325978e6192e4a86fc0344125bcd088b6c44c94e5de546b377d06121e4ca7c7b41653c8c59dbd825ccd2
SSDEEP 12288:Aw/uTr88gIAGBLbEtUoNUk2KDSBgJNiYHBA:Aw/ufGGLoNU0Sm6gA
TLSH
T1A6A45C13A7E101ECE4B7C671CABA92329A327C505934FA2E165CCD352F71E119E38F66
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

ransomware

Malware Config

Signatures

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

ioc	Process
\??\M:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\N:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\F:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\H:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\L:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\Z:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\D:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\J:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\P:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\R:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\U:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\V:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\K:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\O:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\S:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\T:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\W:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\X:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\Y:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\Q:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\E:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\G:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
\??\I:\	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe

Drops file in Windows directory 61 IoCs

description	ioc	Process
File created	C:\Windows\INF\c_barcodescanner.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fshsm.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsreplication.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_receiptprinter.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsvirtualization.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_swcomponent.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_ucm.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\rawsilo.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_media.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsantivirus.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsinfrastructure.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsopenfilebackup.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_ramdisk.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\eyegazeioctl.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\miradisp.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\oposdrv.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fssystemrecovery.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_processor.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_camera.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_diskdrive.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fscontinuousbackup.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_generic.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_mcx.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_netdriver.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_smrvolume.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\ts_generic.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fssecurityenhancer.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsactivitymonitor.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fscfsmetadataserver.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsundelete.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_magneticstripereader.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_primitive.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_display.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsencryption.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_scmvolume.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_computeaccelerator.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fscontentscreener.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fssystem.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_i3c.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\digitalmediadevice.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\xusb22.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_scmdisk.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\dc1-controller.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\wsdprint.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_cashdrawer.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsphysicalquotamgmt.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_smrdisk.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fscopyprotection.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fscompression.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_sslaccel.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_volume.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_extension.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_nvmedisk.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\remoteposdrv.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_apo.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_fsquotamgmt.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_monitor.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\rdcameradriver.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_firmware.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_linedisplay.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
File created	C:\Windows\INF\c_proximity.PNF	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe

Checks SCSI registry key(s) 3 TTPs 28 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Driver	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\CompatibleIDs	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\DeviceDesc	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Driver	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\CompatibleIDs	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Driver	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\CompatibleIDs	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe

Opens file in notepad (likely ransom note) 22 IoCs

ransomware

pid	Process
2332	notepad.exe
3036	notepad.exe
4988	notepad.exe
5432	notepad.exe
4912	notepad.exe
4140	notepad.exe
3252	notepad.exe
1988	notepad.exe
5264	notepad.exe
1320	notepad.exe
4560	notepad.exe
1432	notepad.exe
1632	notepad.exe
3268	notepad.exe
4612	notepad.exe
3768	notepad.exe
1892	notepad.exe
860	notepad.exe
4192	notepad.exe
1856	notepad.exe
1680	notepad.exe
5000	notepad.exe

Suspicious behavior: LoadsDriver 36 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1236 wrote to memory of 3768	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	89
PID 1236 wrote to memory of 4140	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	90
PID 1236 wrote to memory of 1320	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	91
PID 1236 wrote to memory of 1856	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	94
PID 1236 wrote to memory of 1680	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	95
PID 1236 wrote to memory of 5000	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	96
PID 1236 wrote to memory of 4560	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	97
PID 1236 wrote to memory of 1432	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	98
PID 1236 wrote to memory of 3252	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	99
PID 1236 wrote to memory of 1988	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	100
PID 1236 wrote to memory of 5264	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	101
PID 1236 wrote to memory of 2332	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	102
PID 1236 wrote to memory of 1632	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	103
PID 1236 wrote to memory of 3036	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	104
PID 1236 wrote to memory of 4988	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	105
PID 1236 wrote to memory of 5432	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	106
PID 1236 wrote to memory of 1892	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	107
PID 1236 wrote to memory of 3268	1236	be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe	108

C:\Users\Admin\AppData\Local\Temp\be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe
"C:\Users\Admin\AppData\Local\Temp\be45717b85a80caaec041ef0719e62e9632f759f15f700c9f0c807ce5bd8cdef.exe"
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1236
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3768
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4140
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1320
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1856
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1680
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5000
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4560
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1432
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3252
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1988
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5264
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:2332
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1632
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3036
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4988
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:5432
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:1892
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:3268
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4612
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:860
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4912
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe" "C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt"
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 3904eb8e395cbb8af714d276aa4a74d0e34c62df3176e91cdb196cb38c7a9ca9
MD5 4245b5fa3bb97180fadf6fb92b6fcbf9
SHA1 1c602e304a522f11cf21ff5b14f2eba6a5884926
SHA512 5fc3b2470af035d99c609d321bd426bb5259daa068faa5f44953bc467e777415f6d04ac39db019cabf3fe290a7665bbaa533ef8a55068c5a69cc1d8aac9d640c
TLSH
T170D0A90062E8010AB2F38B222BFB00024776FCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 6aa675739e4e154859956f5f651c918762772d0a3e5a6dde52092161fadba81b
MD5 477f7b54d0ac886d4fd5d69aea19c5e7
SHA1 2af466242a8732077c49d7fda657776f72fb3ab5
SHA512 1dfac1e219f2976c3926682f18dac46854ffcea0a444d17bb1fd74b0ff9117830ef9862599b517685116102499e0982f23a80f0f73b092822d1a48c46d74c061
TLSH
T1DCD0A90092E9010AB2F38B222BFB00020776FCD08530E14E31C0A21D0AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 2fe23b4612eb3b134ecc98ff66ec700c25bcdb0586dc8e89fe0e22aac2c4c488
MD5 e6b4618e0cd2fbdb9ed1a5e58990d40a
SHA1 fbee2c5851c6c7bf7e19d280eafe607385c17ddd
SHA512 a9c7a17c03ec264bdc5b3e8f454eb661c056031b0450df56585ed0612a3e634c85ed0f197c7b3f8f6f9ebe89e6d1d7beebf92e2d65aab0ce430c9b0220e08b36
TLSH
T188D0A90052E80509B2F38B122BFB0002077AFCD08530E14E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

DriverInstall_Result.txt

Path C:\Users\Admin\AppData\Local\Temp\DriverInstall_Result.txt
Size 242B
SHA256 7d5ed5e3d24b2c4b35059361112caa01709332efda89302345765c6a04f54ec9
MD5 5edb51eea1eaf57d6fdd20fd525db455
SHA1 51c387a4c7db209e9ae6be1f55cc3a101b85e061
SHA512 102ed090abac8a57ab28a6483caa44b84ec23c6dd498217f7bd7d638954ed300ac70bc1f65a6125a09e11eb664d512348f4a5d9fb40ffe040d428e367cb5de9a
TLSH
T1A1D0A90052E80109B2F38B122BFB00020776FCD18630E54E31C0A2190AB1F8488B1333
MD5 SHA1 SHA512 TLSH

Submit Download

c_diskdrive.PNF

Path C:\Windows\INF\c_diskdrive.PNF
Size 6KB
SHA256 9cbc84b8e872d90b5fde0693806e567ae993ce21bbe73d25b9380fd851a9407f
MD5 85630bdb16302d5ca2b6433a801ca1ed
SHA1 f085176b200e99152d898d2c2d23809c61874a70
SHA512 fd4cfe1157358373b6524285415873d053a9ca7ceb53d572b22c2334366ff73a73ec3cb41e4ea277a92695cb555b9743ac72a84b00f2136866c75930904ee4da
SSDEEP 96:oalWHRvQGW8J/9J/WeqsYtDusNXe2c87hpXv3211Lh:dlcT/qZniMb/32F
TLSH
T114D1B095B7D98B28F1BA8D31ADF560EE85657C825C02CE5F3118330D2872E84E7F172A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_display.PNF

Path C:\Windows\INF\c_display.PNF
Size 8KB
SHA256 a5da1472a6161a6a9fffc2815d00d6886f2d6bf2fb92da1acdf851d070d8c0fb
MD5 b41a65a9b33f70302c861da2a5225b5b
SHA1 d37ffd31b8e44993ea0d3664938642e193e7a0fc
SHA512 c1fb6285e485d8e303cd1bec242243a763823f9d19233e83f8ec005308002dd4c4b57df55c37f310aeaf932c478effd8a32b0bbd565fd28375547dd376a6a9ad
SSDEEP 96:tHj5XgRfWWzlH4VfOrtlEARvoLi+XT7+KZt/Y0BnuOTITdaU4Zvo3KRUmWR:0f5LEAqLjXvF1Nnujkvo3R
TLSH
T10D028825B7E58B24F2B65970DDF0A0DA45757CC21C81DA9F3628730E7C72F8496B0B2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_media.PNF

Path C:\Windows\INF\c_media.PNF
Size 12KB
SHA256 da233c63a0a6b0311c191e9e8852d2bc45bbc2c22c8f577a4fa28165296f5bd4
MD5 e1874f241a1244cc0bd2849f3ceb26d7
SHA1 54536e7696d8d561f5fd7e2eb65d50ba2d40993e
SHA512 26e0a02e1fb1f03426bf986c699b6e536e3aedecbdefa2a88a0776c19b797a70a7c204b809e7c817098a41abbca69fe20a0ed43232a8621fb67cb705530e9094
SSDEEP 192:aTf31oagX35QwGNogEvxsCDa/HlR1VpRhJElAEm:Cf31oaO5Qw4ExsCaX
TLSH
T118526413B7D88919F1F74A70EDBD21E64CA57C821D11DA4F3258B34E1872E84FBA072A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_monitor.PNF

Path C:\Windows\INF\c_monitor.PNF
Size 9KB
SHA256 57f16a3a27f67eede7638347df700fe7227aa03813a1da934c7964b9a1b69a07
MD5 2a85bd5534739a7d28db4bb8ebab4816
SHA1 e093204bc54d2b706bf4fb7e3c2729159bb6a4b3
SHA512 61d9cb837b5654f87f7174141c36c222c465d83c36ad833e22422cd5ccbbae38d265657bd361968349606c412f77b620509a0904fd49e7b5a66b1d3c08d6f70b
SSDEEP 96:JwrKkR/TWfWOMnVj3yjQMx9POiE18O8tR6Efv1Qc5M4+I8wuCXDH//FujVGBSSrM:J5fn2j3V+cZU6S5swu0Yv
TLSH
T15212DB55BBE98914F1B65930EFF560E686793C821C02DA8F3168730E1872B90D7B173E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_processor.PNF

Path C:\Windows\INF\c_processor.PNF
Size 5KB
SHA256 69d523f5682fd71ab9b27de5cf9bcf6b936e112b24cea25ab4571f17b70202b5
MD5 86338bdaaa2c5ded23722adddb34fb08
SHA1 3559bdb510eeaf111a5dc2db1cda7b74e8a6c723
SHA512 cc902154c7d8b7881539b7286c7f6148734e6ea13d2fe864d738a65ebfbe4ce25bb4a61df1cb1d94f272b35f6445577e9c2f5793e1a06d561895e0b3b99d124d
SSDEEP 96:toMRidfWAeiSeEG9OqtT0Ay2Mc8VzE8S0RupQ:efJefYt0tjc8REBVQ
TLSH
T168B17B56B3E99A58F17B4E70BDB890F681B1BC925C01CA5F3248731D1C71A88EBB071B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c_volume.PNF

Path C:\Windows\INF\c_volume.PNF
Size 4KB
SHA256 f96da3374c24c3ce1f98ffb8592521e55a41032f54c95d7b7019d7dbaecf8473
MD5 9dd0eec7c752bb1591bc2fb4ec33c02f
SHA1 4e460139b5a3feda7b9e6d383636792b9d3b2a82
SHA512 019a377658ffbc74f945b078a86b3b157e0612b42006d1414013a3cd0109c9c5495b05840cea1be398aa05bf02812fc55d07eb0d29873e7484adb5a085708669
SSDEEP 48:FQ9AgrNDt7/Wyki5m6MRu3owYWeaIDbsRbXcVMRTplqEEt45a/U:FQ93rht7/Wy3owY0usNXl3OKP
TLSH
T128A14445B7E88E24F27A9935BCF060E64266BC924C15DA5F3384730D5CB3794E7B071A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1236-880-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-1308-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-1599-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-652-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-1964-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-2255-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-2620-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-2984-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-3641-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-3932-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-4297-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-4588-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

memory/1236-215-0x00007FF6ED8C0000-0x00007FF6ED95F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads