89990fdc6fbe754642924d0ce297ffb23c90e05f974760e4935c8aa7a21888de

Analysis

user interaction
yes
max time kernel
298s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
gui_mapper.exe
Size 173KB
Sample261027-dp8ceace78
SHA256 89990fdc6fbe754642924d0ce297ffb23c90e05f974760e4935c8aa7a21888de
MD5 0a00ef0775fd2b35e5e703c3be6c42bf
SHA1 837fd12c0fff87c2fe35603bdf860e824d82ef8e
SHA512 f82bd30bd9499f8110090dc76842df956e3c231aa0148c155da22a1394f997ddf6bdcec993bff7d72504938e1948bfaf9c5ea2c385dab2fc2f0e3dcc8936ee36
SSDEEP 3072:AJaPQ7+YDuBsiNlopjU9B/mG98E8AD6Wk8ayfRdomJTQSaMm5/6o:po+YDuBsiNlopjU9B/mm5gRxyJNWlx
TLSH
T1BB042B1797A9106DF1B696BCDAB24612DBB1BC411B70E3CF135088990F72BD49E3EB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

persistence ransomware

Malware Config

Signatures

Sets service image path in registry 3 TTPs 1 IoCs

This determines the executable launched when a service starts. It can be used to establish persistence.

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\mdmfttttdfvg\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Microsoft\\Windows\\WER\\Temp\\vuwdlerlemjdhbnw\\mdmfttttdfvg.sys"	gui_mapper.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5044	NOTEPAD.EXE

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
2316	gui_mapper.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2316	gui_mapper.exe
Token: SeLoadDriverPrivilege	2316	gui_mapper.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2316	gui_mapper.exe

C:\Users\Admin\AppData\Local\Temp\gui_mapper.exe
"C:\Users\Admin\AppData\Local\Temp\gui_mapper.exe"
1⤵
- Sets service image path in registry
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2316

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2132

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Documents\DriverMapper_log.txt
1⤵
- Opens file in notepad (likely ransom note)
PID:5044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DriverMapper_log.txt

Path C:\Users\Admin\Documents\DriverMapper_log.txt
Size 835B
SHA256 d7dc661ba51365c6b579a799fb2acf2c31241e08badb683311af1622dc7985d6
MD5 d947c962c8392912db578e735d41eea8
SHA1 486b072ab94b58d9c23a0654bd0f892a3eba369e
SHA512 30bec994b8ede4ea6742c0827098bdbaad679da3524b2c71dea2878a1d2cbecc588f07dbd3c4acf514e7c6f9f3143935b53028007e22360aa681723aef7e2c00
TLSH
T1B301C09097F0461B9770A0974D37E1A46FE0250F3F6E6B2A8654514CC00558FA3947E2
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads