99b79b63630150ba46a9da0abbf186ce92677921cfb953ac8820f14235d7718e

Analysis

Target
ChfvrJ0s.exe
Size 14KB
Sample201219-nms87gnh8s
SHA256 99b79b63630150ba46a9da0abbf186ce92677921cfb953ac8820f14235d7718e
MD5 7b887b59e005a288daa79334b80a0e28
SHA1 fc1cb19714fd91945e1b43758e9b0dd0f8967baf
SHA512 a3291f2345b709fbba58440d7a71f1480b0e5d2bb86d9a8131485d2635dcb37a019a5705be594fbd294d9241fbc977c999d7ed7cf20f5ccd0fe1c9252ce8c623
MD5 SHA1 SHA512

Score

1^/10

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ChfvrJ0s.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	ChfvrJ0s.exe

C:\Users\Admin\AppData\Local\Temp\ChfvrJ0s.exe
"C:\Users\Admin\AppData\Local\Temp\ChfvrJ0s.exe"
1⤵
- Checks processor information in registry
PID:744

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact