f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8

Analysis

Target

f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe
Size

24KB
MD5

c25b797d6737751936766cd50e26d725
SHA1

dfb3bfb53ce0430c8af1ee7b145408d63b1bec67
SHA256

f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8
SHA512

28871ab7d533a22d78545dd740df0c8b93ab0e9e0d81901faaf30d4656c953162ee1e049dcfbba0050405e7441eee77f056445653a8bd927963b8f81d9bf8eed

Score

1^/10

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe

C:\Users\Admin\AppData\Local\Temp\f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe
"C:\Users\Admin\AppData\Local\Temp\f6b2c58f9846adcb295edd3c8a5beaec31fff3bc98f6503d04e95be3f9f072e8.exe"
1⤵
- Checks processor information in registry
PID:1960

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

memory/1960-54-0x00000000767A1000-0x00000000767A3000-memory.dmp

Filesize
8KB

Download
memory/1960-55-0x0000000074B20000-0x00000000750CB000-memory.dmp

Filesize
5.7MB

Download