Analysis
- user interaction
yes - max time kernel
49s - max time network
49s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260126-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260126-enlocale:en-usos:windows10-ltsc_2021-x64system - submitted
05/05/2026, 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HDN UID BYPASS V1.0.exe
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
HDN UID BYPASS V1.0.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
HDN UID BYPASS V1.0.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target HDN UID BYPASS V1.0.exe
- Size 4.1MB
- Sample260505-ebt4asfz21
- SHA256 2236676c8e57dc62caff14657271e0256ae4ebf09f8e1d6c48c541423b2c1713
- MD5 fe04ccbe1d703aa6291059259f55cfe7
- SHA1 5df2eec32219ddec1a2cbecfb2093b0051d2f62a
- SHA512 82b5742dcadb2ad2d07ee0b455c1d0dad5f0ec187c0f47cf9530a361629c2c4b7b01154886d04ff611c3acad67647349afec585973db2077877223c5495c4d57
- SSDEEP 98304:7RfwyPXzaB50q1XtrzHer9gHhMjmyTDNVnlRuyJ4fP:V1s5z+riOjfN9lRvJ4fP
- TLSH T19D1622BC76E93939CF2F86B6769C8321D33A23B363111E3F25A371C24D45AD20566E94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion HDN UID BYPASS V1.0.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion HDN UID BYPASS V1.0.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS HDN UID BYPASS V1.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer HDN UID BYPASS V1.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName HDN UID BYPASS V1.0.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4214655515-2537246629-1547560666-1000\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\4B3CF1E0F51D4701B5A8B300EFACB345E454378A HDN UID BYPASS V1.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-4214655515-2537246629-1547560666-1000\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\4B3CF1E0F51D4701B5A8B300EFACB345E454378A\Blob = 0200000001000000ac0000001c0000004c000000010000000000000000000000000000000100000043004e003d0052006100680075006c00420079007000610073007300200052006f006f007400200043004100000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000000300000001000000140000004b3cf1e0f51d4701b5a8b300efacb345e454378a0b000000010000002800000052006100680075006c00420079007000610073007300200052006f006f00740020004300410000002000000001000000ea020000308202e6308201cea003020102020805d65e506468b758300d06092a864886f70d01010b0500301e311c301a06035504030c13526168756c42797061737320526f6f74204341301e170d3235303530343033343730355a170d3238303830373033343730355a301e311c301a06035504030c13526168756c42797061737320526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a8c143ad99151e764d6c87a71d40721b17c0446cf63897266312df43c13300fe24922f99a2ca8bb61ce390dd5b603d8880bb87286252ef4c6b84e841abb8dbdd1c6116853dc8dcbca06ca8906c9f7396368545e47ae66b88773e42533fd9446326ecb2110705c04847ace499bf01760ad42f13e0ba72a8100933eee91adb1c3af2515d0e506f303a59511d8a6db4689eda74371806a6f0ced3da774bc163bca1bbefd8e7e3f7cf36a14bbc2fbcea7db026326b54f5274cabd8f72b4da2b0936a87eccc15b6ea50a248c7a6b5a49e227f6efaef51b22f8b036939726a4348ff502950bb45614eb08c7a93215bb0f696662759fa924359ea74fb43311a18f5a24d0203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101002ddfb32344c679d474381ae4b38eb4a0df01d19fe22d303f2f5c5e65a7ed036e247b80b547a0be1bb04e7a52d85eb1bbf38519eb346a2305cac3744e3faaa64e285d91bbceb761c009732a148844fdd11fa8317ca6dbb2442f3035f2ac2b82474a33a03fd45390d50714532005260d2e86d22acf967c76a7c8c6e9ea43ead96fa1f2612222f974e789db64bf08191b3f825f4b05c407010e98e0160b58505394037ab212dfba3f54b619831187b5034e70f3aab9c3ddfe57c07e97bbe6250feaae33bb045c4d7974b3a21a51925dbd7e65076298045ad13601c8f26ffc39efd0d265bb1d8e6b00816c1c700afca339e297d44c2dbe00a60fe902735b8b24baf2 HDN UID BYPASS V1.0.exe Set value (data) \REGISTRY\USER\S-1-5-21-4214655515-2537246629-1547560666-1000\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates\4B3CF1E0F51D4701B5A8B300EFACB345E454378A\Blob = 0b000000010000002800000052006100680075006c00420079007000610073007300200052006f006f00740020004300410000000300000001000000140000004b3cf1e0f51d4701b5a8b300efacb345e454378a0200000001000000ac0000001c0000004c000000010000000000000000000000000000000100000043004e003d0052006100680075006c00420079007000610073007300200052006f006f007400200043004100000000004d006900630072006f0073006f0066007400200045006e00680061006e006300650064002000430072007900700074006f0067007200610070006800690063002000500072006f00760069006400650072002000760031002e003000000000002000000001000000ea020000308202e6308201cea003020102020805d65e506468b758300d06092a864886f70d01010b0500301e311c301a06035504030c13526168756c42797061737320526f6f74204341301e170d3235303530343033343730355a170d3238303830373033343730355a301e311c301a06035504030c13526168756c42797061737320526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100a8c143ad99151e764d6c87a71d40721b17c0446cf63897266312df43c13300fe24922f99a2ca8bb61ce390dd5b603d8880bb87286252ef4c6b84e841abb8dbdd1c6116853dc8dcbca06ca8906c9f7396368545e47ae66b88773e42533fd9446326ecb2110705c04847ace499bf01760ad42f13e0ba72a8100933eee91adb1c3af2515d0e506f303a59511d8a6db4689eda74371806a6f0ced3da774bc163bca1bbefd8e7e3f7cf36a14bbc2fbcea7db026326b54f5274cabd8f72b4da2b0936a87eccc15b6ea50a248c7a6b5a49e227f6efaef51b22f8b036939726a4348ff502950bb45614eb08c7a93215bb0f696662759fa924359ea74fb43311a18f5a24d0203010001a328302630130603551d25040c300a06082b06010505070301300f0603551d130101ff040530030101ff300d06092a864886f70d01010b050003820101002ddfb32344c679d474381ae4b38eb4a0df01d19fe22d303f2f5c5e65a7ed036e247b80b547a0be1bb04e7a52d85eb1bbf38519eb346a2305cac3744e3faaa64e285d91bbceb761c009732a148844fdd11fa8317ca6dbb2442f3035f2ac2b82474a33a03fd45390d50714532005260d2e86d22acf967c76a7c8c6e9ea43ead96fa1f2612222f974e789db64bf08191b3f825f4b05c407010e98e0160b58505394037ab212dfba3f54b619831187b5034e70f3aab9c3ddfe57c07e97bbe6250feaae33bb045c4d7974b3a21a51925dbd7e65076298045ad13601c8f26ffc39efd0d265bb1d8e6b00816c1c700afca339e297d44c2dbe00a60fe902735b8b24baf2 HDN UID BYPASS V1.0.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe 5444 HDN UID BYPASS V1.0.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5444 HDN UID BYPASS V1.0.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 5444 HDN UID BYPASS V1.0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HDN UID BYPASS V1.0.exe"C:\Users\Admin\AppData\Local\Temp\HDN UID BYPASS V1.0.exe"1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5444
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Tmp1613.tmp
- Size 2KB
- SHA256 48a48545c40ab8b8b0dd458098e3fd03a02d1f94268f0d860ff6080638a74f61
- MD5 c993ac90465c9c32e7156684824492b2
- SHA1 4aa983a7e573581414fb0524bc0c02504277c423
- SHA512 8504dd59debcadfea1fb2966d409bfb1bb0d1d4300314ad23c233cac6195ddc69fbf3abdf891214af784190f40adee10664d03411cd71bb1ba5de66a658bc3ef
- TLSH T1D6513A755BBB4053AC28D8FD363E4F9634EBD7263D5672CDA7B500BE08A24247754240
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCertificates\My\Certificates\4B3CF1E0F51D4701B5A8B300EFACB345E454378A
- Size 1KB
- SHA256 76a3a34f3b85a837c0a22dc15641baa8136319c54c26c8be3bb4a390aa054ced
- MD5 4351e59a357cc788da0dcf5cd3d5350f
- SHA1 fcb501b12b5757019f3a210814f600d0e6827bff
- SHA512 3d1e8461e913455ef7a219f5ee0e610ee3c17fa00398470055ce478d1b30be5d321f26ebbb0790108c7ed5a775eb596688ff3e311693f6790941e9b6999681a9
- TLSH T1F51135581F302454F872DEF244E9A72E6636F7A05B3A450A00EA1DDD8C04780447671F
- MD5 SHA1 SHA512 TLSH