Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
05/05/2026, 03:46
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
HDN UID BYPASS V1.0.exe
Resource
win10ltsc2021-20260126-en
windows10-ltsc_2021-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
HDN UID BYPASS V1.0.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
HDN UID BYPASS V1.0.exe
Resource
win11-20260130-en
windows11-21h2-x64
4 signatures
150 seconds
General
- Target HDN UID BYPASS V1.0.exe
- Size 4.1MB
- Sample260505-ebt4asfz21
- SHA256 2236676c8e57dc62caff14657271e0256ae4ebf09f8e1d6c48c541423b2c1713
- MD5 fe04ccbe1d703aa6291059259f55cfe7
- SHA1 5df2eec32219ddec1a2cbecfb2093b0051d2f62a
- SHA512 82b5742dcadb2ad2d07ee0b455c1d0dad5f0ec187c0f47cf9530a361629c2c4b7b01154886d04ff611c3acad67647349afec585973db2077877223c5495c4d57
- SSDEEP 98304:7RfwyPXzaB50q1XtrzHer9gHhMjmyTDNVnlRuyJ4fP:V1s5z+riOjfN9lRvJ4fP
- TLSH T19D1622BC76E93939CF2F86B6769C8321D33A23B363111E3F25A371C24D45AD20566E94
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion HDN UID BYPASS V1.0.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS HDN UID BYPASS V1.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer HDN UID BYPASS V1.0.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName HDN UID BYPASS V1.0.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe 4296 HDN UID BYPASS V1.0.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4296 HDN UID BYPASS V1.0.exe