Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
16/07/2026, 04:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe
- Size 1.6MB
- Sample260716-e6dd2ac18n
- SHA256 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c
- MD5 6915bdcb7e9c215e7fdbc50fcf4a3b5d
- SHA1 a75dbc2873993352559a061133258a4acbdc6ee4
- SHA512 990e98ee5c6e51d3c86b987630ada4db87e1c09230c39a0cd813f70f1101a5e78d275605b391db5a0ae1088292f10345af48afae250f4c9185e73be3ff1cb5ad
- SSDEEP 12288:2LhhlC2lrPLhhlC2lrsF/ZewYtImfQ2hVN:uI2lrbI2lriryDQ2hVN
- TLSH T1F775759033E49993F672833958F6D2213B39BA515776CB0B8200692D1D37BC36ED6B1B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate = "01/01/70" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 14 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Set value (int) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet = "3099311615" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString = "pc-a51-9.2" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (int) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\FeatureSet = "3099311615" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\Identifier = "Intel64 Family 6 Model 13 Stepping 2" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString = "pc-a51-9.2" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier = "Intel64 Family 6 Model 13 Stepping 2" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier = "DADY" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (int) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz = "4192" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\VendorIdentifier = "DADY" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (int) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz = "4192" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe - Enumerates system info in registry 2 TTPs 20 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosMinorRelease = "0" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (int) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMinorVersion = "255" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier = "AT compatible" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate = "04/01/2014" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (int) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BiosMajorRelease = "0" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion = "pc-a51-9.2" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0\Identifier = "Intel64 Family 6 Model 13 Stepping 2" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion = "rel-1.16.3-0-ga6ed6b70-prebuilt.dady.org" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (int) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorVersion = "255" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName = "Dady super powerful PC" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor = "SeaBIOS" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer = "DADY" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\0 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Key created \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe Set value (str) \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\FloatingPointProcessor\1\Identifier = "Intel64 Family 6 Model 13 Stepping 2" 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1160 wrote to memory of 3000 1160 662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe"C:\Users\Admin\AppData\Local\Temp\662cffb1c1083754dac3dd7153b2269c95b2bc7c17e227e74d15ef7d4cf79d6c.exe"1⤵
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\windows\system32\crn3zx.exeC:\windows\system32\crn3zx.exe2⤵PID:3000
-