43fb72b807543c00de7844368fe75ba6145ce2e7e1b926a4cb601535bd94a1b3

Analysis

user interaction
yes
max time kernel
8s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/09/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sdfg.exe
Size 14.0MB
Sample260905-yepgrsysdz
SHA256 43fb72b807543c00de7844368fe75ba6145ce2e7e1b926a4cb601535bd94a1b3
MD5 94323726aefc8c78be82231d0c8bd43c
SHA1 2f91ee6e9832057476598e5613f2f6139d015016
SHA512 44b5cfb101847f54924ebe2ec3b32e944025fda840383df02873667079f36eab7d63f4c1883493fe4c3724da8c3d434a1eba58f7ff0542c9da99242cb8179c32
SSDEEP 196608:BNDNGuVCWlz9DDsgBq8vCKLjQcZhritwm3kmHVd1z2PAgqwdsSEX:BNDfX95qlYMJiE/2YgqwV
TLSH
T10FE6188032189114E9DC3A3701E3170C2F66A5D3DBB7F1D6BA9D9B2154722F9984F8AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

Malware Config

Signatures

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	sdfg.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	sdfg.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	sdfg.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	sdfg.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1656	sdfg.exe

C:\Users\Admin\AppData\Local\Temp\sdfg.exe
"C:\Users\Admin\AppData\Local\Temp\sdfg.exe"
1⤵
- Checks BIOS information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1656-0-0x00000269D9A30000-0x00000269DA82E000-memory.dmp

Download

memory/1656-1-0x00000269DC660000-0x00000269DC670000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads