0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121

Peripheral Device Discovery

System Information Discovery

ioc	Process
\??\D:\	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
\??\E:\	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
\??\F:\	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
\??\G:\	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe

Maps connected drives based on registry 3 TTPs 3 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\Count	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\DeviceDesc	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\DeviceDesc	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe

C:\Users\Admin\AppData\Local\Temp\0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe
"C:\Users\Admin\AppData\Local\Temp\0c5f5128863d2941055e187b3e9346a072230bff005a5bbf924c2664d561e121.exe"
1⤵
- Enumerates connected drives
- Maps connected drives based on registry
- Reads the TCP/IP host and domain name from the registry
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
PID:2996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery