Analysis

  • max time kernel
    91s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2023, 16:27

General

  • Target

    hwid-spoofer.exe

  • Size

    266KB

  • MD5

    322f7016ccf0835c39375dfc42370222

  • SHA1

    701a2e8c1d8976c7b5b6a49d6449a4ff92dba6ee

  • SHA256

    9945aca9c51b2d420585e28adcb500631f27e4322e07afc1f13b7b690d177d0c

  • SHA512

    82fc8db901bd68ba322635d8a1d7d515f3b61cdf2a65d0c5f132ce7f0a3b74dd4545ed7c762707510a225e0adb91516a468019b264bd7ac625fe24ffc6e6aefb

  • SSDEEP

    6144:amBvRxy3LhH3R8QG18lS8kjdiWNAYot/lKyy8rw/8E/lx1q:BxfeZk1oGNyy8rwUE/8

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hwid-spoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\hwid-spoofer.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2204
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2204 -s 1876
      2⤵
      • Program crash
      PID:4956
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 2204 -ip 2204
    1⤵
      PID:3672

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2204-0-0x0000000000BA0000-0x0000000000C14000-memory.dmp

            Filesize

            464KB

          • memory/2204-1-0x0000000074560000-0x0000000074D10000-memory.dmp

            Filesize

            7.7MB

          • memory/2204-5-0x00000000077F0000-0x0000000007800000-memory.dmp

            Filesize

            64KB

          • memory/2204-4-0x00000000077F0000-0x0000000007800000-memory.dmp

            Filesize

            64KB

          • memory/2204-3-0x00000000077F0000-0x0000000007800000-memory.dmp

            Filesize

            64KB

          • memory/2204-2-0x00000000077F0000-0x0000000007800000-memory.dmp

            Filesize

            64KB

          • memory/2204-6-0x0000000074560000-0x0000000074D10000-memory.dmp

            Filesize

            7.7MB