Analysis

  • max time kernel
    0s
  • max time network
    116s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231129-en
  • resource tags

    arch:x64arch:x86image:win11-20231129-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/12/2023, 16:27

General

  • Target

    hwid-spoofer.exe

  • Size

    266KB

  • MD5

    322f7016ccf0835c39375dfc42370222

  • SHA1

    701a2e8c1d8976c7b5b6a49d6449a4ff92dba6ee

  • SHA256

    9945aca9c51b2d420585e28adcb500631f27e4322e07afc1f13b7b690d177d0c

  • SHA512

    82fc8db901bd68ba322635d8a1d7d515f3b61cdf2a65d0c5f132ce7f0a3b74dd4545ed7c762707510a225e0adb91516a468019b264bd7ac625fe24ffc6e6aefb

  • SSDEEP

    6144:amBvRxy3LhH3R8QG18lS8kjdiWNAYot/lKyy8rw/8E/lx1q:BxfeZk1oGNyy8rwUE/8

Score
7/10

Malware Config

Signatures

  • VMProtect packed file 1 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Program crash 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hwid-spoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\hwid-spoofer.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2452
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2452 -s 1924
      2⤵
      • Program crash
      PID:1040
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 352 -p 2452 -ip 2452
    1⤵
      PID:3972

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/2452-1-0x0000000074F60000-0x0000000075711000-memory.dmp

            Filesize

            7.7MB

          • memory/2452-0-0x0000000000C80000-0x0000000000CF4000-memory.dmp

            Filesize

            464KB

          • memory/2452-5-0x0000000007A90000-0x0000000007AA0000-memory.dmp

            Filesize

            64KB

          • memory/2452-4-0x0000000007A90000-0x0000000007AA0000-memory.dmp

            Filesize

            64KB

          • memory/2452-3-0x0000000007A90000-0x0000000007AA0000-memory.dmp

            Filesize

            64KB

          • memory/2452-2-0x0000000007A90000-0x0000000007AA0000-memory.dmp

            Filesize

            64KB

          • memory/2452-6-0x0000000074F60000-0x0000000075711000-memory.dmp

            Filesize

            7.7MB