��WQ��ʇ���n����Dr�uT�xD� �ZHĿ��>D#�c�1t����Ķ���4X��nZ_��2�E�GhSc9��^� ��b+��v� �v��(��0�P�3K@r_ϐ10��Fstf�l[^cky����˞����^�M-j�����֎;����}m2&�Ɂ���H `]f��K��X�������W>`�V[ �.����26�j��D�x�.��� =�^^�"��v�4A}�E�f�����ʙ5��ٴx}�-5���]��$k��.k�x:?$`d��s��#ŝ���3e�g�A��F�&,8Pq�hu'��K:�C��/6���+>Q� �B�i0��f�/EO�b��d�f��UIc�eD�Oe�w�����x�25�cd?�5�>�'twl��l\�����8g����2����<:���d4߯=���������Hf!�/2�E촙�\�u��0[�?������N���bɫ��R��9��(}*��Ǐپ�P����éC���1`�!�f�]��� %��f8pu�������� !;ђ�f!���--�sg���3ԧ�Ob�@�i��+�s�L.�d-$2�N����u)@y���:��9��^��d�:�-��W���ǖy�z�����%D� �'S{��_��u�?���c3!��l�!)�/H��Z�ѫ�+�ҽ����ӑ�OBl̈�d���y�1���.�K���wӒ��A%���/��� �0h��%�,��{!vF�d����)��E�]��j�(�H��wN���0pD"q4c��5����|{��:�2�M���?������4�c���t��#M[Z7��ת�\_Zݢ]�I�E��=�d7��5��@�WdC��>�@�m���xWu�bKQˎ�ٴM�c�y���=f; 2J 8��n��9����k*�)8�q?��n��f�=����a���k�K��r_ qV��T� iy"�4�5��06(5ԙÄ̼��Η��KfI�!�s�i��Lxb�]�n�B(�uM=����/�3��~y7w�W�������t��KL�%���13�K�:8K��Gݵ�m�p_�;yʑ7���"�'V�+T���lX S0�'Ζ�����*'��YN� � �΅��J$*0�!,��Nc4y��r$)<��γҐ��Ң{�0��B����Oe��\�1pyfDœ���S�-�#�r����@m3��:]$G��i�a�Z1��g�|�d�([�)Y�����D>q]���V����O��k�z���q���`Ի�l����1�K8��"�w"������`oL�Gb����Z�0��0�����4o��T�&;�7L֟`��r�l���r�����`�}�f(�:���n�8��=�p�*~+lT���K���i�m]�ˈ|^���j��ض��r�v��ZX���aTP��8@C/�0�W��������)�f�!b��a:�c|J���Pf� v��\�I�N��&c9y����2�-���N����W�L)��P�g���`�0�g3�,:+�!̓�,�Y�@?��y�V�\؉ �c AQ�f�P�M�Țl��ng�l�@ C)��ܷ�\o3B�T��ϛ�e��Y�0LrdZ��#�x9�ͷ�,ضg�=�\��Ep�� ���J�Y7������*ۅ�̎����EI,y*�M5�.;Cž��H�=8>�@)����Y�woBS�����_�X[�E}��(*��/������4Yz���H}��:�����na�Pu$Y� X�O #�VV��F��쨫J՞QYD�͓����/�����$��s�V����%�g�IVE���N�R����$ASxk�7(��BXd��P�ݱ:�#X]�K!L��?a�ޥ�>Ns�6��qэ�vA@S4�3��B@m�$0:8���r��]�����[�u�U���)K-ٴyr��]@���I_�yف����̺�b���&��;�d��乣~�� �By�����-���s�j1�}|A\�!�qMX턣e� 5�j9���y_(�O��� �>oKO�cd^��Ǵ�܉X��\��<�ھ�,�����X�@����G���od��n��T��h��9{Vt.�8�3��Q^�WQ��xܯ������}�<jKKm*�ۡ;�"�4}�*�Hc����F\���N����< �:�BfQ%�hbJȥB������I=�I�9`o�+�P ڿ4M��^�H6;�.���NU*�z��c"����,�0�������S�%%�~~4���-@��L�i��X��fW���᥌��۲���9:��n-Y�_�{�+.���������M@ĺ�C��$+hw(�.�~ �)���E�-��l�nF�.�= Yphhh����FF|��N�ɍ�J��Ȉנ6;L���� W %��Q%1�8e�����A��H�1�a(��録���RwP����������e�<��V����,��bƻ^@�;Y��������U�^*Zw�)���V���Nrp�3�.0�@�(Xk����@d32ԥ�*���y�?�?_�#i�M/�p�*]]k���5u�� Y����$�p�"=�>`[ '�����ʆcC쌿y�{PbT���?$�х*�$z�X�Ņ�]6a�\���B�lEP�7k�'�wu�1�i�S���Wr�O�@��~��[-*�Rټ=��;�XR�;/��$��V��,^�s��j��'=��N�*��O��Az�!d:F��r��Uh����ZDu:K�?���4����h�xI9�rjp�$��]�BkC���387P/<e�~� �,��܊��Mu4���#Q��0���z��;�zk=���e���Z��t��US�q�S�^�K�s�C���P�kC :$�H�uk��Ilx^������y�*:�b���wb�$�p�݂��9����� ˲��{��Qo,b���(� �i�hr{N���ƐH�c: ���F�-�6nF�����K�����o�M��?a��^bz 8���镚�/4i��A��m;J�:��<�J�����O�xR�9D�&q:�3 >��Xc�ػ��
Static task
static1
Behavioral task
behavioral1
Sample
SpooferHwID.exe
Resource
win10-20231215-en
Behavioral task
behavioral2
Sample
SpooferHwID.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
SpooferHwID.exe
Resource
win11-20231222-en
General
-
Target
SpooferHwID.exe
-
Size
5.2MB
-
MD5
831062e7a290c88f2e2e60ee105a634b
-
SHA1
339110f520d416879c0ddd8c636ebc3b92471799
-
SHA256
169617d19dbaa44c07e49891bc0bd14a99d3b900ac211206649439f2153daa21
-
SHA512
e8277462575ac0b58f1280df7657dbe0d6498bde0b6887c0e736bc06d345051bcc8b0d1f489efcb469d2dcba0296efc3a5674fc585e8ee5a03c33c578822568e
-
SSDEEP
98304:p6cnHWv35owmpSpTiQEwtTuvPKBoswGnAiysZw0UW6Gp:cMY3XmfdwcAwK9ysZw7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource SpooferHwID.exe
Files
-
SpooferHwID.exe.exe windows:6 windows x64 arch:x64
2135a920cf6f00a5e645f590ed85f29c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
Sleep
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
msvcp140
?_Xlength_error@std@@YAXPEBD@Z
urlmon
URLDownloadToFileW
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
_initialize_onexit_table
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-stdio-l1-1-0
_set_fmode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
user32
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
Exports
Exports
Sections
4_RL^4Ag Size: - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
-6^qm+[< Size: - Virtual size: 6KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
7>zsdb9+ Size: - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
_@a_\)9J Size: - Virtual size: 684B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
gEXh1PUv Size: - Virtual size: 3.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
;8!:(o,G Size: 5.2MB - Virtual size: 5.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
u$o@?MvH Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ