K鰱;7�p�Ů7���@_��U��;*tA7^�R���I]ڃ�P� 4�*���A����C�J)FV�%�6YjGw)>�5? � ۄ�AWh�Vh� ӂ_�4O.O��\J�u�l���4�Bh͈���ެ�H������e��{���L�IB�Dž�6Rwz��ILJo}Z���AG� oq=�Vm���w<� K��%��^.ox'���if�DYqo�][�h����E}���lx>�Q��W1���ϥ���M�?|����Te�P��E����X`9�@&��useA<�j�W��Z-zύ%��z�W H��^Hua���!>����Z��ט\Qd.��� ɜ ���Ҙ��Z�6}���og���ڑ"dIʼn!�q�.Ew^�Y�x�������s6Mg����=PQ�z��d����j=�*�'�oH�[n�w,)�]��CO _�x�y����Y��5di�oB��.5�!���1�M<iGh����!�-�̽6$W6"�<�a.e�ح͑��Xd�:#L(O��綼W�,v���s��.��T�� y�U�����:�2����~�r�+�Wkbʥ�e�0�k��d���M|\q�.��K�����7M�uH�wֿ�Ai��x'�^O; �T�����jJ�z���'��W.D��/�C#�d�P@4��3$�e��d�fa��F����³��A8� ��qa�o��o�D���h,��r�����\�8E�����α>z�`�G�'�kR������/�1�U$ܻ妐QS�v}>�uc�Wn�Ej�'S12�K@�cw5�0�6]U�/��!�hW*�&�)�7�~�E��ۮ�2�+�à(�t���.o�s�����DDܜ@V��qe�>��gL��$0r�c�]�S� ��r�.��p��E��PP���~�������t�u����I�(�����6�+|��uT���C&,|���=+����a>=Q.#X����h���6��P�r1����,����+�Z`�8����\��>+�̸�`:W����8�H9��%��V�Pv����X�e �$����"_���0~��H%��j���ſ�f�G�wh�̫���z0�>+��L��v�>����Cp]��g� 3pԃ��t�،���]��e��S�&n�8��9���i�9�� ǛLSg�,J�7W�J��� J{� �y�RF�h���a.@�hy�9x���G,�U�2lW kZo=�t��?�xGi/0�m���8@�������w�u+G9ڏq�x� v{Ϩi�n3���/g��;�<`Ʋ��w�R�� ~�.�@Z�pǘ{zVw�5|��V���R�8��'���5�� ���YYeO�%�QO��}��C�b�)�&ڶ������Hf�z�[�>�q�����1��Y2]0�$�v���nX����pPB���j��D1���@��ǒ�#��6���4�}7$��ƍ���2D2I:}��u�H��h�r����Ƃ��$È#�zL�Zr���(FJ�$���$����喣� W�ݠVa ����$*�"� �^�� `��2x��M+�7#�.�l�_L��)9���N��RA�ND�8���:w�T;����V�|sX�X�p���@݆���/=�j���������g�DzE�1�)α|^S��������dڞƖ�؇�nb��0���&����ԋ���y ���Ż)�?O� ���/�ݥ�ku���~]v6�<�i����f��^D������Ֆ<��n�o�#�S�EKC��� �tw�������O#u�_=�.��ٹ�.n��0 z��2���ߵ�%��C*��z�]�|pS�M���������_�:��lz�����Vkך�T���E;p7��l���+�a�-�DŧD�~jE�����Q��M�{�șLp̚WLJa�l:��/�}R����3��Q;�-�C<���e�|�� Ǵ;A��X��z��dL�� ��G�5�)ZT��wQ^��2Jik3y}�b�D���Ȅ,������SR���(�.����������[�`7��w���Hr�u�C����w%⋄���谭>�u���d�+�- Y�O�:2�d�ĄT�d�*�������� G :�U�YU���2��l;��(�F)���Q������M�v���S��8��N��1�d*���o$|��5-�7Ӆie�P���5,�[�I���櫡GK����m�a�|$+aKKHY�ƣ� �Rմhm IE�o~�u-�&�4\v������S�C�l���b*õ%��RD.Wf��wv��:+��#��S|I�0y�LA'ƀ��� a�)�Wt܇�"�H�3J]��x��L�ǮK���3k�5���Z�<h�t�$ߒ=Γ�t� sQ4H�y[r�_7PK��O�C�H��^K: �`���#�3t38Q��B�bjy���mU7�eb��d+�)G-�I��x�|���m�[��)p���I� �i���v�"�\Ȉf�m@Unb"K��]��awIcsah`$U�7_|�#� �������^���˕�^r�v� ��J(e3�T���=`I@��{�����\b��>�����;��{��,�L)�9��"-�,��`&*�+Glgx�1?j�������yr �ڞ�לr�z���x������B��O{���,���I���g�#��v�����1����8�绀���撺rZ����n-Ύa���w���#��D����!ׇHf8��] 묤�X���}�7c�TGW\҃�Q+�a�? �(eV�# ��:$d�pn��f��6�<l�F�o � "X�qKR�b����5��������PAz���p�s��B��6�$�vn�YE�����Ul���=`�ƍ㏸�=:+k9���~�2�)�T�%��8Vn�1�dݻ�yȵ��6�O6������/�[�::��'g8�d�llM�f�B���Slʠ_1W�����r��y�<s4ꚤɞ��b��&jE�菸�F'��B$ܬ���4�|���^��g�<�D��:����Vq�-o�9��� Ώ��[Ng��> ���ʕl�� ��|'�3h{Qw�F��U�P
Behavioral task
behavioral1
Sample
Hwid_Spoofer.exe
Resource
win10v2004-20240221-en
Behavioral task
behavioral2
Sample
Hwid_Spoofer.exe
Resource
win11-20240221-en
General
-
Target
Hwid_Spoofer.exe
-
Size
6.4MB
-
MD5
cefd581a70fe5ee215940b4457087e4a
-
SHA1
9d52d6bc22444b913e7ad3c3c3e00b2dcccb5c68
-
SHA256
250450bbf9aeb9ae6acd8b459a701da1d5ed3aedd22af55fa6fcbfc73ccc5876
-
SHA512
5d8204dd08ea71e3826ddd95225dc0a36529e4b74ec221d424acfdb4f9a62312f033e92bc2c61fe23c5d60df517d8a7ce2d54f80f60b500901023ba24b264cf3
-
SSDEEP
196608:9+wwbc7zI2f5ojEUh6dj3k7MTHotpt2cvRf9h86DHvg:Qzo3Ff2LhiLk7M4R91
Malware Config
Signatures
-
resource yara_rule sample vmprotect -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource Hwid_Spoofer.exe
Files
-
Hwid_Spoofer.exe.exe windows:6 windows x64 arch:x64
0624dac67380eec05d3e8766aabfad8c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
FreeLibrary
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
BlockInput
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
CryptEncrypt
shell32
ShellExecuteA
msvcp140
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
psapi
GetModuleInformation
ntdll
RtlAdjustPrivilege
normaliz
IdnToAscii
wldap32
ord26
crypt32
CertFreeCertificateChain
ws2_32
connect
rpcrt4
RpcStringFreeA
userenv
UnloadUserProfile
vcruntime140_1
__CxxFrameHandler4
vcruntime140
__std_exception_copy
api-ms-win-crt-runtime-l1-1-0
_invalid_parameter_noinfo
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-heap-l1-1-0
free
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-locale-l1-1-0
localeconv
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-string-l1-1-0
strpbrk
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 460KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 106KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 17KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 6.4MB - Virtual size: 6.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 200B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ