6633dc1065eb03be134931bd57332c8ed34a289d5fe181e156c303b36dc0fbce

Sharing

Copy URL Twitter E-mail

General

Target
HWID Spoofer.rar
Size 2.5MB
Sample240901-rxexqatfjd
SHA256 6633dc1065eb03be134931bd57332c8ed34a289d5fe181e156c303b36dc0fbce
MD5 4e397ee45aa2f12f5abfeae5abcaa765
SHA1 fa9182fad3545bdbd84b58cfe3624bdc24cfdc2e
SHA512 0f1507d623990d33f560cf23b9b38875d1b0f8238771c618b2aa820a519982fca076a9511034115f83cec66d042794e84b253e22ca59e5fbbf50303039642496
SSDEEP 49152:yVBi65s42EY6Aa77AWODCWoxX4TLnpiBXT84C96uzSJehL2UERHCzY:yzik12q77AWlGTzpaHHJCL7EuY
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery

Malware Config

Targets

- Target
  HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Download Revo Uninstaller.url
- Size 153B
- SHA256 f6db928c42771e18d7795dab63dc991ec8d3dc371e8b4804d467f65ce11c607f
- MD5 b8af8aa3d0d8003e486b3f952bafbaac
- SHA1 d452237651cb4b04ea8ade827cbb3512f69c0f9d
- SHA512 a34972401cca357962507ac28907ad83eac902235f52608b77a1ee005032bbf5f76fbc65a2bead1d5cab85ff867641926a281a0fb3df145282bbd93e8de49b7f
- MD5 SHA1 SHA512
Score

1^/10
behavioral1
- Target
  HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Updated Step 1 - Follow instructions on website.url
- Size 148B
- SHA256 c7a9eb7d13feaaccf24d3cc3a591fe47dbcd1b228bd287c75422776aeb71a4e5
- MD5 ef9fa18d6d49e92eaf2324b0d014813a
- SHA1 f68a93434a8829909bb047bffb57b8271121f78d
- SHA512 5c44360313ce713b3fceaf1a16de6ce66fd2f567d225f80b813f88125a0e3bca21bfd0f4b3ad2a083398778a2183ac2df3e629f5cd57f46215db4e8fbc618b22
- MD5 SHA1 SHA512
Score

1^/10
behavioral2
- Target
  HWID Spoofer/STEP 2 - Edit HWID Registry keys/1. Registry Editor.lnk
- Size 1KB
- SHA256 64aa810fa77628dc199f75f54dd764c142b0a479cdb62e24f853a707ca3a2db5
- MD5 0e2092f136d0e7f155a6c688e34533dc
- SHA1 33f71faf7585c7a4a450b91f794334f200bf15f7
- SHA512 8057d335d66ca0257d7c53b3fd681efbd9123c7c5cb955c1b49cbca243e8550cc5210de9044b4481c311873c28fd79ad79f1d32905b473005584631fe61c4f92
- MD5 SHA1 SHA512
Score

3^/10
behavioral3
- Target
  HWID Spoofer/STEP 2 - Edit HWID Registry keys/3. GUID Generator Website.url
- Size 143B
- SHA256 21c4de7b2083d60d3f0d2f38e70d1b2a1e0049279b1ade9ba900a77d2e3a64e4
- MD5 dc2726585a60180658c2fb0714e436b8
- SHA1 1568187c8c250ca83340f02d8df4695680a5b0ff
- SHA512 5c495093a71613bbee9e83ca59155c43263274dd9bb83fb6d456ee4c23ed8e7bb11ea2ade66f1e18c83d33f03771ede3da80c50fc7c97809322487cd650f6ce9
- MD5 SHA1 SHA512
Score

1^/10
behavioral4
- Target
  HWID Spoofer/STEP 3 - Mask your IP Address/1. Download NordVPN.url
- Size 128B
- SHA256 89ff7443cc30c87127b75fe899648c8729beffd67cb91940ca97cacf9085f17f
- MD5 92a3e5db54b4166e789b643b53be9004
- SHA1 1806667f266b68f92272cb45dce83811633c3d6a
- SHA512 a529d0691a6307261cc1a94c1c83df0949552105614bb8c472f684cdabd29970cf451e7c383191eedc198b2068f1749bdfb4727827c5573017914930b73206d3
- MD5 SHA1 SHA512
Score

1^/10
behavioral5
- Target
  HWID Spoofer/STEP 4 -Disk Serial NumberID/1. Change Disk IDs.cmd
- Size 1KB
- SHA256 282932d8caacf613b7167f674a84d320af5b9e253f21c8134c46ce25ff4bb07b
- MD5 6346b33980b7d8946c1f0dba5cbfd7f9
- SHA1 c42c97f649afa4b408d25e003277f89b4cdbe7d8
- SHA512 bef23ec08e2e9623a1b8769c509726e36e8d91b23593d59f38a3c7848ea6d07b963728a33ba74cde6da27f1944ca06ed4dd58eed4c7456c0e5c942ae227c2320
- MD5 SHA1 SHA512
Score

1^/10
behavioral6
- Target
  HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid.exe
- Size 228KB
- SHA256 22a2484d7fa799e6e71e310141614884f3bc8dad8ac749b6f1c475b5398a72f3
- MD5 4d867033b27c8a603de4885b449c4923
- SHA1 f1ace1a241bab6efb3c7059a68b6e9bbe258da83
- SHA512 b5d6d4a58d8780a43e69964f80525905224fa020c0032e637cd25557097e331f63d156cceaaacfe1a692ca8cea8d8bd1b219468b6b8e4827c90febe1535a5702
- SSDEEP 3072:OgfbRmDIHA98kK2WndTslNac+dA6YdqhsXCNZpp4GIoHZUFozD3zgJwDmr9u76v9:OSCgkKdcg9vCoaoMpcto
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral7
- Target
  HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid64.exe
- Size 165KB
- SHA256 fb0d02ea26bb1e5df5a07147931caf1ae3d7d1d9b4d83f168b678e7f3a1c0ecd
- MD5 81a45f1a91448313b76d2e6d5308aa7a
- SHA1 0d615343d5de03da03bce52e11b233093b404083
- SHA512 675662f84dfcbf33311f5830db70bff50b6e8a34a4a926de6369c446ea2b1cf8a63e9c94e5a5c2e1d226248f0361a1698448f82118ac4de5a92b64d8fdf8815d
- SSDEEP 3072:PngbfXWm18pX82lOl7NuT7DLM5Weo5UFs5QM8JwDmtFk1glurXEa:/gbfXWVoRNuT7DkbFsKM1glI
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral8
- Target
  HWID Spoofer/STEP 5 - HWIDs of everything/1. Change ALL HWIDs.cmd
- Size 2KB
- SHA256 74bfdf73031582b1e9431d72fb017a349f279f87d6dddcea63b0eee5c90c3545
- MD5 f79a031d21d43d3293a56d6351070c36
- SHA1 b51ec3847bdc77e15bcacdd8b5a0755de9ce0101
- SHA512 fb0bfd1eca976ed91aa45b5cec5f94fbb1fcf9e57634a25c5867ff5287dc14681533cb1467b850d23c9d719c32578d384dd18e3a4049af6aa8863548d724fbd3
- MD5 SHA1 SHA512
Score

1^/10
behavioral9
- Target
  HWID Spoofer/STEP 5 - HWIDs of everything/_/AMIDEWINx64.EXE
- Size 455KB
- SHA256 13037eedd91f9313ec0d807947db65c639642e5ae6497e87d12fa6d19951f78e
- MD5 9adfcdac59db3286690c7eede8da2528
- SHA1 0b54d251438a634bd13b49a1f20587cf03d4598d
- SHA512 fde1700cdb4212593ec2733944a169c7d02f436ca6831719a33482fbfd0be289697c9aa6ce7ddfb6c245e87952b35416929bbf69753d21a24197ac6c2d1243cc
- SSDEEP 6144:PRx1SY2XTh/Fq+1VU1/SznTh8NUc9v4/nOmNAFw+lgBwFejOLlC:PR/2N/I+rUqE9inOmNAFwa/TQ
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral10
- Target
  HWID Spoofer/STEP 5 - HWIDs of everything/_/Command Prompt.lnk
- Size 1KB
- SHA256 8bee776a81eedf942937bf03cdec43b1b37f9bc1f4e10a031fb2517fd181d8bc
- MD5 6cba9707b339f1756673d2ed33b5a37a
- SHA1 373e60b3c971605d783a4c6ae44c4ea50322c49a
- SHA512 d670e3be8c72e923c89e3bd18457f8ee1155fca307eb2bcd3970381ff9e761a14eec3d926e5e2091811d4bc3b5bbcb008ee6115c99cf3309444d544966446360
- MD5 SHA1 SHA512
Score

3^/10
behavioral11
- Target
  HWID Spoofer/STEP 5 - HWIDs of everything/_/amifldrv64.sys
- Size 29KB
- SHA256 65c26276cadda7a36f8977d1d01120edb5c3418be2317d501761092d5f9916c9
- MD5 f22740ba54a400fd2be7690bb204aa08
- SHA1 5812387783d61c6ab5702213bb968590a18065e3
- SHA512 ac1f89736cf348f634b526569b5783118a1a35324f9ce2f2804001e5a04751f8cc21d09bfa1c4803cd14a64152beba868f5ecf119f10fa3ccbe680d2fb481500
- SSDEEP 384:qvOTI5HIPy54ygZOq0HMMKf69JG8QnuOfZFnJtQSZsHLPK6jjMYiWPFRUI5xl9Wn:qvsUoK54ZCMMb9U82uO7Jt6PKg4YHUc+
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral12
- Target
  HWID Spoofer/STEP 6 - MAC address/1. Install TMACv6.0.7_Setup.exe
- Size 5.1MB
- SHA256 a453b3ea8d8133531fad26b18701c694c324cc201e3069d07e99f0e100908c1a
- MD5 a7c8cf1d50ebe630a7d0c47686a0abbf
- SHA1 3229e8080975f4f5512d2382552f68c0389acff5
- SHA512 42340b7435605049e3f817feac1ac238177772b2b1ebf05eb9311bb58ee3dd1cab39913240a4c39e3407374009310770d8221c31914549524ecd92beab93b787
- SSDEEP 98304:ARU3j4wtopcj2dqCYV1coZ4hv3tmF1b6CrjfW/sfH6s7zQcKDsVv/JLSF66b/:ARqt/CdqRc64hv3tmF1b6CffW/sfH6sm
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral13
- Target
  HWID Spoofer/STEP 8 - Monitor HWID/CRU.exe
- Size 1.2MB
- SHA256 8e151b2a680913f627052e18349fb9a4151c7b9ed7afa13b45df3923f450c8ab
- MD5 33ddbeafa1ef85263ff2de5f95b271ef
- SHA1 a5736867ac8d2ce41f8600ff32e949c8b1825854
- SHA512 758c5cb44be54693361f7519f1c6d4468fc40b2603a3871c8da85b96b97668aae8850ce4319cac60dde22dd5cbf50121a804233782a4f2db22f6fe30ad41f13e
- SSDEEP 24576:wR63SAdWjAvfArbdNBWQV4sU1FR5HcIT/FVAY+t+QzyTcO:GbdNAbc0o1Ec
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral14
- Target
  HWID Spoofer/STEP 8 - Monitor HWID/reset-all.exe
- Size 51KB
- SHA256 70639c195430afb92799d711ed784406bfdfd04c648d5f3e4d9873da0063660b
- MD5 3d47586c62bf61dac639d8cc1bf43ee7
- SHA1 36f605e1fb7cae972c6723ded6a5f126f36a8d01
- SHA512 638a75c0159de8553e8071a68b5a4355bfc002489d9ed62bfbb1019d287073a555133bd4a55abd68c51b3e2a1616f586a26998ce32ade322cd72ffeab5ffe105
- SSDEEP 768:Jd0XBRNU+hV81e14G8xGvMhBmqVHhc6ZrLy01fA5Egt2rHNZAEDFn27DQNE5B:b0XbeQ8xG0Kqjc6lLFfSortZBMDu8
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral15
- Target
  HWID Spoofer/STEP 8 - Monitor HWID/restart.exe
- Size 63KB
- SHA256 b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
- MD5 8242ce426ad462eff02edae1487a6949
- SHA1 9a4f382d427e0de729053535aaa3310cac5f087b
- SHA512 aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
- SSDEEP 768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10

discovery
- Drops file in System32 directory
behavioral16
- Target
  HWID Spoofer/STEP 8 - Monitor HWID/restart64.exe
- Size 73KB
- SHA256 5f779bb822aedaf5bd11693cdf73f6c7c3342f37371a78c07c2aca1e15dbfd00
- MD5 297aa19bade534a791d053ca190b74ad
- SHA1 15cb6a33994f75fe9e30a2afbc8a7e4616b63962
- SHA512 df883950c598f31b81f22a68b2a9fed7459dcad5084ec6e39399658b0492bcc458d9fc5bb80fda6bc994bed3241f969fc67a0b8e021fb82b040455d64776c625
- SSDEEP 1536:8vXMJl7uRupZzidl/T+Dnx86Rpy4roKsIrryeq3OTM:8vMJl6RAZu/T+7x8qpRM8rNcOTM
- MD5 SHA1 SHA512 SSDEEP
Score

5^/10
- Drops file in System32 directory
behavioral17
- Target
  HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.chm
- Size 24KB
- SHA256 63606a5617a62060a2894904bf28d53f9f80cbe7b1be885cec114173d054767c
- MD5 411e4fba3110e963a85ceaf46e8cedd2
- SHA1 4272eb5976e951c448fab798f7b1fb0437f8f148
- SHA512 c8cdb839b6a49591a64a949d8602ef14703d47a7c90b300db9a4b64fd59a8e3b3e6ee6f4881732a05ff480fc23241848cc99852733e1049da5342b7b4e176ce4
- SSDEEP 384:9TXSD100stETnEaqFqFWWreTy7H9CluSY1t5A2Xzo:9TCDWtEL8Fy0yH92zY1/A2Do
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral18
- Target
  HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.exe
- Size 189KB
- SHA256 95e50f7eea21bfed82a34a24bc5d66029146c7b988e889b11f30b45cb364dcf1
- MD5 5c1729d2611fdcaeeadd238c1f0427c7
- SHA1 ddcfca0994cc92783d6a942075166f026c88ed07
- SHA512 47c608e0590e1f73c32a0c677f9b81738fb188b27243e99d514911158d673f18ae7ef99ea897e87c850c5588eae19e3d6ae8736e0a974dd51f438f5190e362c5
- SSDEEP 3072:3FSG80yvkmcA4bEvLhWoLdpxgZZapW9T8iXcWWbgYrrzwKeugTedajIHNNSP7g8x:fyvkC6EvLhTLdpxgZRbWJdBHNNSd689
- MD5 SHA1 SHA512 SSDEEP
Score

6^/10
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry
  Disk information is often read in order to detect sandboxing environments.
behavioral19

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops file in System32 directory

Drops file in System32 directory

Enumerates connected drives

Maps connected drives based on registry

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19