6633dc1065eb03be134931bd57332c8ed34a289d5fe181e156c303b36dc0fbce

Analysis

max time kernel
98s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
01/09/2024, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HWID Spoofer/STEP 8 - Monitor HWID/restart.exe
Size 63KB
Sample240901-rxexqatfjd
SHA256 b68ee265308dc9da7dbb521bb71238d27ac50a5ee816f21c13818393be982d7a
MD5 8242ce426ad462eff02edae1487a6949
SHA1 9a4f382d427e0de729053535aaa3310cac5f087b
SHA512 aff43a78d29ede49eac386d9b0b44d0f37d5a20bdda8553369d68dec90bbc727c6dd8fe239987a9d2e3affaeff8b72b5023ed973d7aecfbb99de46dca8c99ef1
SSDEEP 768:xa+/MMnf2XivrjhmxEQSQIjDaGva2XaT+CSxKUAch9Itvo7vq2XFelWn2iED5Vx0:xa0wstmSpDaGS2RCSxK28otXFQwUx
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 6 IoCs

description	ioc	Process
File created	C:\Windows\system32\perfh009.dat	WMIADAP.EXE
File created	C:\Windows\system32\PerfStringBackup.TMP	WMIADAP.EXE
File opened for modification	C:\Windows\system32\PerfStringBackup.INI	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.h	WMIADAP.EXE
File created	C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini	WMIADAP.EXE
File created	C:\Windows\system32\perfc009.dat	WMIADAP.EXE

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.h	WMIADAP.EXE
File created	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE
File opened for modification	C:\Windows\inf\WmiApRpl\WmiApRpl.ini	WMIADAP.EXE

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	restart.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe
4548	restart64.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4548	restart64.exe
Token: 33	5108	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	5108	AUDIODG.EXE
Token: SeLoadDriverPrivilege	4548	restart64.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4548	restart64.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 4548	1944	restart.exe	81
PID 1944 wrote to memory of 4548	1944	restart.exe	81

C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\STEP 8 - Monitor HWID\restart.exe
"C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\STEP 8 - Monitor HWID\restart.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\STEP 8 - Monitor HWID\restart64.exe
  restart64.exe
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:4548

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004E8 0x00000000000004F0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5108

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService
1⤵
PID:1448

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /R /T
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

perfc009.dat

Path C:\Windows\System32\perfc009.dat
Size 132KB
SHA256 ff5f0b114b1b4a774e00dfb7cbca55e867fe92361788c1790abfa5dd24f949bd
MD5 b85d1f8d494b4d2ca0677e559ee94d44
SHA1 36b90483ac2110165d8a34c17e0d17f6c9ff1f6b
SHA512 2b25c8adb58a1034e0981ae9cfaaf3c74ded58c380610d98106c56d1a4ce319706b01ef8c25e76131f00cca84fd014a5670a176f421123659270369555a16ff3
SSDEEP 3072:XVWO1h5BJ53ro2tAIO2pWprytWo3KvoJVVrBfYi5:QoJVV5
MD5 SHA1 SHA512 SSDEEP

Submit Download

perfh009.dat

Path C:\Windows\System32\perfh009.dat
Size 699KB
SHA256 2e4b510ab605c8487fd2ee9e0cafa76f77f4ab99d34f3bfc43a180aafce9cc4e
MD5 47d6084d814dd0528f2d0ce0b0d6cf36
SHA1 f31ceb806b1ac1b6dbf7130a315491b3e9755bd5
SHA512 be7ce364dbbc859517bf255b08370ce574e505fbd3f9e9c4787d2e14d807e993da8b01ba48040e6c9c65bfba6567f9692153ab197e1593201eda04dbc3d26dc6
SSDEEP 3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHXOZocUqYm3MEnBeHsZhgX3eTxg5o/3ZdOd:78M6d0/OZLMbjNOCd
MD5 SHA1 SHA512 SSDEEP

Submit Download

WmiApRpl.h

Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
Size 3KB
SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
MD5 b133a676d139032a27de3d9619e70091
SHA1 1248aa89938a13640252a79113930ede2f26f1fa
SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
MD5 SHA1 SHA512

Submit Download

WmiApRpl.ini

Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
Size 29KB
SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
MD5 ffdeea82ba4a5a65585103dd2a922dfe
SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a
SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
MD5 SHA1 SHA512 SSDEEP

Submit Download