Overview
overview
9Static
static
9HWID Spoof...er.url
windows11-21h2-x64
1HWID Spoof...te.url
windows11-21h2-x64
1HWID Spoof...or.lnk
windows11-21h2-x64
3HWID Spoof...te.url
windows11-21h2-x64
1HWID Spoof...PN.url
windows11-21h2-x64
1HWID Spoof...Ds.cmd
windows11-21h2-x64
1HWID Spoof...id.exe
windows11-21h2-x64
3HWID Spoof...64.exe
windows11-21h2-x64
1HWID Spoof...Ds.cmd
windows11-21h2-x64
1HWID Spoof...64.exe
windows11-21h2-x64
1HWID Spoof...pt.lnk
windows11-21h2-x64
3HWID Spoof...64.sys
windows11-21h2-x64
1HWID Spoof...up.exe
windows11-21h2-x64
3HWID Spoof...RU.exe
windows11-21h2-x64
3HWID Spoof...ll.exe
windows11-21h2-x64
3HWID Spoof...rt.exe
windows11-21h2-x64
5HWID Spoof...64.exe
windows11-21h2-x64
5HWID Spoof...ew.chm
windows11-21h2-x64
1HWID Spoof...ew.exe
windows11-21h2-x64
6Analysis
- max time kernel
69s - max time network
142s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system - submitted
01/09/2024, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Download Revo Uninstaller.url
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral2
Sample
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Updated Step 1 - Follow instructions on website.url
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
HWID Spoofer/STEP 2 - Edit HWID Registry keys/1. Registry Editor.lnk
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral4
Sample
HWID Spoofer/STEP 2 - Edit HWID Registry keys/3. GUID Generator Website.url
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
HWID Spoofer/STEP 3 - Mask your IP Address/1. Download NordVPN.url
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral6
Sample
HWID Spoofer/STEP 4 -Disk Serial NumberID/1. Change Disk IDs.cmd
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral8
Sample
HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid64.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/1. Change ALL HWIDs.cmd
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral10
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/_/AMIDEWINx64.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/_/Command Prompt.lnk
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral12
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/_/amifldrv64.sys
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
HWID Spoofer/STEP 6 - MAC address/1. Install TMACv6.0.7_Setup.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral14
Sample
HWID Spoofer/STEP 8 - Monitor HWID/CRU.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
HWID Spoofer/STEP 8 - Monitor HWID/reset-all.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral16
Sample
HWID Spoofer/STEP 8 - Monitor HWID/restart.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
HWID Spoofer/STEP 8 - Monitor HWID/restart64.exe
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral18
Sample
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.chm
Resource
win11-20240802-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.exe
Resource
win11-20240802-en
windows11-21h2-x64
General
- Target HWID Spoofer/STEP 8 - Monitor HWID/restart64.exe
- Size 73KB
- Sample240901-rxexqatfjd
- SHA256 5f779bb822aedaf5bd11693cdf73f6c7c3342f37371a78c07c2aca1e15dbfd00
- MD5 297aa19bade534a791d053ca190b74ad
- SHA1 15cb6a33994f75fe9e30a2afbc8a7e4616b63962
- SHA512 df883950c598f31b81f22a68b2a9fed7459dcad5084ec6e39399658b0492bcc458d9fc5bb80fda6bc994bed3241f969fc67a0b8e021fb82b040455d64776c625
- SSDEEP 1536:8vXMJl7uRupZzidl/T+Dnx86Rpy4roKsIrryeq3OTM:8vMJl6RAZu/T+7x8qpRM8rNcOTM
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops file in System32 directory 6 IoCs
description ioc Process File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.h WMIADAP.EXE File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini WMIADAP.EXE File created C:\Windows\system32\perfc009.dat WMIADAP.EXE File created C:\Windows\system32\perfh009.dat WMIADAP.EXE File created C:\Windows\system32\PerfStringBackup.TMP WMIADAP.EXE File opened for modification C:\Windows\system32\PerfStringBackup.INI WMIADAP.EXE - Drops file in Windows directory 4 IoCs
description ioc Process File created C:\Windows\inf\WmiApRpl\WmiApRpl.ini WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.ini WMIADAP.EXE File created C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE File opened for modification C:\Windows\inf\WmiApRpl\WmiApRpl.h WMIADAP.EXE - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe 4164 restart64.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeLoadDriverPrivilege 4164 restart64.exe Token: SeLoadDriverPrivilege 4164 restart64.exe Token: 33 4916 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4916 AUDIODG.EXE - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4164 restart64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\STEP 8 - Monitor HWID\restart64.exe"C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\STEP 8 - Monitor HWID\restart64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4164
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D4 0x00000000000004D01⤵
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DisplayEnhancementService1⤵PID:4924
-
C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /R /T1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:3216
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\System32\perfc009.dat
- Size 128KB
- SHA256 c08bb34abb284c2fb15d4372c2c3c2387f71ebeb920be89c9079e96c7a4ca3ec
- MD5 a9ae270f03cd818fc5ccb1fc114ed0f8
- SHA1 57cfce4c18c0163fd41652ab89e4c51649eee492
- SHA512 5fa35050038e187b0be9547ff86e49aa5272a273eefb83472758da5b818e4e86eba254422b4524fb7a4bd66bd5c3ae210162cab1247b601ea1a3fc6454703ef0
- SSDEEP 3072:XVWO1h5BJ53ro2tAIO2pWprytWo3KvoJVVrBfYiC:QoJVVC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\perfh009.dat
- Size 699KB
- SHA256 94ddaf67c6973113ef2992feab11bd2147194541c8c8efc82f7b51e89fc08a25
- MD5 a89ae42f5a026c19299f9fa3278556cd
- SHA1 ec0a61aa2b89c9f80c734006446f124530e0f66b
- SHA512 fad978dd060c6a507d8be487d8478f4f550c2e3fa440c8b3f90c19771f9e2b0d34ead3fad6f026ea233bbd5ec0f5274b7dc6bab4ea4d090322d4406edd3a836e
- SSDEEP 3072:NUdGNuowE4j0PrRZnpETMDZ8M6d0PHXOZocUqYm3MEnBeHsZhgX3eTxg5o/3ZdOY:78M6d0/OZLMbjNOCY
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\System32\wbem\Performance\WmiApRpl.h
- Size 3KB
- SHA256 ae2b6236d3eeb4822835714ae9444e5dcd21bc60f7a909f2962c43bc743c7b15
- MD5 b133a676d139032a27de3d9619e70091
- SHA1 1248aa89938a13640252a79113930ede2f26f1fa
- SHA512 c6b99e13d854ce7a6874497473614ee4bd81c490802783db1349ab851cd80d1dc06df8c1f6e434aba873a5bbf6125cc64104709064e19a9dc1c66dcde3f898f5
- MD5 SHA1 SHA512
- Path C:\Windows\System32\wbem\Performance\WmiApRpl.ini
- Size 29KB
- SHA256 c20b11dff802aa472265f4e9f330244ec4aca81b0009f6efcb2cf8a36086f390
- MD5 ffdeea82ba4a5a65585103dd2a922dfe
- SHA1 094c3794503245cc7dfa9e222d3504f449a5400b
- SHA512 7570527fdae4818f0fc780f9f141ab6a2d313cc6b3fdb1f7d7ff05d994ad77d3f8d168b1d77c2555d25dc487d24c18f2cc0eab505d1dd758d709f2576aac1a8a
- SSDEEP 384:eso3V1/z21+byTLVh4+rCop/g4kg4491T91XFrw4G4xvrtZ9dyu+2V0DrtcYkcTu:esoW/g4kg4oG4J
- MD5 SHA1 SHA512 SSDEEP