Overview
overview
9Static
static
9HWID Spoof...er.url
windows11-21h2-x64
1HWID Spoof...te.url
windows11-21h2-x64
1HWID Spoof...or.lnk
windows11-21h2-x64
3HWID Spoof...te.url
windows11-21h2-x64
1HWID Spoof...PN.url
windows11-21h2-x64
1HWID Spoof...Ds.cmd
windows11-21h2-x64
1HWID Spoof...id.exe
windows11-21h2-x64
3HWID Spoof...64.exe
windows11-21h2-x64
1HWID Spoof...Ds.cmd
windows11-21h2-x64
1HWID Spoof...64.exe
windows11-21h2-x64
1HWID Spoof...pt.lnk
windows11-21h2-x64
3HWID Spoof...64.sys
windows11-21h2-x64
1HWID Spoof...up.exe
windows11-21h2-x64
3HWID Spoof...RU.exe
windows11-21h2-x64
3HWID Spoof...ll.exe
windows11-21h2-x64
3HWID Spoof...rt.exe
windows11-21h2-x64
5HWID Spoof...64.exe
windows11-21h2-x64
5HWID Spoof...ew.chm
windows11-21h2-x64
1HWID Spoof...ew.exe
windows11-21h2-x64
6Analysis
- max time kernel
150s - max time network
146s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system - submitted
01/09/2024, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Download Revo Uninstaller.url
Resource
win11-20240802-en
Behavioral task
behavioral2
Sample
HWID Spoofer/STEP 1 - Uninstall_Clear Traces/Updated Step 1 - Follow instructions on website.url
Resource
win11-20240802-en
Behavioral task
behavioral3
Sample
HWID Spoofer/STEP 2 - Edit HWID Registry keys/1. Registry Editor.lnk
Resource
win11-20240802-en
Behavioral task
behavioral4
Sample
HWID Spoofer/STEP 2 - Edit HWID Registry keys/3. GUID Generator Website.url
Resource
win11-20240802-en
Behavioral task
behavioral5
Sample
HWID Spoofer/STEP 3 - Mask your IP Address/1. Download NordVPN.url
Resource
win11-20240802-en
Behavioral task
behavioral6
Sample
HWID Spoofer/STEP 4 -Disk Serial NumberID/1. Change Disk IDs.cmd
Resource
win11-20240802-en
Behavioral task
behavioral7
Sample
HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid.exe
Resource
win11-20240802-en
Behavioral task
behavioral8
Sample
HWID Spoofer/STEP 4 -Disk Serial NumberID/_/Volumeid64.exe
Resource
win11-20240802-en
Behavioral task
behavioral9
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/1. Change ALL HWIDs.cmd
Resource
win11-20240802-en
Behavioral task
behavioral10
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/_/AMIDEWINx64.exe
Resource
win11-20240802-en
Behavioral task
behavioral11
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/_/Command Prompt.lnk
Resource
win11-20240802-en
Behavioral task
behavioral12
Sample
HWID Spoofer/STEP 5 - HWIDs of everything/_/amifldrv64.sys
Resource
win11-20240802-en
Behavioral task
behavioral13
Sample
HWID Spoofer/STEP 6 - MAC address/1. Install TMACv6.0.7_Setup.exe
Resource
win11-20240802-en
Behavioral task
behavioral14
Sample
HWID Spoofer/STEP 8 - Monitor HWID/CRU.exe
Resource
win11-20240802-en
Behavioral task
behavioral15
Sample
HWID Spoofer/STEP 8 - Monitor HWID/reset-all.exe
Resource
win11-20240802-en
Behavioral task
behavioral16
Sample
HWID Spoofer/STEP 8 - Monitor HWID/restart.exe
Resource
win11-20240802-en
Behavioral task
behavioral17
Sample
HWID Spoofer/STEP 8 - Monitor HWID/restart64.exe
Resource
win11-20240802-en
Behavioral task
behavioral18
Sample
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.chm
Resource
win11-20240802-en
Behavioral task
behavioral19
Sample
HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.exe
Resource
win11-20240802-en
General
- Target HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.chm
- Size 24KB
- Sample240901-rxexqatfjd
- SHA256 63606a5617a62060a2894904bf28d53f9f80cbe7b1be885cec114173d054767c
- MD5 411e4fba3110e963a85ceaf46e8cedd2
- SHA1 4272eb5976e951c448fab798f7b1fb0437f8f148
- SHA512 c8cdb839b6a49591a64a949d8602ef14703d47a7c90b300db9a4b64fd59a8e3b3e6ee6f4881732a05ff480fc23241848cc99852733e1049da5342b7b4e176ce4
- SSDEEP 384:9TXSD100stETnEaqFqFWWreTy7H9CluSY1t5A2Xzo:9TCDWtEL8Fy0yH92zY1/A2Do
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 656 hh.exe 656 hh.exe