Analysis
- max time kernel
90s - max time network
101s - platform
windows11-21h2_x64 - resource
win11-20240802-en - resource tags
- submitted
01/09/2024, 14:34
General
- Target HWID Spoofer/STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)/USBDeview.exe
- Size 189KB
- Sample240901-rxexqatfjd
- SHA256 95e50f7eea21bfed82a34a24bc5d66029146c7b988e889b11f30b45cb364dcf1
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)\USBDeview.exe"C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\STEP 9 - Hide Mouse, Keyboard, and Controller serial numbers (not need for every game)\USBDeview.exe"1⤵
- Enumerates connected drives
- Maps connected drives based on registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken