hxxps://github[.]com/JaredWestley/HWIDSpoofer/releases/download/1[.]0/HWIDSpoofer[.]exe

Resubmissions

06/09/2024, 08:22

240906-j9n26awcnm 8

06/09/2024, 08:08

06/09/2024, 08:05

06/09/2024, 08:04

06/09/2024, 08:04

06/09/2024, 08:02

06/09/2024, 08:00

Analysis

max time kernel
44s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 08:08

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://github.com/JaredWestley/HWIDSpoofer/releases/download/1.0/HWIDSpoofer.exe

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	HWIDSpoofer.exe

Executes dropped EXE 3 IoCs

pid	Process
3692	HWIDSpoofer.exe
1536	HWIDSpoofer.exe
1972	HWIDSpoofer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\TypedURLs	HWIDSpoofer.exe
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Software\Microsoft\Internet Explorer\TypedURLs	HWIDSpoofer.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "91"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 838531.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 15 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
4620	msedge.exe
4620	msedge.exe
448	identity_helper.exe
448	identity_helper.exe
920	msedge.exe
920	msedge.exe
3692	HWIDSpoofer.exe
3692	HWIDSpoofer.exe
1536	HWIDSpoofer.exe
1536	HWIDSpoofer.exe
1972	HWIDSpoofer.exe
1972	HWIDSpoofer.exe
3692	HWIDSpoofer.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3692	HWIDSpoofer.exe
Token: SeDebugPrivilege	1536	HWIDSpoofer.exe
Token: SeDebugPrivilege	1972	HWIDSpoofer.exe
Token: SeShutdownPrivilege	5848	shutdown.exe
Token: SeRemoteShutdownPrivilege	5848	shutdown.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
1536	HWIDSpoofer.exe
3692	HWIDSpoofer.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5924	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 5020	4620	msedge.exe	84
PID 4620 wrote to memory of 5020	4620	msedge.exe	84
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 1212	4620	msedge.exe	86
PID 4620 wrote to memory of 3644	4620	msedge.exe	87
PID 4620 wrote to memory of 3644	4620	msedge.exe	87
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88
PID 4620 wrote to memory of 3708	4620	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/JaredWestley/HWIDSpoofer/releases/download/1.0/HWIDSpoofer.exe
1⤵
- Enumerates system info in registry
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x80,0x108,0x7ff8b22a46f8,0x7ff8b22a4708,0x7ff8b22a4718
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2116,6700640044816925449,8333372758127118697,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Users\Admin\Downloads\HWIDSpoofer.exe
  "C:\Users\Admin\Downloads\HWIDSpoofer.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3692
- - C:\Windows\System32\shutdown.exe
    "C:\Windows\System32\shutdown.exe" -r -t 0
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:5848
- C:\Users\Admin\Downloads\HWIDSpoofer.exe
  "C:\Users\Admin\Downloads\HWIDSpoofer.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1536
- C:\Users\Admin\Downloads\HWIDSpoofer.exe
  "C:\Users\Admin\Downloads\HWIDSpoofer.exe"
  2⤵
  - Executes dropped EXE
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3340

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3396

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa39b9855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\HWIDSpoofer.exe.log

Filesize
1KB

MD5
baf55b95da4a601229647f25dad12878

SHA1
abc16954ebfd213733c4493fc1910164d825cac8

SHA256
ee954c5d8156fd8890e582c716e5758ed9b33721258f10e758bdc31ccbcb1924

SHA512
24f502fedb1a305d0d7b08857ffc1db9b2359ff34e06d5748ecc84e35c985f29a20d9f0a533bea32d234ab37097ec0481620c63b14ac89b280e75e14d19fd545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
f5cd008cf465804d0e6f39a8d81f9a2d

SHA1
6b2907356472ed4a719e5675cc08969f30adc855

SHA256
fcea95cc39dc6c2a925f5aed739dbedaa405ee4ce127f535fcf1c751b2b8fb5d

SHA512
dc97034546a4c94bdaa6f644b5cfd1e477209de9a03a5b02a360c254a406c1d647d6f90860f385e27387b35631c41f0886cb543ede9116436941b9af6cd3285d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5a97e9de957f7f19c30d9d75106e9833

SHA1
ece8edb8accca7f04cc652c168a2b19d405b35a3

SHA256
3d6cbd65b4b27e2dbef6cb27ca5eef7f3cc186314e1354d645f7392025a2dce8

SHA512
2e9a7b460b29c58629a220003eb67008518b6f275fd1f130d69e54c595e4790513091cf6cae6b28a6ee1fc6faa1488255a79a5a36f139cb7f6a44d5959e4db26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7edf94f9970a5a3d9b3a5b23e56feaa9

SHA1
9ede2fdd529567d39e484a51fa248c8675314b98

SHA256
ec9ef805b874e9dc6b10c4a634ef63d6c88039aefea9951c21eea9d156a16a95

SHA512
626ee9dd935e339b94ff256484cec81a5ca8771cb5fd481e5dc1ef5ad8a70cc6582a6e4f2760e9e57b5b01d401adb2c88d7c8aa204805ff0b358fb4cdfa2188b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6239a1e4f8f39d558402078cee37a2ff

SHA1
6cd092e8a71dcbb3959177f38589079c6de4f16a

SHA256
d6d38710d852a75508b370f793c873032d778c0fbe1622589d1aaba3e8d7a258

SHA512
5fa4fdd375d81efc39fb235e48b00c4898e94ef41e2acd43248e8f1c2aa76b6f95e19469c60e9288534b6a0dc6eef7e8bdc873c2808fee57ac5b8221e5fe8d3f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b0cecd5fef36c94b32f59aebbc468f5e

SHA1
5f0d4136e0937c0f03b66a0c88989cc9bac95aed

SHA256
d3634a41857e8ac2cc37bcb5c0a9ed29edfcf00fac4d834f3b207f82f8884a32

SHA512
8dd72c9e99a0059a80e9fd37a5654e160c2f30f4afedd066fc3722192f1760b6585efa5b789d86b8d46b2e8969c3c4d8be73cfb331cab39ee12fc960d2f4f0f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
052fea594054bb2a98ff07644984a407

SHA1
9a74d1e947864c356a153e40c77de8f61230e15e

SHA256
d98836b27cced016e7bc445ba78de3cd8d605040d9611f2d645a73c41e05a3db

SHA512
ff4b107a3a853e61bdd205731b1ee329c25d49ecd99987d71e0e0d1e81b7a82317bb1c4e91e381b02ef249b8be7f2dafb17238a8c19fbb697876accdf2d4aeff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
80ab2bffe17586441cb2a25b336ae58a

SHA1
aabcf426db2edfa77146e5535e4fbd87226a56db

SHA256
6cc693493efb68a44cb7750d2a53a2e047b53aae1859e0addaa76a6004a1afa4

SHA512
f5a0679b115baa8669a0bd5a34883c0e0a1ce9efe30b1b82836bb6d70d7d44abc582f2df3e3d286726272b67353faf39c161d1a78288389d840cbc7de0d1e98e

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 838531.crdownload

Filesize
995KB

MD5
73598365e7be8f06f79b4bd81ef86341

SHA1
354adaea812528d9e5bb3cbf5c5fec7b144cfa45

SHA256
127e0c260765a58e3916eea7b5f4a6edd447504d372f24ff4d78b9068d54dece

SHA512
456bfc208b6abe9ea45b18492a6d32a9008245412c81dc60c1df18e138099a0a81a2eecc04849300b65f32da515f795471c227eb3346cada5d4d6b68c743f63a

Download Submit
memory/1536-85-0x00000000009E0000-0x00000000009F4000-memory.dmp

Filesize
80KB

Download
memory/1972-86-0x00000000031D0000-0x00000000031E4000-memory.dmp

Filesize
80KB

Download
memory/3692-82-0x00000000011A0000-0x00000000011B4000-memory.dmp

Filesize
80KB

Download
memory/3692-81-0x000000001B950000-0x000000001BA9E000-memory.dmp

Filesize
1.3MB

Download
memory/3692-80-0x00000000029E0000-0x0000000002A60000-memory.dmp

Filesize
512KB

Download
memory/3692-79-0x00000000007C0000-0x00000000008C0000-memory.dmp

Filesize
1024KB

Download
memory/3692-205-0x000000001EAC0000-0x000000001EB12000-memory.dmp

Filesize
328KB

Download
memory/3692-206-0x000000001EB60000-0x000000001EC0A000-memory.dmp

Filesize
680KB

Download

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads