Analysis
- user interaction
yes - max time kernel
149s - max time network
95s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
16/04/2026, 01:57
General
- Target TraceX Final/Run-TraceX-HWID-Spoofer.bat
- Size 6KB
- Sample260416-cdc7fsd12j
- SHA256 37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs
Using powershell.exe command.
- Drops file in Windows directory 1 IoCs
- Delays execution with timeout.exe 1 IoCs
- Modifies registry class 6 IoCs
- Suspicious behavior: EnumeratesProcesses 14 IoCs
- Suspicious use of AdjustPrivilegeToken 7 IoCs
- Suspicious use of FindShellTrayWindow 26 IoCs
- Suspicious use of SendNotifyMessage 26 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TraceX Final\Run-TraceX-HWID-Spoofer.bat"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cacls.exe"C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"2⤵
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c powershell -Command "Get-ExecutionPolicy -Scope CurrentUser" 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-ExecutionPolicy -Scope CurrentUser"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "$blocked = Get-ChildItem -Path 'C:\Users\Admin\AppData\Local\Temp\TraceX Final\' -Recurse | Where-Object { $_.IsBlocked }; if ($blocked) { exit 1 } else { exit 0 }"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Write-Host 'Test' | Out-Null"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\choice.exechoice /C YN /M "Would you like to configure PowerShell now"2⤵
-
-
C:\Windows\system32\reg.exereg add "HKCR\Applications\powershell.exe\shell\open\command" /ve /t REG_SZ /d "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -ExecutionPolicy unrestricted -File \"%1\"" /f2⤵
- Modifies registry class
-
-
C:\Windows\system32\reg.exereg add "HKCU\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Unrestricted" /f2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\reg.exereg add "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Unrestricted" /f2⤵
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope LocalMachine -Force"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -Command "Get-ChildItem -Path 'C:\Users\Admin\AppData\Local\Temp\TraceX Final\' -Recurse | Unblock-File"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\timeout.exetimeout /t 1 /nobreak2⤵
- Delays execution with timeout.exe
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -ExecutionPolicy Bypass -Command "& 'C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\HWID-Spoofer.ps1'"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\RevoUninstaller.exe"C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\RevoUninstaller.exe"3⤵
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
settings.ini
__PSScriptPolicyTest_uble1ajo.wzj.ps1
memory/796-26-0x0000013624E50000-0x0000013624E60000-memory.dmp
memory/796-27-0x0000013624E50000-0x0000013624E60000-memory.dmp
memory/796-36-0x000001360C750000-0x000001360C75C000-memory.dmp
memory/796-37-0x0000013624E00000-0x0000013624E12000-memory.dmp
memory/1924-62-0x000001C6079D0000-0x000001C6079DC000-memory.dmp
memory/1924-63-0x000001C607A70000-0x000001C607A82000-memory.dmp
memory/2180-79-0x00000149BAED0000-0x00000149BAEE2000-memory.dmp
memory/2180-78-0x00000149BAAE0000-0x00000149BAAEC000-memory.dmp
memory/3308-47-0x000001F1392E0000-0x000001F1392F2000-memory.dmp
memory/3308-46-0x000001F139280000-0x000001F13928C000-memory.dmp
memory/3708-507-0x0000000003000000-0x000000000311E000-memory.dmp
memory/3708-504-0x0000000003000000-0x000000000311E000-memory.dmp
memory/3832-97-0x00000278CB8E0000-0x00000278CB8EC000-memory.dmp
memory/3832-98-0x00000278E55C0000-0x00000278E55D2000-memory.dmp
memory/4452-88-0x000001B396520000-0x000001B39652C000-memory.dmp
memory/4452-89-0x000001B3AE760000-0x000001B3AE772000-memory.dmp
memory/4644-20-0x0000021F7AEB0000-0x0000021F7AECC000-memory.dmp
memory/4644-19-0x0000021F7AE80000-0x0000021F7AE8A000-memory.dmp
memory/4644-1-0x0000021F7AAD0000-0x0000021F7AAE0000-memory.dmp
memory/4644-18-0x0000021F7AF20000-0x0000021F7AFD3000-memory.dmp
memory/4644-17-0x0000021F7AE60000-0x0000021F7AE7C000-memory.dmp
memory/4644-10-0x00007FF4EE9E0000-0x00007FF4EE9F0000-memory.dmp
memory/4644-9-0x0000021F7AAD0000-0x0000021F7AAE0000-memory.dmp
memory/4644-2-0x0000021F7AA60000-0x0000021F7AA82000-memory.dmp
memory/4644-0-0x0000021F7AAD0000-0x0000021F7AAE0000-memory.dmp
memory/4644-23-0x0000021F7A7F0000-0x0000021F7A7FC000-memory.dmp
memory/4644-24-0x0000021F7A850000-0x0000021F7A862000-memory.dmp