4301b77b175e56803bf2d5a33e796772af22383b9343ced30af2fc3f668e51f5

Resubmissions

30/05/2026, 01:20

260530-bp6sgacx3t

30/05/2026, 01:16

260530-bmvbnaex4j8

Analysis

max time kernel
58s
max time network
58s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/05/2026, 01:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Syntex Hwid Spoofer/Serial Checker.bat
Size 1KB
Sample260530-bmvbnaex4j
SHA256 4301b77b175e56803bf2d5a33e796772af22383b9343ced30af2fc3f668e51f5
MD5 e6aa388e1bdfbb74831d9dac00f87864
SHA1 1ea3e900bcd914e20968f4ee2a0dbc2642808f74
SHA512 6733e220796a2edc9261e4ad5e1054ab0854bd22c1ac92b0d00c1bc5b78492b51c9c68758a33d44059eb42efc98df2ec88d41ec358b4e3daac02d5a5cd308a44
TLSH
T13F31D511B84409D836D9FB290E3146B330A2489BC5751C4D369F82384F413EC799BF1D
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1236	WMIC.exe
Token: SeSecurityPrivilege	1236	WMIC.exe
Token: SeTakeOwnershipPrivilege	1236	WMIC.exe
Token: SeLoadDriverPrivilege	1236	WMIC.exe
Token: SeSystemProfilePrivilege	1236	WMIC.exe
Token: SeSystemtimePrivilege	1236	WMIC.exe
Token: SeProfSingleProcessPrivilege	1236	WMIC.exe
Token: SeIncBasePriorityPrivilege	1236	WMIC.exe
Token: SeCreatePagefilePrivilege	1236	WMIC.exe
Token: SeBackupPrivilege	1236	WMIC.exe
Token: SeRestorePrivilege	1236	WMIC.exe
Token: SeShutdownPrivilege	1236	WMIC.exe
Token: SeDebugPrivilege	1236	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1236	WMIC.exe
Token: SeRemoteShutdownPrivilege	1236	WMIC.exe
Token: SeUndockPrivilege	1236	WMIC.exe
Token: SeManageVolumePrivilege	1236	WMIC.exe
Token: 33	1236	WMIC.exe
Token: 34	1236	WMIC.exe
Token: 35	1236	WMIC.exe
Token: 36	1236	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1236	WMIC.exe
Token: SeSecurityPrivilege	1236	WMIC.exe
Token: SeTakeOwnershipPrivilege	1236	WMIC.exe
Token: SeLoadDriverPrivilege	1236	WMIC.exe
Token: SeSystemProfilePrivilege	1236	WMIC.exe
Token: SeSystemtimePrivilege	1236	WMIC.exe
Token: SeProfSingleProcessPrivilege	1236	WMIC.exe
Token: SeIncBasePriorityPrivilege	1236	WMIC.exe
Token: SeCreatePagefilePrivilege	1236	WMIC.exe
Token: SeBackupPrivilege	1236	WMIC.exe
Token: SeRestorePrivilege	1236	WMIC.exe
Token: SeShutdownPrivilege	1236	WMIC.exe
Token: SeDebugPrivilege	1236	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1236	WMIC.exe
Token: SeRemoteShutdownPrivilege	1236	WMIC.exe
Token: SeUndockPrivilege	1236	WMIC.exe
Token: SeManageVolumePrivilege	1236	WMIC.exe
Token: 33	1236	WMIC.exe
Token: 34	1236	WMIC.exe
Token: 35	1236	WMIC.exe
Token: 36	1236	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3976	WMIC.exe
Token: SeSecurityPrivilege	3976	WMIC.exe
Token: SeTakeOwnershipPrivilege	3976	WMIC.exe
Token: SeLoadDriverPrivilege	3976	WMIC.exe
Token: SeSystemProfilePrivilege	3976	WMIC.exe
Token: SeSystemtimePrivilege	3976	WMIC.exe
Token: SeProfSingleProcessPrivilege	3976	WMIC.exe
Token: SeIncBasePriorityPrivilege	3976	WMIC.exe
Token: SeCreatePagefilePrivilege	3976	WMIC.exe
Token: SeBackupPrivilege	3976	WMIC.exe
Token: SeRestorePrivilege	3976	WMIC.exe
Token: SeShutdownPrivilege	3976	WMIC.exe
Token: SeDebugPrivilege	3976	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3976	WMIC.exe
Token: SeRemoteShutdownPrivilege	3976	WMIC.exe
Token: SeUndockPrivilege	3976	WMIC.exe
Token: SeManageVolumePrivilege	3976	WMIC.exe
Token: 33	3976	WMIC.exe
Token: 34	3976	WMIC.exe
Token: 35	3976	WMIC.exe
Token: 36	3976	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3976	WMIC.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 4772	5108	cmd.exe	89
PID 5108 wrote to memory of 1236	5108	cmd.exe	90
PID 5108 wrote to memory of 3976	5108	cmd.exe	92
PID 5108 wrote to memory of 2868	5108	cmd.exe	93
PID 5108 wrote to memory of 312	5108	cmd.exe	94
PID 5108 wrote to memory of 1580	5108	cmd.exe	95
PID 5108 wrote to memory of 4052	5108	cmd.exe	96
PID 5108 wrote to memory of 2092	5108	cmd.exe	97
PID 5108 wrote to memory of 4668	5108	cmd.exe	98
PID 5108 wrote to memory of 4124	5108	cmd.exe	100
PID 5108 wrote to memory of 4016	5108	cmd.exe	101

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Syntex Hwid Spoofer\Serial Checker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:4772
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1236
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3976
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:2868
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:312
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get partnumber, serialnumber
  2⤵
  PID:1580
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:4052
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:2092
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:4668
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:4124
- C:\Windows\System32\Wbem\WMIC.exe
  wmic OS GET Caption,SerialNumber,CSName
  2⤵
  PID:4016

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads