4301b77b175e56803bf2d5a33e796772af22383b9343ced30af2fc3f668e51f5

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/05/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Syntex Hwid Spoofer/Serial Checker.bat
Size 1KB
Sample260531-kvr1yadv21
SHA256 4301b77b175e56803bf2d5a33e796772af22383b9343ced30af2fc3f668e51f5
MD5 e6aa388e1bdfbb74831d9dac00f87864
SHA1 1ea3e900bcd914e20968f4ee2a0dbc2642808f74
SHA512 6733e220796a2edc9261e4ad5e1054ab0854bd22c1ac92b0d00c1bc5b78492b51c9c68758a33d44059eb42efc98df2ec88d41ec358b4e3daac02d5a5cd308a44
TLSH
T13F31D511B84409D836D9FB290E3146B330A2489BC5751C4D369F82384F413EC799BF1D
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	1692	WMIC.exe
Token: SeSecurityPrivilege	1692	WMIC.exe
Token: SeTakeOwnershipPrivilege	1692	WMIC.exe
Token: SeLoadDriverPrivilege	1692	WMIC.exe
Token: SeSystemProfilePrivilege	1692	WMIC.exe
Token: SeSystemtimePrivilege	1692	WMIC.exe
Token: SeProfSingleProcessPrivilege	1692	WMIC.exe
Token: SeIncBasePriorityPrivilege	1692	WMIC.exe
Token: SeCreatePagefilePrivilege	1692	WMIC.exe
Token: SeBackupPrivilege	1692	WMIC.exe
Token: SeRestorePrivilege	1692	WMIC.exe
Token: SeShutdownPrivilege	1692	WMIC.exe
Token: SeDebugPrivilege	1692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1692	WMIC.exe
Token: SeRemoteShutdownPrivilege	1692	WMIC.exe
Token: SeUndockPrivilege	1692	WMIC.exe
Token: SeManageVolumePrivilege	1692	WMIC.exe
Token: 33	1692	WMIC.exe
Token: 34	1692	WMIC.exe
Token: 35	1692	WMIC.exe
Token: 36	1692	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1692	WMIC.exe
Token: SeSecurityPrivilege	1692	WMIC.exe
Token: SeTakeOwnershipPrivilege	1692	WMIC.exe
Token: SeLoadDriverPrivilege	1692	WMIC.exe
Token: SeSystemProfilePrivilege	1692	WMIC.exe
Token: SeSystemtimePrivilege	1692	WMIC.exe
Token: SeProfSingleProcessPrivilege	1692	WMIC.exe
Token: SeIncBasePriorityPrivilege	1692	WMIC.exe
Token: SeCreatePagefilePrivilege	1692	WMIC.exe
Token: SeBackupPrivilege	1692	WMIC.exe
Token: SeRestorePrivilege	1692	WMIC.exe
Token: SeShutdownPrivilege	1692	WMIC.exe
Token: SeDebugPrivilege	1692	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1692	WMIC.exe
Token: SeRemoteShutdownPrivilege	1692	WMIC.exe
Token: SeUndockPrivilege	1692	WMIC.exe
Token: SeManageVolumePrivilege	1692	WMIC.exe
Token: 33	1692	WMIC.exe
Token: 34	1692	WMIC.exe
Token: 35	1692	WMIC.exe
Token: 36	1692	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3344	WMIC.exe
Token: SeSecurityPrivilege	3344	WMIC.exe
Token: SeTakeOwnershipPrivilege	3344	WMIC.exe
Token: SeLoadDriverPrivilege	3344	WMIC.exe
Token: SeSystemProfilePrivilege	3344	WMIC.exe
Token: SeSystemtimePrivilege	3344	WMIC.exe
Token: SeProfSingleProcessPrivilege	3344	WMIC.exe
Token: SeIncBasePriorityPrivilege	3344	WMIC.exe
Token: SeCreatePagefilePrivilege	3344	WMIC.exe
Token: SeBackupPrivilege	3344	WMIC.exe
Token: SeRestorePrivilege	3344	WMIC.exe
Token: SeShutdownPrivilege	3344	WMIC.exe
Token: SeDebugPrivilege	3344	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3344	WMIC.exe
Token: SeRemoteShutdownPrivilege	3344	WMIC.exe
Token: SeUndockPrivilege	3344	WMIC.exe
Token: SeManageVolumePrivilege	3344	WMIC.exe
Token: 33	3344	WMIC.exe
Token: 34	3344	WMIC.exe
Token: 35	3344	WMIC.exe
Token: 36	3344	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3344	WMIC.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 4272	5036	cmd.exe	86
PID 5036 wrote to memory of 1692	5036	cmd.exe	88
PID 5036 wrote to memory of 3344	5036	cmd.exe	91
PID 5036 wrote to memory of 1392	5036	cmd.exe	92
PID 5036 wrote to memory of 1952	5036	cmd.exe	93
PID 5036 wrote to memory of 2124	5036	cmd.exe	94
PID 5036 wrote to memory of 4916	5036	cmd.exe	95
PID 5036 wrote to memory of 1248	5036	cmd.exe	96
PID 5036 wrote to memory of 5096	5036	cmd.exe	97
PID 5036 wrote to memory of 3720	5036	cmd.exe	99
PID 5036 wrote to memory of 1888	5036	cmd.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Syntex Hwid Spoofer\Serial Checker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:4272
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1692
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:3344
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:1392
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:1952
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get partnumber, serialnumber
  2⤵
  PID:2124
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:4916
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:1248
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:5096
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:3720
- C:\Windows\System32\Wbem\WMIC.exe
  wmic OS GET Caption,SerialNumber,CSName
  2⤵
  PID:1888

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads