4301b77b175e56803bf2d5a33e796772af22383b9343ced30af2fc3f668e51f5

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
31/05/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Syntex Hwid Spoofer/Serial Checker.bat
Size 1KB
Sample260531-kvr1yadv21
SHA256 4301b77b175e56803bf2d5a33e796772af22383b9343ced30af2fc3f668e51f5
MD5 e6aa388e1bdfbb74831d9dac00f87864
SHA1 1ea3e900bcd914e20968f4ee2a0dbc2642808f74
SHA512 6733e220796a2edc9261e4ad5e1054ab0854bd22c1ac92b0d00c1bc5b78492b51c9c68758a33d44059eb42efc98df2ec88d41ec358b4e3daac02d5a5cd308a44
TLSH
T13F31D511B84409D836D9FB290E3146B330A2489BC5751C4D369F82384F413EC799BF1D
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4172	WMIC.exe
Token: SeSecurityPrivilege	4172	WMIC.exe
Token: SeTakeOwnershipPrivilege	4172	WMIC.exe
Token: SeLoadDriverPrivilege	4172	WMIC.exe
Token: SeSystemProfilePrivilege	4172	WMIC.exe
Token: SeSystemtimePrivilege	4172	WMIC.exe
Token: SeProfSingleProcessPrivilege	4172	WMIC.exe
Token: SeIncBasePriorityPrivilege	4172	WMIC.exe
Token: SeCreatePagefilePrivilege	4172	WMIC.exe
Token: SeBackupPrivilege	4172	WMIC.exe
Token: SeRestorePrivilege	4172	WMIC.exe
Token: SeShutdownPrivilege	4172	WMIC.exe
Token: SeDebugPrivilege	4172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4172	WMIC.exe
Token: SeRemoteShutdownPrivilege	4172	WMIC.exe
Token: SeUndockPrivilege	4172	WMIC.exe
Token: SeManageVolumePrivilege	4172	WMIC.exe
Token: 33	4172	WMIC.exe
Token: 34	4172	WMIC.exe
Token: 35	4172	WMIC.exe
Token: 36	4172	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4172	WMIC.exe
Token: SeSecurityPrivilege	4172	WMIC.exe
Token: SeTakeOwnershipPrivilege	4172	WMIC.exe
Token: SeLoadDriverPrivilege	4172	WMIC.exe
Token: SeSystemProfilePrivilege	4172	WMIC.exe
Token: SeSystemtimePrivilege	4172	WMIC.exe
Token: SeProfSingleProcessPrivilege	4172	WMIC.exe
Token: SeIncBasePriorityPrivilege	4172	WMIC.exe
Token: SeCreatePagefilePrivilege	4172	WMIC.exe
Token: SeBackupPrivilege	4172	WMIC.exe
Token: SeRestorePrivilege	4172	WMIC.exe
Token: SeShutdownPrivilege	4172	WMIC.exe
Token: SeDebugPrivilege	4172	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4172	WMIC.exe
Token: SeRemoteShutdownPrivilege	4172	WMIC.exe
Token: SeUndockPrivilege	4172	WMIC.exe
Token: SeManageVolumePrivilege	4172	WMIC.exe
Token: 33	4172	WMIC.exe
Token: 34	4172	WMIC.exe
Token: 35	4172	WMIC.exe
Token: 36	4172	WMIC.exe
Token: SeIncreaseQuotaPrivilege	488	WMIC.exe
Token: SeSecurityPrivilege	488	WMIC.exe
Token: SeTakeOwnershipPrivilege	488	WMIC.exe
Token: SeLoadDriverPrivilege	488	WMIC.exe
Token: SeSystemProfilePrivilege	488	WMIC.exe
Token: SeSystemtimePrivilege	488	WMIC.exe
Token: SeProfSingleProcessPrivilege	488	WMIC.exe
Token: SeIncBasePriorityPrivilege	488	WMIC.exe
Token: SeCreatePagefilePrivilege	488	WMIC.exe
Token: SeBackupPrivilege	488	WMIC.exe
Token: SeRestorePrivilege	488	WMIC.exe
Token: SeShutdownPrivilege	488	WMIC.exe
Token: SeDebugPrivilege	488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	488	WMIC.exe
Token: SeRemoteShutdownPrivilege	488	WMIC.exe
Token: SeUndockPrivilege	488	WMIC.exe
Token: SeManageVolumePrivilege	488	WMIC.exe
Token: 33	488	WMIC.exe
Token: 34	488	WMIC.exe
Token: 35	488	WMIC.exe
Token: 36	488	WMIC.exe
Token: SeIncreaseQuotaPrivilege	488	WMIC.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 2404 wrote to memory of 3352	2404	cmd.exe	83
PID 2404 wrote to memory of 4172	2404	cmd.exe	84
PID 2404 wrote to memory of 488	2404	cmd.exe	86
PID 2404 wrote to memory of 4712	2404	cmd.exe	87
PID 2404 wrote to memory of 1060	2404	cmd.exe	88
PID 2404 wrote to memory of 4716	2404	cmd.exe	89
PID 2404 wrote to memory of 3784	2404	cmd.exe	90
PID 2404 wrote to memory of 568	2404	cmd.exe	91
PID 2404 wrote to memory of 4244	2404	cmd.exe	92
PID 2404 wrote to memory of 892	2404	cmd.exe	94
PID 2404 wrote to memory of 3160	2404	cmd.exe	95

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Syntex Hwid Spoofer\Serial Checker.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2404
- C:\Windows\system32\mode.com
  mode con: cols=180 lines=62
  2⤵
  PID:3352
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4172
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:488
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:4712
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:1060
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get partnumber, serialnumber
  2⤵
  PID:4716
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:3784
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:568
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:4244
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:892
- C:\Windows\System32\Wbem\WMIC.exe
  wmic OS GET Caption,SerialNumber,CSName
  2⤵
  PID:3160

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads