37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945

Resubmissions

06/06/2026, 10:54

260606-mzrbbacs51

06/06/2026, 10:50

260606-mxff2acs3s8

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HWID Spoofer/TraceX Final/Run-TraceX-HWID-Spoofer.bat
Size 6KB
Sample260606-mxff2acs3s
SHA256 37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945
MD5 4f98523504c362ef51a4c82768e8b51a
SHA1 8d3c001925d58761b5707f8a10d662d7b77416c6
SHA512 95baf291c47eb91da07ba20025df0c93b54e9b06bc1afd5f2090a991ade6b50a88083472543377d1b8f6c55b50c9e0d8ec231735114291b02b5997f2972dbbfb
SSDEEP 192:H55Iq2WQKBJ+mglJIqL1WRDK6DFD66DFOQDF:Z/QNPGe6pW65OQZ
TLSH
T1A3D12122342E97760ABED52884250069F55A62CF61085EFDF1AFD1781F38384DBFE5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2408	powershell.exe
3960	powershell.exe
492	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2408	powershell.exe
2408	powershell.exe
3960	powershell.exe
3960	powershell.exe
492	powershell.exe
492	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2408	powershell.exe
Token: SeDebugPrivilege	3960	powershell.exe
Token: SeDebugPrivilege	492	powershell.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5208 wrote to memory of 2676	5208	cmd.exe	81
PID 5208 wrote to memory of 3272	5208	cmd.exe	82
PID 3272 wrote to memory of 2408	3272	cmd.exe	83
PID 5208 wrote to memory of 3960	5208	cmd.exe	84
PID 5208 wrote to memory of 492	5208	cmd.exe	85
PID 5208 wrote to memory of 4932	5208	cmd.exe	86

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\TraceX Final\Run-TraceX-HWID-Spoofer.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:5208
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:2676
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Get-ExecutionPolicy -Scope CurrentUser" 2>nul
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-ExecutionPolicy -Scope CurrentUser"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2408
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$blocked = Get-ChildItem -Path 'C:\Users\Admin\AppData\Local\Temp\HWID Spoofer\TraceX Final\' -Recurse | Where-Object { $_.IsBlocked }; if ($blocked) { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3960
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host 'Test' | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:492
- C:\Windows\system32\choice.exe
  choice /C YN /M "Would you like to configure PowerShell now"
  2⤵
  PID:4932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 a4aa1e980540f6666c22daa9804220c3f6f6e284e4fae9fdcaebb4672d8e3066
MD5 2142980c582d69c74428b3e93d99b02f
SHA1 d1a641c531e71cde57a742c772c5d73a2aa8680d
SHA512 2043ebf342dc4186ee658faaec7a3687d2d656d3104b05f2aed23605ef773d9867a2d27254d290229b87dab94d4b7ca0ac5521a898cfbc7cb8eac0cded585590
TLSH
T10671BD323375B1D489563F07192C198463BF8356EA54AF4CB65C624EE92B04BDF222F7
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 23865f1cc0cbf59a6c278d6e8ddc875206b831aadca65d715088c48c2f3258ad
MD5 8df6ac866afddd0d80f3c2e16ebc5a85
SHA1 34e3c3ee1a24440175254da5fa7c8e2d4d8474c6
SHA512 addec95cfd53b576deeca4476ffdd1c196983d150f0aa515f549c7865aafe1fcfa01fc93cc3ce35b9800d3ac369eb60e09f9ae4f22c6e432f4025bd2777f219d
TLSH
T1F9218933B7DCC134C8D9117A108CAD11B1B6C3C7449ECE9B7B84C518A57F589DB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4f71d9f8a45af5ad322c964a73a78707def5c2a75d4120a7c60a1c81d8f32fff
MD5 d0179428ff7b0aa1354cd7ff9e6f47cd
SHA1 8de52e22e75846c1be1421d41cbbd7a58952bcdb
SHA512 620806024d0032c7885c8c043689fd91729395cb25ee89a8ddd37e53c0355e0ceec3bfc32abe49d72d7ab6fa1ed4874f0ab79e473dc445158b01ec6fc971664f
TLSH
T1A8117A33B79CC134C8D9157A5088AD11B1B1C3C7049EDE8F7B84C109E57F99AEB646E4
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_bmphow4n.nxt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_bmphow4n.nxt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2408-16-0x00007FF402540000-0x00007FF402550000-memory.dmp

Download

memory/2408-17-0x000001B57E360000-0x000001B57E37C000-memory.dmp

Download

memory/2408-0-0x000001B562D90000-0x000001B562DA0000-memory.dmp

Download

memory/2408-18-0x000001B57E430000-0x000001B57E4E3000-memory.dmp

Download

memory/2408-19-0x000001B57E340000-0x000001B57E34A000-memory.dmp

Download

memory/2408-20-0x000001B57E3A0000-0x000001B57E3BC000-memory.dmp

Download

memory/2408-9-0x000001B562D90000-0x000001B562DA0000-memory.dmp

Download

memory/2408-4-0x000001B57E0D0000-0x000001B57E0F2000-memory.dmp

Download

memory/2408-1-0x000001B562D90000-0x000001B562DA0000-memory.dmp

Download

memory/3960-24-0x000002553C080000-0x000002553C090000-memory.dmp

Download

memory/3960-25-0x000002553C080000-0x000002553C090000-memory.dmp

Download