Overview

overview

7

Static

static

3

hwidspoofer.exe

windows10-2004-x64

7

hwidspoofer.exe

windows11-ltsc_2024-x64

7

hwid.pyc

windows10-2004-x64

3

hwid.pyc

windows11-ltsc_2024-x64

3

Analysis

  • user interaction
    yes
  • max time kernel
    148s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260618-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/06/2026, 11:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    hwidspoofer.exe
  • Size 5.2MB
  • Sample260620-m794dsev6k
  • SHA256 9818ef062c3fcf10fd5a829a03b9ea4ac392fa0c63395ccd0145a9c6f2fe5c3f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasion

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Delays execution with timeout.exe 3 IoCs
    defense_evasion
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\hwidspoofer.exe
    "C:\Users\Admin\AppData\Local\Temp\hwidspoofer.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2860
    • C:\Users\Admin\AppData\Local\Temp\hwidspoofer.exe
      "C:\Users\Admin\AppData\Local\Temp\hwidspoofer.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:3900
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        3⤵
          PID:3564
        • C:\Windows\SYSTEM32\cmd.exe
          cmd /c start "HW Monitor" cmd /k "echo Listening for device events ( only) & timeout /t 1 >nul & echo Kernel glance: enumerating adapters ( only) & timeout /t 1 >nul & echo Refreshing ephemeral token caches ( only) & timeout /t 1 >nul & echo [press ENTER to close] & pause >nul"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:5460
          • C:\Windows\system32\cmd.exe
            cmd /k "echo Listening for device events ( only) & timeout /t 1 >nul & echo Kernel glance: enumerating adapters ( only) & timeout /t 1 >nul & echo Refreshing ephemeral token caches ( only) & timeout /t 1 >nul & echo [press ENTER to close] & pause >nul"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:5304
            • C:\Windows\system32\timeout.exe
              timeout /t 1
              5⤵
              • Delays execution with timeout.exe
              PID:5712
            • C:\Windows\system32\timeout.exe
              timeout /t 1
              5⤵
              • Delays execution with timeout.exe
              PID:1716
            • C:\Windows\system32\timeout.exe
              timeout /t 1
              5⤵
              • Delays execution with timeout.exe
              PID:2276

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\VCRUNTIME140.dll
          • Size 94KB
          • SHA256 e1d6f78a72836ea120bd27a33ae89cbdc3f3ca7d9d0231aaa3aac91996d2fa4e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\_bz2.pyd
          • Size 78KB
          • SHA256 4c2649dc69a8874b91646723aacb84c565efeaa4277c46392055bca9a10497a8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\_ctypes.pyd
          • Size 117KB
          • SHA256 35cdd122679041ebef264de5626b7805f3f66c8ae6cc451b8bc520be647fa007
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _decimal.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\_decimal.pyd
          • Size 241KB
          • SHA256 384993b2b8cfcbf155e63f0ee2383a9f9483de92ab73736ff84590a0c4ca2690
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\_hashlib.pyd
          • Size 57KB
          • SHA256 50daeb3985302a8d85ce8167b0bf08b9da43e7d51ceae50e8e1cdfb0edf218c6
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\_lzma.pyd
          • Size 149KB
          • SHA256 f125a885c10e1be4b12d988d6c19128890e7add75baa935fe1354721aa2dea3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\_socket.pyd
          • Size 72KB
          • SHA256 3669e56e99ae3a944fbe7845f0be05aea96a603717e883d56a27dc356f8c2f2c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\base_library.zip
          • Size 858KB
          • SHA256 2c8e6724117389c197dbfacd53afc6156d4b7f2e43cf1ca6beca8e885942f655
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\libcrypto-1_1.dll
          • Size 3.3MB
          • SHA256 664c3e52f914e351bb8a66ce2465ee0d40acab1d2a6b3167ae6acf6f1d1724d2
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          python310.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\python310.dll
          • Size 4.2MB
          • SHA256 f281c2e252ed59dd96726dbb2de529a2b07b818e9cc3799d1ffa9883e3028ed8
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\select.pyd
          • Size 25KB
          • SHA256 f1694ce82da997faa89a9d22d469bfc94abb0f2063a69ec9b953bc085c2cb823
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          unicodedata.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI28602\unicodedata.pyd
          • Size 1.1MB
          • SHA256 9b22d93f4db077a70a1d85ffc503980903f1a88e262068dd79c6190ec7a31b08
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          hwid_ultra_1781953670.log
          • Path C:\Users\Admin\AppData\Local\Temp\hwid_ultra_sim\hwid_ultra_1781953670.log
          • Size 4KB
          • SHA256 878f7b44a30cb2bd534260e89d20b0ad8169509a0c13233a8f911d7f1f6fab68
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download