Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
28/06/2026, 16:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
get_hwid.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
get_hwid.exe
Resource
win11ltsc2024-20260618-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
General
- Target get_hwid.exe
- Size 38KB
- Sample260628-tsxcbaas2y
- SHA256 87953b537451555e9bbf1911ee7aeccae23a23eb88c69582bef6a121f041eaa1
- MD5 7868f3837ad98c4359949071d3a43b8c
- SHA1 7e81f96b189ef01db0da103f39ab56c6d899879a
- SHA512 73205360738705b34ce7e95bcfa69d99b831ff0ca3c99dbb384506d3954a3632e8593d6db65c940f92416e58ec98c210e7577355d419f9dcc91e9da08c05cf41
- SSDEEP 384:eipC1UA/UVDLql7wx0zKO59BrzZJfuHEcs9wMbT6+lIXURuZoijtBKYkOlCtNRuO:ATUO7wx09533ukcEnbTw5kHPz3aU
- TLSH T1BD03D71ADE1790EBD35D8DB4D6030901DE72BCC68BE1B2CBA7915CD50E65BE4AB3B201
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10
Malware Config
Signatures
- Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2940 WMIC.exe 2940 WMIC.exe 2940 WMIC.exe 2940 WMIC.exe 2416 WMIC.exe 2416 WMIC.exe 2416 WMIC.exe 2416 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2940 WMIC.exe Token: SeSecurityPrivilege 2940 WMIC.exe Token: SeTakeOwnershipPrivilege 2940 WMIC.exe Token: SeLoadDriverPrivilege 2940 WMIC.exe Token: SeSystemProfilePrivilege 2940 WMIC.exe Token: SeSystemtimePrivilege 2940 WMIC.exe Token: SeProfSingleProcessPrivilege 2940 WMIC.exe Token: SeIncBasePriorityPrivilege 2940 WMIC.exe Token: SeCreatePagefilePrivilege 2940 WMIC.exe Token: SeBackupPrivilege 2940 WMIC.exe Token: SeRestorePrivilege 2940 WMIC.exe Token: SeShutdownPrivilege 2940 WMIC.exe Token: SeDebugPrivilege 2940 WMIC.exe Token: SeSystemEnvironmentPrivilege 2940 WMIC.exe Token: SeRemoteShutdownPrivilege 2940 WMIC.exe Token: SeUndockPrivilege 2940 WMIC.exe Token: SeManageVolumePrivilege 2940 WMIC.exe Token: 33 2940 WMIC.exe Token: 34 2940 WMIC.exe Token: 35 2940 WMIC.exe Token: 36 2940 WMIC.exe Token: SeIncreaseQuotaPrivilege 2940 WMIC.exe Token: SeSecurityPrivilege 2940 WMIC.exe Token: SeTakeOwnershipPrivilege 2940 WMIC.exe Token: SeLoadDriverPrivilege 2940 WMIC.exe Token: SeSystemProfilePrivilege 2940 WMIC.exe Token: SeSystemtimePrivilege 2940 WMIC.exe Token: SeProfSingleProcessPrivilege 2940 WMIC.exe Token: SeIncBasePriorityPrivilege 2940 WMIC.exe Token: SeCreatePagefilePrivilege 2940 WMIC.exe Token: SeBackupPrivilege 2940 WMIC.exe Token: SeRestorePrivilege 2940 WMIC.exe Token: SeShutdownPrivilege 2940 WMIC.exe Token: SeDebugPrivilege 2940 WMIC.exe Token: SeSystemEnvironmentPrivilege 2940 WMIC.exe Token: SeRemoteShutdownPrivilege 2940 WMIC.exe Token: SeUndockPrivilege 2940 WMIC.exe Token: SeManageVolumePrivilege 2940 WMIC.exe Token: 33 2940 WMIC.exe Token: 34 2940 WMIC.exe Token: 35 2940 WMIC.exe Token: 36 2940 WMIC.exe Token: SeIncreaseQuotaPrivilege 2416 WMIC.exe Token: SeSecurityPrivilege 2416 WMIC.exe Token: SeTakeOwnershipPrivilege 2416 WMIC.exe Token: SeLoadDriverPrivilege 2416 WMIC.exe Token: SeSystemProfilePrivilege 2416 WMIC.exe Token: SeSystemtimePrivilege 2416 WMIC.exe Token: SeProfSingleProcessPrivilege 2416 WMIC.exe Token: SeIncBasePriorityPrivilege 2416 WMIC.exe Token: SeCreatePagefilePrivilege 2416 WMIC.exe Token: SeBackupPrivilege 2416 WMIC.exe Token: SeRestorePrivilege 2416 WMIC.exe Token: SeShutdownPrivilege 2416 WMIC.exe Token: SeDebugPrivilege 2416 WMIC.exe Token: SeSystemEnvironmentPrivilege 2416 WMIC.exe Token: SeRemoteShutdownPrivilege 2416 WMIC.exe Token: SeUndockPrivilege 2416 WMIC.exe Token: SeManageVolumePrivilege 2416 WMIC.exe Token: 33 2416 WMIC.exe Token: 34 2416 WMIC.exe Token: 35 2416 WMIC.exe Token: 36 2416 WMIC.exe Token: SeIncreaseQuotaPrivilege 2416 WMIC.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 5792 wrote to memory of 6016 5792 get_hwid.exe 90 PID 6016 wrote to memory of 2940 6016 cmd.exe 91 PID 5792 wrote to memory of 3100 5792 get_hwid.exe 93 PID 3100 wrote to memory of 2416 3100 cmd.exe 94 PID 5792 wrote to memory of 4904 5792 get_hwid.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\get_hwid.exe"C:\Users\Admin\AppData\Local\Temp\get_hwid.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5792 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:6016 -
C:\Windows\System32\Wbem\WMIC.exewmic diskdrive get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2940
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c wmic baseboard get serialnumber 2>nul2⤵
- Suspicious use of WriteProcessMemory
PID:3100 -
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2416
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c pause2⤵PID:4904
-