62d2ef6369e8a4a04d1ab143bf8a4e72cede9cdc01722c387cdf94fb7df96ca9

Analysis

user interaction
yes
max time kernel
119s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HACK/HELPERS/CleanSystem/Check HWID.bat
Size 1KB
Sample260706-ts5npadt3k
SHA256 62d2ef6369e8a4a04d1ab143bf8a4e72cede9cdc01722c387cdf94fb7df96ca9
MD5 ed48ef00185dde33cfb5ed2538231d4a
SHA1 6a62f8f2cc6b7a28a545657bf42ebc2c246f8371
SHA512 54855af8359335a07e904e8d3a51dd1988733b726f411639705982a82554a84f6d5cce6af2b93be6857a8acbff35eebacf32610de805fd98c690b87e86740099
TLSH
T18C21C109BD8886C065DAFAC86B3A4272F1B5D05384711DCC2F6755205F81ACCBBEEB1E
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	684	WMIC.exe
Token: SeSecurityPrivilege	684	WMIC.exe
Token: SeTakeOwnershipPrivilege	684	WMIC.exe
Token: SeLoadDriverPrivilege	684	WMIC.exe
Token: SeSystemProfilePrivilege	684	WMIC.exe
Token: SeSystemtimePrivilege	684	WMIC.exe
Token: SeProfSingleProcessPrivilege	684	WMIC.exe
Token: SeIncBasePriorityPrivilege	684	WMIC.exe
Token: SeCreatePagefilePrivilege	684	WMIC.exe
Token: SeBackupPrivilege	684	WMIC.exe
Token: SeRestorePrivilege	684	WMIC.exe
Token: SeShutdownPrivilege	684	WMIC.exe
Token: SeDebugPrivilege	684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	684	WMIC.exe
Token: SeRemoteShutdownPrivilege	684	WMIC.exe
Token: SeUndockPrivilege	684	WMIC.exe
Token: SeManageVolumePrivilege	684	WMIC.exe
Token: 33	684	WMIC.exe
Token: 34	684	WMIC.exe
Token: 35	684	WMIC.exe
Token: 36	684	WMIC.exe
Token: SeIncreaseQuotaPrivilege	684	WMIC.exe
Token: SeSecurityPrivilege	684	WMIC.exe
Token: SeTakeOwnershipPrivilege	684	WMIC.exe
Token: SeLoadDriverPrivilege	684	WMIC.exe
Token: SeSystemProfilePrivilege	684	WMIC.exe
Token: SeSystemtimePrivilege	684	WMIC.exe
Token: SeProfSingleProcessPrivilege	684	WMIC.exe
Token: SeIncBasePriorityPrivilege	684	WMIC.exe
Token: SeCreatePagefilePrivilege	684	WMIC.exe
Token: SeBackupPrivilege	684	WMIC.exe
Token: SeRestorePrivilege	684	WMIC.exe
Token: SeShutdownPrivilege	684	WMIC.exe
Token: SeDebugPrivilege	684	WMIC.exe
Token: SeSystemEnvironmentPrivilege	684	WMIC.exe
Token: SeRemoteShutdownPrivilege	684	WMIC.exe
Token: SeUndockPrivilege	684	WMIC.exe
Token: SeManageVolumePrivilege	684	WMIC.exe
Token: 33	684	WMIC.exe
Token: 34	684	WMIC.exe
Token: 35	684	WMIC.exe
Token: 36	684	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5044	WMIC.exe
Token: SeSecurityPrivilege	5044	WMIC.exe
Token: SeTakeOwnershipPrivilege	5044	WMIC.exe
Token: SeLoadDriverPrivilege	5044	WMIC.exe
Token: SeSystemProfilePrivilege	5044	WMIC.exe
Token: SeSystemtimePrivilege	5044	WMIC.exe
Token: SeProfSingleProcessPrivilege	5044	WMIC.exe
Token: SeIncBasePriorityPrivilege	5044	WMIC.exe
Token: SeCreatePagefilePrivilege	5044	WMIC.exe
Token: SeBackupPrivilege	5044	WMIC.exe
Token: SeRestorePrivilege	5044	WMIC.exe
Token: SeShutdownPrivilege	5044	WMIC.exe
Token: SeDebugPrivilege	5044	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5044	WMIC.exe
Token: SeRemoteShutdownPrivilege	5044	WMIC.exe
Token: SeUndockPrivilege	5044	WMIC.exe
Token: SeManageVolumePrivilege	5044	WMIC.exe
Token: 33	5044	WMIC.exe
Token: 34	5044	WMIC.exe
Token: 35	5044	WMIC.exe
Token: 36	5044	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5044	WMIC.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 3036	4140	cmd.exe	85
PID 4140 wrote to memory of 684	4140	cmd.exe	86
PID 4140 wrote to memory of 5044	4140	cmd.exe	88
PID 4140 wrote to memory of 4572	4140	cmd.exe	89
PID 4140 wrote to memory of 2324	4140	cmd.exe	90
PID 4140 wrote to memory of 3644	4140	cmd.exe	91
PID 4140 wrote to memory of 4816	4140	cmd.exe	92
PID 4140 wrote to memory of 4264	4140	cmd.exe	93
PID 4140 wrote to memory of 4524	4140	cmd.exe	94
PID 4140 wrote to memory of 400	4140	cmd.exe	95
PID 4140 wrote to memory of 4488	4140	cmd.exe	96
PID 4140 wrote to memory of 888	4140	cmd.exe	97
PID 4140 wrote to memory of 368	4140	cmd.exe	98
PID 4140 wrote to memory of 4040	4140	cmd.exe	100

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HACK\HELPERS\CleanSystem\Check HWID.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Windows\system32\mode.com
  mode con: cols=120 lines=120
  2⤵
  PID:3036
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:684
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber,product,Manufacturer,version
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:5044
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  PID:4572
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get devicelocatior,serialnumber
  2⤵
  PID:2324
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  PID:3644
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  PID:4816
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  PID:4264
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  PID:4524
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  PID:400
- C:\Windows\System32\Wbem\WMIC.exe
  wmic systemenclosure get serialnumber
  2⤵
  PID:4488
- C:\Windows\System32\Wbem\WMIC.exe
  wmic os get serialnumber
  2⤵
  PID:888
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:368
- C:\Windows\system32\cmd.exe
  cmd /k
  2⤵
  PID:4040

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads