62d2ef6369e8a4a04d1ab143bf8a4e72cede9cdc01722c387cdf94fb7df96ca9

Analysis

max time kernel
118s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/07/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
HACK/HELPERS/CleanSystem/Check HWID.bat
Size 1KB
Sample260706-ts5npadt3k
SHA256 62d2ef6369e8a4a04d1ab143bf8a4e72cede9cdc01722c387cdf94fb7df96ca9
MD5 ed48ef00185dde33cfb5ed2538231d4a
SHA1 6a62f8f2cc6b7a28a545657bf42ebc2c246f8371
SHA512 54855af8359335a07e904e8d3a51dd1988733b726f411639705982a82554a84f6d5cce6af2b93be6857a8acbff35eebacf32610de805fd98c690b87e86740099
TLSH
T18C21C109BD8886C065DAFAC86B3A4272F1B5D05384711DCC2F6755205F81ACCBBEEB1E
MD5 SHA1 SHA512 TLSH

Score

1^/10

Malware Config

Signatures

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
3472	WMIC.exe
3472	WMIC.exe
3472	WMIC.exe
3472	WMIC.exe
5612	WMIC.exe
5612	WMIC.exe
5612	WMIC.exe
5612	WMIC.exe
5680	WMIC.exe
5680	WMIC.exe
5680	WMIC.exe
5680	WMIC.exe
4800	WMIC.exe
4800	WMIC.exe
4800	WMIC.exe
4800	WMIC.exe
2032	WMIC.exe
2032	WMIC.exe
2032	WMIC.exe
2032	WMIC.exe
5312	WMIC.exe
5312	WMIC.exe
5312	WMIC.exe
5312	WMIC.exe
3976	WMIC.exe
3976	WMIC.exe
3976	WMIC.exe
3976	WMIC.exe
5908	WMIC.exe
5908	WMIC.exe
5908	WMIC.exe
5908	WMIC.exe
5796	WMIC.exe
5796	WMIC.exe
5796	WMIC.exe
5796	WMIC.exe
1080	WMIC.exe
1080	WMIC.exe
1080	WMIC.exe
1080	WMIC.exe
6112	WMIC.exe
6112	WMIC.exe
6112	WMIC.exe
6112	WMIC.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	3472	WMIC.exe
Token: SeSecurityPrivilege	3472	WMIC.exe
Token: SeTakeOwnershipPrivilege	3472	WMIC.exe
Token: SeLoadDriverPrivilege	3472	WMIC.exe
Token: SeSystemProfilePrivilege	3472	WMIC.exe
Token: SeSystemtimePrivilege	3472	WMIC.exe
Token: SeProfSingleProcessPrivilege	3472	WMIC.exe
Token: SeIncBasePriorityPrivilege	3472	WMIC.exe
Token: SeCreatePagefilePrivilege	3472	WMIC.exe
Token: SeBackupPrivilege	3472	WMIC.exe
Token: SeRestorePrivilege	3472	WMIC.exe
Token: SeShutdownPrivilege	3472	WMIC.exe
Token: SeDebugPrivilege	3472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3472	WMIC.exe
Token: SeRemoteShutdownPrivilege	3472	WMIC.exe
Token: SeUndockPrivilege	3472	WMIC.exe
Token: SeManageVolumePrivilege	3472	WMIC.exe
Token: 33	3472	WMIC.exe
Token: 34	3472	WMIC.exe
Token: 35	3472	WMIC.exe
Token: 36	3472	WMIC.exe
Token: SeIncreaseQuotaPrivilege	3472	WMIC.exe
Token: SeSecurityPrivilege	3472	WMIC.exe
Token: SeTakeOwnershipPrivilege	3472	WMIC.exe
Token: SeLoadDriverPrivilege	3472	WMIC.exe
Token: SeSystemProfilePrivilege	3472	WMIC.exe
Token: SeSystemtimePrivilege	3472	WMIC.exe
Token: SeProfSingleProcessPrivilege	3472	WMIC.exe
Token: SeIncBasePriorityPrivilege	3472	WMIC.exe
Token: SeCreatePagefilePrivilege	3472	WMIC.exe
Token: SeBackupPrivilege	3472	WMIC.exe
Token: SeRestorePrivilege	3472	WMIC.exe
Token: SeShutdownPrivilege	3472	WMIC.exe
Token: SeDebugPrivilege	3472	WMIC.exe
Token: SeSystemEnvironmentPrivilege	3472	WMIC.exe
Token: SeRemoteShutdownPrivilege	3472	WMIC.exe
Token: SeUndockPrivilege	3472	WMIC.exe
Token: SeManageVolumePrivilege	3472	WMIC.exe
Token: 33	3472	WMIC.exe
Token: 34	3472	WMIC.exe
Token: 35	3472	WMIC.exe
Token: 36	3472	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5612	WMIC.exe
Token: SeSecurityPrivilege	5612	WMIC.exe
Token: SeTakeOwnershipPrivilege	5612	WMIC.exe
Token: SeLoadDriverPrivilege	5612	WMIC.exe
Token: SeSystemProfilePrivilege	5612	WMIC.exe
Token: SeSystemtimePrivilege	5612	WMIC.exe
Token: SeProfSingleProcessPrivilege	5612	WMIC.exe
Token: SeIncBasePriorityPrivilege	5612	WMIC.exe
Token: SeCreatePagefilePrivilege	5612	WMIC.exe
Token: SeBackupPrivilege	5612	WMIC.exe
Token: SeRestorePrivilege	5612	WMIC.exe
Token: SeShutdownPrivilege	5612	WMIC.exe
Token: SeDebugPrivilege	5612	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5612	WMIC.exe
Token: SeRemoteShutdownPrivilege	5612	WMIC.exe
Token: SeUndockPrivilege	5612	WMIC.exe
Token: SeManageVolumePrivilege	5612	WMIC.exe
Token: 33	5612	WMIC.exe
Token: 34	5612	WMIC.exe
Token: 35	5612	WMIC.exe
Token: 36	5612	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5612	WMIC.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 5388	1480	cmd.exe	89
PID 1480 wrote to memory of 3472	1480	cmd.exe	90
PID 1480 wrote to memory of 5612	1480	cmd.exe	92
PID 1480 wrote to memory of 5680	1480	cmd.exe	93
PID 1480 wrote to memory of 4800	1480	cmd.exe	94
PID 1480 wrote to memory of 2032	1480	cmd.exe	95
PID 1480 wrote to memory of 5312	1480	cmd.exe	96
PID 1480 wrote to memory of 3976	1480	cmd.exe	97
PID 1480 wrote to memory of 5908	1480	cmd.exe	98
PID 1480 wrote to memory of 5796	1480	cmd.exe	99
PID 1480 wrote to memory of 1080	1480	cmd.exe	100
PID 1480 wrote to memory of 6112	1480	cmd.exe	101
PID 1480 wrote to memory of 3024	1480	cmd.exe	102
PID 1480 wrote to memory of 4816	1480	cmd.exe	104

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HACK\HELPERS\CleanSystem\Check HWID.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Windows\system32\mode.com
  mode con: cols=120 lines=120
  2⤵
  PID:5388
- C:\Windows\System32\Wbem\WMIC.exe
  wmic diskdrive get serialnumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3472
- C:\Windows\System32\Wbem\WMIC.exe
  wmic baseboard get serialnumber,product,Manufacturer,version
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5612
- C:\Windows\System32\Wbem\WMIC.exe
  wmic PATH Win32_VideoController GET Description,PNPDeviceID
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5680
- C:\Windows\System32\Wbem\WMIC.exe
  wmic memorychip get devicelocatior,serialnumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4800
- C:\Windows\System32\Wbem\WMIC.exe
  wmic csproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Windows\System32\Wbem\WMIC.exe
  wmic path win32_computersystemproduct get uuid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5312
- C:\Windows\System32\Wbem\WMIC.exe
  wmic bios get serialnumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3976
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get processorid
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5908
- C:\Windows\System32\Wbem\WMIC.exe
  wmic cpu get serialnumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5796
- C:\Windows\System32\Wbem\WMIC.exe
  wmic systemenclosure get serialnumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Windows\System32\Wbem\WMIC.exe
  wmic os get serialnumber
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6112
- C:\Windows\system32\getmac.exe
  getmac
  2⤵
  PID:3024
- C:\Windows\system32\cmd.exe
  cmd /k
  2⤵
  PID:4816

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads