Analysis
- user interaction
yes - max time kernel
58s - max time network
58s - platform
windows10-ltsc_2021_x64 - resource
win10ltsc2021-20260513-en - resource tags
arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows - submitted
31/07/2026, 16:54
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hwid-changer-games-main/AMIDEWINx64.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
60 seconds
Behavioral task
behavioral2
Sample
hwid-changer-games-main/HWID Checker.bat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
4 signatures
60 seconds
Behavioral task
behavioral3
Sample
hwid-changer-games-main/HardDiskSerialNumberChanger.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
6 signatures
60 seconds
Behavioral task
behavioral4
Sample
hwid-changer-games-main/MAC Address Changer.exe
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
6 signatures
60 seconds
Behavioral task
behavioral5
Sample
hwid-changer-games-main/amifldrv64.sys
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
1 signatures
60 seconds
Behavioral task
behavioral6
Sample
hwid-changer-games-main/cleaner.bat
Resource
win10ltsc2021-20260513-en
windows10-ltsc_2021-x64
5 signatures
60 seconds
General
- Target hwid-changer-games-main/HWID Checker.bat
- Size 492B
- Sample260731-vesbwack71
- SHA256 2c88867fe0929b281ac86a0610119a09d773b94ecc4f63664f13f058f03602f1
- MD5 46040e2135e912f85c0cddb8b364d923
- SHA1 28bf68a37f0bf104b42427bdf9f661efbb2240a0
- SHA512 f154e9dd04f80b764129a6849ed33240c9d4684e36d0c25d4394278ff3a14c2e0b0876258da55d6e366bb69922d0b1e79725d6de5a7616031e3242c2bd8b3bfc
- TLSH T164F05E4BB65A86458D506E1036720491303D62A385D29DD87DB722385FD38DCB6DDF2F
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4468 cmd.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1528 WMIC.exe 1528 WMIC.exe 1528 WMIC.exe 1528 WMIC.exe 4496 WMIC.exe 4496 WMIC.exe 4496 WMIC.exe 4496 WMIC.exe 4632 WMIC.exe 4632 WMIC.exe 4632 WMIC.exe 4632 WMIC.exe 3968 WMIC.exe 3968 WMIC.exe 3968 WMIC.exe 3968 WMIC.exe 4844 WMIC.exe 4844 WMIC.exe 4844 WMIC.exe 4844 WMIC.exe 4020 WMIC.exe 4020 WMIC.exe 4020 WMIC.exe 4020 WMIC.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1528 WMIC.exe Token: SeSecurityPrivilege 1528 WMIC.exe Token: SeTakeOwnershipPrivilege 1528 WMIC.exe Token: SeLoadDriverPrivilege 1528 WMIC.exe Token: SeSystemProfilePrivilege 1528 WMIC.exe Token: SeSystemtimePrivilege 1528 WMIC.exe Token: SeProfSingleProcessPrivilege 1528 WMIC.exe Token: SeIncBasePriorityPrivilege 1528 WMIC.exe Token: SeCreatePagefilePrivilege 1528 WMIC.exe Token: SeBackupPrivilege 1528 WMIC.exe Token: SeRestorePrivilege 1528 WMIC.exe Token: SeShutdownPrivilege 1528 WMIC.exe Token: SeDebugPrivilege 1528 WMIC.exe Token: SeSystemEnvironmentPrivilege 1528 WMIC.exe Token: SeRemoteShutdownPrivilege 1528 WMIC.exe Token: SeUndockPrivilege 1528 WMIC.exe Token: SeManageVolumePrivilege 1528 WMIC.exe Token: 33 1528 WMIC.exe Token: 34 1528 WMIC.exe Token: 35 1528 WMIC.exe Token: 36 1528 WMIC.exe Token: SeIncreaseQuotaPrivilege 1528 WMIC.exe Token: SeSecurityPrivilege 1528 WMIC.exe Token: SeTakeOwnershipPrivilege 1528 WMIC.exe Token: SeLoadDriverPrivilege 1528 WMIC.exe Token: SeSystemProfilePrivilege 1528 WMIC.exe Token: SeSystemtimePrivilege 1528 WMIC.exe Token: SeProfSingleProcessPrivilege 1528 WMIC.exe Token: SeIncBasePriorityPrivilege 1528 WMIC.exe Token: SeCreatePagefilePrivilege 1528 WMIC.exe Token: SeBackupPrivilege 1528 WMIC.exe Token: SeRestorePrivilege 1528 WMIC.exe Token: SeShutdownPrivilege 1528 WMIC.exe Token: SeDebugPrivilege 1528 WMIC.exe Token: SeSystemEnvironmentPrivilege 1528 WMIC.exe Token: SeRemoteShutdownPrivilege 1528 WMIC.exe Token: SeUndockPrivilege 1528 WMIC.exe Token: SeManageVolumePrivilege 1528 WMIC.exe Token: 33 1528 WMIC.exe Token: 34 1528 WMIC.exe Token: 35 1528 WMIC.exe Token: 36 1528 WMIC.exe Token: SeIncreaseQuotaPrivilege 4496 WMIC.exe Token: SeSecurityPrivilege 4496 WMIC.exe Token: SeTakeOwnershipPrivilege 4496 WMIC.exe Token: SeLoadDriverPrivilege 4496 WMIC.exe Token: SeSystemProfilePrivilege 4496 WMIC.exe Token: SeSystemtimePrivilege 4496 WMIC.exe Token: SeProfSingleProcessPrivilege 4496 WMIC.exe Token: SeIncBasePriorityPrivilege 4496 WMIC.exe Token: SeCreatePagefilePrivilege 4496 WMIC.exe Token: SeBackupPrivilege 4496 WMIC.exe Token: SeRestorePrivilege 4496 WMIC.exe Token: SeShutdownPrivilege 4496 WMIC.exe Token: SeDebugPrivilege 4496 WMIC.exe Token: SeSystemEnvironmentPrivilege 4496 WMIC.exe Token: SeRemoteShutdownPrivilege 4496 WMIC.exe Token: SeUndockPrivilege 4496 WMIC.exe Token: SeManageVolumePrivilege 4496 WMIC.exe Token: 33 4496 WMIC.exe Token: 34 4496 WMIC.exe Token: 35 4496 WMIC.exe Token: 36 4496 WMIC.exe Token: SeIncreaseQuotaPrivilege 4496 WMIC.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4468 wrote to memory of 1528 4468 cmd.exe 85 PID 4468 wrote to memory of 4496 4468 cmd.exe 87 PID 4468 wrote to memory of 4632 4468 cmd.exe 88 PID 4468 wrote to memory of 3968 4468 cmd.exe 89 PID 4468 wrote to memory of 4844 4468 cmd.exe 90 PID 4468 wrote to memory of 4020 4468 cmd.exe 91 PID 4468 wrote to memory of 2112 4468 cmd.exe 92 PID 4468 wrote to memory of 4688 4468 cmd.exe 94
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\hwid-changer-games-main\HWID Checker.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4468 -
C:\Windows\System32\Wbem\WMIC.exewmic csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get serialnumber2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4496
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get serialnumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632
-
-
C:\Windows\System32\Wbem\WMIC.exewmic systemenclosure get serialnumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3968
-
-
C:\Windows\System32\Wbem\WMIC.exewmic cpu get serialnumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4844
-
-
C:\Windows\System32\Wbem\WMIC.exewmic os get serialnumber2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4020
-
-
C:\Windows\system32\getmac.exegetmac2⤵PID:2112
-
-
C:\Windows\system32\cmd.execmd /k2⤵PID:4688
-