Analysis
- user interaction
yes - max time kernel
148s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
08/08/2026, 17:14
General
- Target HWIDSpoofer.exe
- Size 5.2MB
- Sample260808-vsbahs1elb
- SHA256 58fed528f133e4ea62e5346f8416fc4fccecf3d17613f4c3c014e709b26541bc
Malware Config
Signatures
- Stops running service(s) 4 TTPs
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop BEService3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2124-3-0x0000000000E20000-0x0000000000E21000-memory.dmp
memory/2124-6-0x0000000000E70000-0x0000000000E71000-memory.dmp
memory/2124-5-0x0000000000E60000-0x0000000000E61000-memory.dmp
memory/2124-4-0x0000000000E50000-0x0000000000E51000-memory.dmp
memory/2124-2-0x0000000000E10000-0x0000000000E11000-memory.dmp
memory/2124-1-0x0000000000426000-0x000000000075C000-memory.dmp
memory/2124-0-0x0000000000E00000-0x0000000000E01000-memory.dmp
memory/2124-10-0x0000000000400000-0x0000000000C93000-memory.dmp
memory/2124-7-0x0000000000F90000-0x0000000000F91000-memory.dmp
memory/2124-12-0x0000000000400000-0x0000000000C93000-memory.dmp
memory/2124-13-0x00000000030B0000-0x00000000030E0000-memory.dmp
memory/2124-14-0x0000000000400000-0x0000000000C93000-memory.dmp
memory/2124-15-0x0000000005770000-0x0000000005D14000-memory.dmp
memory/2124-16-0x00000000055D0000-0x00000000055FE000-memory.dmp
memory/2124-44-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-58-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-118-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-128-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-126-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-143-0x0000000005EB0000-0x0000000005EB8000-memory.dmp
memory/2124-124-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-122-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-120-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-116-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-115-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-112-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-110-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-108-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-107-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-105-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-102-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-101-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-99-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-96-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-94-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-92-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-90-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-88-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-86-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-84-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-82-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-81-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-78-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-76-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-74-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-73-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-70-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-66-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-64-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-62-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-60-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-56-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-54-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-52-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-50-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-48-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-46-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-42-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-40-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-38-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-36-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-34-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-32-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-30-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-28-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-26-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-24-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-22-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-20-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-18-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-17-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-68-0x00000000055D0000-0x00000000055F8000-memory.dmp
memory/2124-144-0x000000000A580000-0x000000000A588000-memory.dmp
memory/2124-145-0x000000000A880000-0x000000000A8B8000-memory.dmp
memory/2124-146-0x000000000A5B0000-0x000000000A5BE000-memory.dmp
memory/2124-147-0x0000000000426000-0x000000000075C000-memory.dmp