Analysis
- max time kernel
145s - max time network
154s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
08/08/2026, 17:14
General
- Target HWIDSpoofer.exe
- Size 5.2MB
- Sample260808-vsbahs1elb
- SHA256 58fed528f133e4ea62e5346f8416fc4fccecf3d17613f4c3c014e709b26541bc
Malware Config
Signatures
- Stops running service(s) 4 TTPs
- VMProtect packed file 4 IoCs
Detects executables packed with VMProtect commercial packer.
- Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe"C:\Users\Admin\AppData\Local\Temp\HWIDSpoofer.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\sc.exesc stop BEService3⤵
- Launches sc.exe
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2796-2-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/2796-6-0x0000000002B30000-0x0000000002B31000-memory.dmp
memory/2796-8-0x0000000000400000-0x0000000000C93000-memory.dmp
memory/2796-7-0x0000000002B40000-0x0000000002B41000-memory.dmp
memory/2796-11-0x0000000000400000-0x0000000000C93000-memory.dmp
memory/2796-5-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/2796-4-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/2796-3-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/2796-1-0x0000000000E00000-0x0000000000E01000-memory.dmp
memory/2796-12-0x0000000000400000-0x0000000000C93000-memory.dmp
memory/2796-0-0x0000000000426000-0x000000000075C000-memory.dmp
memory/2796-13-0x00000000031E0000-0x0000000003210000-memory.dmp
memory/2796-14-0x0000000005750000-0x0000000005CF6000-memory.dmp
memory/2796-15-0x00000000056A0000-0x00000000056CE000-memory.dmp
memory/2796-23-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-122-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-137-0x0000000000400000-0x0000000000C93000-memory.dmp
memory/2796-125-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-143-0x0000000005F70000-0x0000000005F78000-memory.dmp
memory/2796-123-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-119-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-118-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-115-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-111-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-109-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-107-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-105-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-103-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-101-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-99-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-97-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-113-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-95-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-93-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-91-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-144-0x000000000A570000-0x000000000A578000-memory.dmp
memory/2796-89-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-87-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-85-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-83-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-81-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-79-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-75-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-74-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-71-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-70-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-67-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-65-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-63-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-61-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-59-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-55-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-53-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-51-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-49-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-47-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-45-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-43-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-41-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-39-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-37-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-35-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-33-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-29-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-27-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-25-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-21-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-19-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-17-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-16-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-77-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-58-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-31-0x00000000056A0000-0x00000000056C8000-memory.dmp
memory/2796-146-0x000000000A750000-0x000000000A75E000-memory.dmp
memory/2796-145-0x000000000AB60000-0x000000000AB98000-memory.dmp
memory/2796-147-0x0000000000426000-0x000000000075C000-memory.dmp