Overview
overview
5Static
static
3AMIDEWINx64.exe
windows10-2004-x64
1AMIDEWINx64.exe
windows11-ltsc_2024-x64
1AMIFLDRV64.sys
windows10-2004-x64
3AMIFLDRV64.sys
windows11-ltsc_2024-x64
3HWID Checker.bat
windows10-2004-x64
3HWID Checker.bat
windows11-ltsc_2024-x64
3MacChanger.bat
windows10-2004-x64
3MacChanger.bat
windows11-ltsc_2024-x64
3Spoofer.bat
windows10-2004-x64
5Spoofer.bat
windows11-ltsc_2024-x64
5Analysis
- user interaction
yes - max time kernel
149s - max time network
131s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
13/08/2026, 17:09
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
AMIDEWINx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
AMIDEWINx64.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
AMIFLDRV64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
AMIFLDRV64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
HWID Checker.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral6
Sample
HWID Checker.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
Behavioral task
behavioral7
Sample
MacChanger.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
MacChanger.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
Spoofer.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
Spoofer.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
5 signatures
150 seconds
General
- Target HWID Checker.bat
- Size 2KB
- Sample260813-vpdapstwcs
- SHA256 827678b52aa2e92c3290391032129d8b87cbb498829201eb7f4e34737dd63cfc
- MD5 06ec29affda20ec677137d5e25d1d1a7
- SHA1 f768bcad64c7f22491978e97db311fa254fc7c99
- SHA512 2cf1b5441e9463d0e36890031046ef3736c2cb954d7f2041d7aa80073e1a5b3a4715da0ec0f7d500f3447afaea0b0c11b378261606333d76785f4e242d28eca6
- TLSH T1B35136667C99C5744260EE633E380266F3424A478C174E4B346F807E0F423CBB2AD62D
- MD5 SHA1 SHA512 TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 312 powershell.exe 1952 powershell.exe - Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4568 cmd.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 312 powershell.exe 312 powershell.exe 1952 powershell.exe 1952 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 312 powershell.exe Token: SeIncreaseQuotaPrivilege 3836 WMIC.exe Token: SeSecurityPrivilege 3836 WMIC.exe Token: SeTakeOwnershipPrivilege 3836 WMIC.exe Token: SeLoadDriverPrivilege 3836 WMIC.exe Token: SeSystemProfilePrivilege 3836 WMIC.exe Token: SeSystemtimePrivilege 3836 WMIC.exe Token: SeProfSingleProcessPrivilege 3836 WMIC.exe Token: SeIncBasePriorityPrivilege 3836 WMIC.exe Token: SeCreatePagefilePrivilege 3836 WMIC.exe Token: SeBackupPrivilege 3836 WMIC.exe Token: SeRestorePrivilege 3836 WMIC.exe Token: SeShutdownPrivilege 3836 WMIC.exe Token: SeDebugPrivilege 3836 WMIC.exe Token: SeSystemEnvironmentPrivilege 3836 WMIC.exe Token: SeRemoteShutdownPrivilege 3836 WMIC.exe Token: SeUndockPrivilege 3836 WMIC.exe Token: SeManageVolumePrivilege 3836 WMIC.exe Token: 33 3836 WMIC.exe Token: 34 3836 WMIC.exe Token: 35 3836 WMIC.exe Token: 36 3836 WMIC.exe Token: SeIncreaseQuotaPrivilege 3836 WMIC.exe Token: SeSecurityPrivilege 3836 WMIC.exe Token: SeTakeOwnershipPrivilege 3836 WMIC.exe Token: SeLoadDriverPrivilege 3836 WMIC.exe Token: SeSystemProfilePrivilege 3836 WMIC.exe Token: SeSystemtimePrivilege 3836 WMIC.exe Token: SeProfSingleProcessPrivilege 3836 WMIC.exe Token: SeIncBasePriorityPrivilege 3836 WMIC.exe Token: SeCreatePagefilePrivilege 3836 WMIC.exe Token: SeBackupPrivilege 3836 WMIC.exe Token: SeRestorePrivilege 3836 WMIC.exe Token: SeShutdownPrivilege 3836 WMIC.exe Token: SeDebugPrivilege 3836 WMIC.exe Token: SeSystemEnvironmentPrivilege 3836 WMIC.exe Token: SeRemoteShutdownPrivilege 3836 WMIC.exe Token: SeUndockPrivilege 3836 WMIC.exe Token: SeManageVolumePrivilege 3836 WMIC.exe Token: 33 3836 WMIC.exe Token: 34 3836 WMIC.exe Token: 35 3836 WMIC.exe Token: 36 3836 WMIC.exe Token: SeIncreaseQuotaPrivilege 3220 WMIC.exe Token: SeSecurityPrivilege 3220 WMIC.exe Token: SeTakeOwnershipPrivilege 3220 WMIC.exe Token: SeLoadDriverPrivilege 3220 WMIC.exe Token: SeSystemProfilePrivilege 3220 WMIC.exe Token: SeSystemtimePrivilege 3220 WMIC.exe Token: SeProfSingleProcessPrivilege 3220 WMIC.exe Token: SeIncBasePriorityPrivilege 3220 WMIC.exe Token: SeCreatePagefilePrivilege 3220 WMIC.exe Token: SeBackupPrivilege 3220 WMIC.exe Token: SeRestorePrivilege 3220 WMIC.exe Token: SeShutdownPrivilege 3220 WMIC.exe Token: SeDebugPrivilege 3220 WMIC.exe Token: SeSystemEnvironmentPrivilege 3220 WMIC.exe Token: SeRemoteShutdownPrivilege 3220 WMIC.exe Token: SeUndockPrivilege 3220 WMIC.exe Token: SeManageVolumePrivilege 3220 WMIC.exe Token: 33 3220 WMIC.exe Token: 34 3220 WMIC.exe Token: 35 3220 WMIC.exe Token: 36 3220 WMIC.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4568 wrote to memory of 312 4568 cmd.exe 86 PID 4568 wrote to memory of 3836 4568 cmd.exe 87 PID 4568 wrote to memory of 3220 4568 cmd.exe 89 PID 4568 wrote to memory of 868 4568 cmd.exe 91 PID 4568 wrote to memory of 5776 4568 cmd.exe 92 PID 4568 wrote to memory of 1952 4568 cmd.exe 93 PID 4568 wrote to memory of 4824 4568 cmd.exe 94 PID 4568 wrote to memory of 4356 4568 cmd.exe 97 PID 4568 wrote to memory of 5620 4568 cmd.exe 98
Processes
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\HWID Checker.bat"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4568 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "$h=$Host.UI.RawUI; $b=$h.BufferSize; $b.Height=5000; $b.Width=180; $h.BufferSize=$b; $w=$h.WindowSize; $w.Width=180; $w.Height=40; $h.WindowSize=$w"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:312
-
-
C:\Windows\System32\Wbem\WMIC.exewmic baseboard get Manufacturer,Product,SerialNumber,Version2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3836
-
-
C:\Windows\System32\Wbem\WMIC.exewmic bios get Manufacturer,SMBIOSBIOSVersion,SerialNumber,ReleaseDate2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
-
C:\Windows\System32\Wbem\WMIC.exewmic computersystem get Manufacturer,Model2⤵PID:868
-
-
C:\Windows\System32\Wbem\WMIC.exewmic nic where "NetEnabled=true" get Name,MACAddress2⤵PID:5776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -NoProfile -Command "try{Get-Tpm | Select TpmPresent,TpmReady,ManufacturerIdTxt,ManufacturerVersion}catch{}"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1952
-
-
C:\Windows\System32\Wbem\WMIC.exewmic os get Caption,Version,BuildNumber2⤵PID:4824
-
-
C:\Windows\System32\Wbem\WMIC.exewmic path win32_computersystemproduct get IdentifyingNumber,UUID,Vendor2⤵PID:4356
-
-
C:\Windows\System32\Wbem\WMIC.exewmic systemenclosure get Manufacturer,SerialNumber,SMBIOSAssetTag2⤵PID:5620
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
- Size 2KB
- SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
- MD5 d85ba6ff808d9e5444a4b369f5bc2730
- SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
- SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
- TLSH T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
- Size 944B
- SHA256 7eb27aa79f58330353a590fecaf193144a25377ca9d71207755fa1b0ce2f835a
- MD5 8e2a621d50fcd69b69de4c2076db42e6
- SHA1 106afb8e515d25eb0d8ea0d643a640eb3cce266a
- SHA512 9091fbadd0a73ce663b962e396015a494815ab8230d0d8d4aadf1f231e35f5b769b12ddd1ccb4790fe9ff17fbdd822b255eb22fb05420d3e4bf1b2793826d463
- TLSH T136114523F78C8920CC96563A509DAC5172B586CB81AEDF9F7FC0D210E1BF584CBA1294
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ue144lyq.ulb.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH