37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945

Analysis

user interaction
yes
max time kernel
898s
max time network
633s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TraceX Final/Run-TraceX-HWID-Spoofer.bat
Size 6KB
Sample260816-jsc9bsshpa
SHA256 37af4c4519fe8fe3331d56e74ff2be57c09a46041b32c5a3233acc243b456945
MD5 4f98523504c362ef51a4c82768e8b51a
SHA1 8d3c001925d58761b5707f8a10d662d7b77416c6
SHA512 95baf291c47eb91da07ba20025df0c93b54e9b06bc1afd5f2090a991ade6b50a88083472543377d1b8f6c55b50c9e0d8ec231735114291b02b5997f2972dbbfb
SSDEEP 192:H55Iq2WQKBJ+mglJIqL1WRDK6DFD66DFOQDF:Z/QNPGe6pW65OQZ
TLSH
T1A3D12122342E97760ABED52884250069F55A62CF61085EFDF1AFD1781F38384DBFE5C8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 7 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3956	powershell.exe
4156	powershell.exe
544	powershell.exe
3620	powershell.exe
1184	powershell.exe
4980	powershell.exe
1772	powershell.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	fsutil.exe
File opened (read-only)	\??\F:	fsutil.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4612	cmd.exe
4928	cmd.exe
3252	cmd.exe
3660	cmd.exe
696	cmd.exe
828	cmd.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
2524	timeout.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command\ = "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -NoLogo -ExecutionPolicy unrestricted -File \"%1\""	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\powershell.exe\shell\open\command	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Applications\powershell.exe	reg.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1184	powershell.exe
1184	powershell.exe
3956	powershell.exe
3956	powershell.exe
4156	powershell.exe
4156	powershell.exe
4980	powershell.exe
4980	powershell.exe
1772	powershell.exe
1772	powershell.exe
544	powershell.exe
544	powershell.exe
3620	powershell.exe
3620	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	1184	powershell.exe
Token: SeDebugPrivilege	3956	powershell.exe
Token: SeDebugPrivilege	4156	powershell.exe
Token: SeDebugPrivilege	4980	powershell.exe
Token: SeDebugPrivilege	1772	powershell.exe
Token: SeDebugPrivilege	544	powershell.exe
Token: SeDebugPrivilege	3620	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 696 wrote to memory of 956	696	cmd.exe	87
PID 696 wrote to memory of 828	696	cmd.exe	88
PID 828 wrote to memory of 1184	828	cmd.exe	89
PID 696 wrote to memory of 3956	696	cmd.exe	90
PID 696 wrote to memory of 4156	696	cmd.exe	91
PID 696 wrote to memory of 536	696	cmd.exe	92
PID 696 wrote to memory of 4200	696	cmd.exe	101
PID 696 wrote to memory of 1544	696	cmd.exe	103
PID 696 wrote to memory of 4980	696	cmd.exe	104
PID 696 wrote to memory of 2600	696	cmd.exe	105
PID 696 wrote to memory of 1772	696	cmd.exe	106
PID 696 wrote to memory of 544	696	cmd.exe	107
PID 696 wrote to memory of 2524	696	cmd.exe	109
PID 696 wrote to memory of 3620	696	cmd.exe	110
PID 3620 wrote to memory of 4612	3620	powershell.exe	112
PID 4612 wrote to memory of 3440	4612	cmd.exe	113
PID 3620 wrote to memory of 4928	3620	powershell.exe	114
PID 4928 wrote to memory of 2000	4928	cmd.exe	115
PID 3620 wrote to memory of 3252	3620	powershell.exe	116
PID 3252 wrote to memory of 1252	3252	cmd.exe	117
PID 3620 wrote to memory of 3660	3620	powershell.exe	118
PID 3660 wrote to memory of 4228	3660	cmd.exe	119

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\TraceX Final\Run-TraceX-HWID-Spoofer.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:696
- C:\Windows\system32\cacls.exe
  "C:\Windows\system32\cacls.exe" "C:\Windows\system32\config\system"
  2⤵
  PID:956
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Get-ExecutionPolicy -Scope CurrentUser" 2>nul
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:828
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Get-ExecutionPolicy -Scope CurrentUser"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$blocked = Get-ChildItem -Path 'C:\Users\Admin\AppData\Local\Temp\TraceX Final\' -Recurse | Where-Object { $_.IsBlocked }; if ($blocked) { exit 1 } else { exit 0 }"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Write-Host 'Test' | Out-Null"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4156
- C:\Windows\system32\choice.exe
  choice /C YN /M "Would you like to configure PowerShell now"
  2⤵
  PID:536
- C:\Windows\system32\reg.exe
  reg add "HKCR\Applications\powershell.exe\shell\open\command" /ve /t REG_SZ /d "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoLogo -ExecutionPolicy unrestricted -File \"%1\"" /f
  2⤵
  - Modifies registry class
  PID:4200
- C:\Windows\system32\reg.exe
  reg add "HKCU\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Unrestricted" /f
  2⤵
  PID:1544
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4980
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\PowerShell\1\ShellIds\Microsoft.PowerShell" /v "ExecutionPolicy" /t REG_SZ /d "Unrestricted" /f
  2⤵
  PID:2600
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope LocalMachine -Force"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Get-ChildItem -Path 'C:\Users\Admin\AppData\Local\Temp\TraceX Final\' -Recurse | Unblock-File"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:544
- C:\Windows\system32\timeout.exe
  timeout /t 1 /nobreak
  2⤵
  - Delays execution with timeout.exe
  PID:2524
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -Command "& 'C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\HWID-Spoofer.ps1'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "fsutil fsinfo volumeinfo C:"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4612
  - - C:\Windows\system32\fsutil.exe
      fsutil fsinfo volumeinfo C:
      4⤵
      PID:3440
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "fsutil fsinfo volumeinfo F:"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4928
  - - C:\Windows\system32\fsutil.exe
      fsutil fsinfo volumeinfo F:
      4⤵
      Enumerates connected drives
      PID:2000
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "fsutil fsinfo volumeinfo F:"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3252
  - - C:\Windows\system32\fsutil.exe
      fsutil fsinfo volumeinfo F:
      4⤵
      Enumerates connected drives
      PID:1252
- - C:\Windows\system32\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "cd /d "C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools" && "C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\VolumeID64.exe" -accepteula F: 89E1-8524"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3660
  - - C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\VolumeID64.exe
      "C:\Users\Admin\AppData\Local\Temp\TraceX Final\tools\VolumeID64.exe" -accepteula F: 89E1-8524
      4⤵
      PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...