Overview
overview
8Static
static
3Manuel spo...er.exe
windows10-2004-x64
6Manuel spo...er.exe
windows11-ltsc_2024-x64
6Manuel spo...64.sys
windows10-2004-x64
3Manuel spo...64.sys
windows11-ltsc_2024-x64
3Manuel spo...of.exe
windows10-2004-x64
1Manuel spo...of.exe
windows11-ltsc_2024-x64
1Manuel spo...of.bat
windows10-2004-x64
3Manuel spo...of.bat
windows11-ltsc_2024-x64
3Manuel spo...up.exe
windows10-2004-x64
3Manuel spo...up.exe
windows11-ltsc_2024-x64
7Manuel spo...DA.pdf
windows10-2004-x64
3Manuel spo...DA.pdf
windows11-ltsc_2024-x64
3Manuel spo...IT.exe
windows10-2004-x64
3Manuel spo...IT.exe
windows11-ltsc_2024-x64
3Manuel spo...64.exe
windows10-2004-x64
1Manuel spo...64.exe
windows11-ltsc_2024-x64
1procexp.chm
windows10-2004-x64
1procexp.chm
windows11-ltsc_2024-x64
1procexp.exe
windows10-2004-x64
8procexp.exe
windows11-ltsc_2024-x64
8procexp64.exe
windows10-2004-x64
8procexp64.exe
windows11-ltsc_2024-x64
8procexp64a.exe
windows10-2004-x64
procexp64a.exe
windows11-ltsc_2024-x64
Manuel spo...32.sys
windows10-2004-x64
3Manuel spo...32.sys
windows11-ltsc_2024-x64
3Manuel spo...64.sys
windows10-2004-x64
3Manuel spo...64.sys
windows11-ltsc_2024-x64
3Manuel spo...it.exe
windows10-2004-x64
3Manuel spo...it.exe
windows11-ltsc_2024-x64
3Manuel spo...1).bat
windows10-2004-x64
3Manuel spo...1).bat
windows11-ltsc_2024-x64
3Analysis
- max time kernel
148s - max time network
142s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 12:57
Static task
static1
Behavioral task
behavioral1
Sample
Manuel spoof/HardDiskSerialNumberChanger.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Manuel spoof/HardDiskSerialNumberChanger.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Manuel spoof/Manual-Spoofer-main/Manual-Spoofer-main/sefdebos64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Manuel spoof/Manual-Spoofer-main/Manual-Spoofer-main/sefdebos64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Manuel spoof/Manual-Spoofer-main/Manual-Spoofer-main/spoof.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Manuel spoof/Manual-Spoofer-main/Manual-Spoofer-main/spoof.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Manuel spoof/Manual-Spoofer-main/Manual-Spoofer-main/spoof.bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Manuel spoof/Manual-Spoofer-main/Manual-Spoofer-main/spoof.bat
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Manuel spoof/TMACv6.0.7_Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Manuel spoof/TMACv6.0.7_Setup.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Manuel spoof/dmiedit-main/AMI_AptioV_DMIEDIT_GUI_User_Guide_NDA.pdf
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Manuel spoof/dmiedit-main/AMI_AptioV_DMIEDIT_GUI_User_Guide_NDA.pdf
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Manuel spoof/dmiedit-main/DMIEDIT.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Manuel spoof/dmiedit-main/DMIEDIT.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Manuel spoof/dmiedit-main/DMIEDITx64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Manuel spoof/dmiedit-main/DMIEDITx64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
procexp.chm
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
procexp.chm
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
procexp.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
procexp.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
procexp64.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
procexp64.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
procexp64a.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
procexp64a.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Manuel spoof/dmiedit-main/amifldrv32.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Manuel spoof/dmiedit-main/amifldrv32.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Manuel spoof/dmiedit-main/amifldrv64.sys
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Manuel spoof/dmiedit-main/amifldrv64.sys
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
Manuel spoof/dmiedit-main/bit.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
Manuel spoof/dmiedit-main/bit.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
Manuel spoof/quick_hwid (1).bat
Resource
win10v2004-20260513-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
Manuel spoof/quick_hwid (1).bat
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
General
- Target Manuel spoof/HardDiskSerialNumberChanger.exe
- Size 636KB
- Sample260822-p7ch8sgr3z
- SHA256 2c141c06f7df57f11ef2c62f2a96093484a65df47065b1a475c53784af0e2664
- MD5 c20e96d4e616ce333c19a1c15a1cc137
- SHA1 f79645ec115130ee59958c55a556f564260b7a9e
- SHA512 519fec9955c4a18e45ec68d9e7dc2bcda74721a6ea088e59e634e26b136bfa15f5efedf8839c036a3cfdcdb9780a2121dc2d71f1fdbbfd3df02d9969e5db753b
- SSDEEP 12288:EN1TNRzUSWgDxPWnP0Lamg+hyMU1EUFT99qpDDcZDDR5Id1888888888888W888H:whNRASWgDxPWnP0LamWYC8EOd
- TLSH T188D47D12B3D14437D177563D9C7B92A8AC26BD212EE4984A2EF4FE4C1F787813939263
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: HardDiskSerialNumberChanger.exe File opened (read-only) \??\N: HardDiskSerialNumberChanger.exe File opened (read-only) \??\S: HardDiskSerialNumberChanger.exe File opened (read-only) \??\T: HardDiskSerialNumberChanger.exe File opened (read-only) \??\U: HardDiskSerialNumberChanger.exe File opened (read-only) \??\Y: HardDiskSerialNumberChanger.exe File opened (read-only) \??\D: HardDiskSerialNumberChanger.exe File opened (read-only) \??\O: HardDiskSerialNumberChanger.exe File opened (read-only) \??\P: HardDiskSerialNumberChanger.exe File opened (read-only) \??\R: HardDiskSerialNumberChanger.exe File opened (read-only) \??\A: HardDiskSerialNumberChanger.exe File opened (read-only) \??\G: HardDiskSerialNumberChanger.exe File opened (read-only) \??\J: HardDiskSerialNumberChanger.exe File opened (read-only) \??\M: HardDiskSerialNumberChanger.exe File opened (read-only) \??\V: HardDiskSerialNumberChanger.exe File opened (read-only) \??\W: HardDiskSerialNumberChanger.exe File opened (read-only) \??\H: HardDiskSerialNumberChanger.exe File opened (read-only) \??\I: HardDiskSerialNumberChanger.exe File opened (read-only) \??\K: HardDiskSerialNumberChanger.exe File opened (read-only) \??\Q: HardDiskSerialNumberChanger.exe File opened (read-only) \??\X: HardDiskSerialNumberChanger.exe File opened (read-only) \??\Z: HardDiskSerialNumberChanger.exe File opened (read-only) \??\B: HardDiskSerialNumberChanger.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HardDiskSerialNumberChanger.exe