Analysis
- user interaction
yes - max time kernel
59s - max time network
59s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 17:21
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
hwidspoof_x64.exe
Resource
win11-20260911-en
windows11-21h2-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
hwidspoof_x64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target hwidspoof_x64.exe
- Size 18.2MB
- Sample261014-vxe49sgt21
- SHA256 6052dae9db2423a9e56ec9162fa92d63bf69e6818a971394a8931ed0c507d291
- MD5 0d1471e20947315b4e791c1e860a10d6
- SHA1 f207735343f12644e136e2296c372e30f99579b6
- SHA512 63512268acb5ba5e7bccb827303d3b0c99a787b952e6bffc50a14eaa6726f4e98dd441c0823af92aebefa038f91520a189db4bb3cff55ea3c62e6d4ac451edc3
- SSDEEP 196608:684ZbQI9U1zpCfxwNrmvxQiLntezRKMveE7yuGYp3MUqCrdjMWZ9I95X/K9Tb7n:BDrAfxMqvxhYzRtp7yZwnrNPqTXUH7
- TLSH T15D17D043F2A295ECD06AC074935A7633FA327C4D43357AEB5BD04A213F69F906A39B05
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 5164 extra.exe 4692 elv_b921d5e5-5a22-4d2a-a4c6-5e706ba8dd21.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain wmic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname extra.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain extra.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 4116 hwidspoof_x64.exe 4116 hwidspoof_x64.exe 4116 hwidspoof_x64.exe 4116 hwidspoof_x64.exe 4116 hwidspoof_x64.exe 4116 hwidspoof_x64.exe 5260 wmic.exe 5260 wmic.exe 5260 wmic.exe 5260 wmic.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe 5164 extra.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 5260 wmic.exe Token: SeSecurityPrivilege 5260 wmic.exe Token: SeTakeOwnershipPrivilege 5260 wmic.exe Token: SeLoadDriverPrivilege 5260 wmic.exe Token: SeSystemProfilePrivilege 5260 wmic.exe Token: SeSystemtimePrivilege 5260 wmic.exe Token: SeProfSingleProcessPrivilege 5260 wmic.exe Token: SeIncBasePriorityPrivilege 5260 wmic.exe Token: SeCreatePagefilePrivilege 5260 wmic.exe Token: SeBackupPrivilege 5260 wmic.exe Token: SeRestorePrivilege 5260 wmic.exe Token: SeShutdownPrivilege 5260 wmic.exe Token: SeDebugPrivilege 5260 wmic.exe Token: SeSystemEnvironmentPrivilege 5260 wmic.exe Token: SeRemoteShutdownPrivilege 5260 wmic.exe Token: SeUndockPrivilege 5260 wmic.exe Token: SeManageVolumePrivilege 5260 wmic.exe Token: 33 5260 wmic.exe Token: 34 5260 wmic.exe Token: 35 5260 wmic.exe Token: 36 5260 wmic.exe Token: SeIncreaseQuotaPrivilege 5260 wmic.exe Token: SeSecurityPrivilege 5260 wmic.exe Token: SeTakeOwnershipPrivilege 5260 wmic.exe Token: SeLoadDriverPrivilege 5260 wmic.exe Token: SeSystemProfilePrivilege 5260 wmic.exe Token: SeSystemtimePrivilege 5260 wmic.exe Token: SeProfSingleProcessPrivilege 5260 wmic.exe Token: SeIncBasePriorityPrivilege 5260 wmic.exe Token: SeCreatePagefilePrivilege 5260 wmic.exe Token: SeBackupPrivilege 5260 wmic.exe Token: SeRestorePrivilege 5260 wmic.exe Token: SeShutdownPrivilege 5260 wmic.exe Token: SeDebugPrivilege 5260 wmic.exe Token: SeSystemEnvironmentPrivilege 5260 wmic.exe Token: SeRemoteShutdownPrivilege 5260 wmic.exe Token: SeUndockPrivilege 5260 wmic.exe Token: SeManageVolumePrivilege 5260 wmic.exe Token: 33 5260 wmic.exe Token: 34 5260 wmic.exe Token: 35 5260 wmic.exe Token: 36 5260 wmic.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4116 hwidspoof_x64.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4116 hwidspoof_x64.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4116 wrote to memory of 5164 4116 hwidspoof_x64.exe 90 PID 5164 wrote to memory of 5260 5164 extra.exe 91 PID 5164 wrote to memory of 4692 5164 extra.exe 94 PID 4692 wrote to memory of 1224 4692 elv_b921d5e5-5a22-4d2a-a4c6-5e706ba8dd21.exe 96 PID 4692 wrote to memory of 1224 4692 elv_b921d5e5-5a22-4d2a-a4c6-5e706ba8dd21.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\hwidspoof_x64.exe"C:\Users\Admin\AppData\Local\Temp\hwidspoof_x64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4116 -
C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\extra.exe"C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\extra.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5164 -
C:\Windows\System32\Wbem\wmic.exe"wmic" logicaldisk where drivetype=3 get size /format:list3⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5260
-
-
C:\Users\Admin\AppData\Local\Temp\elv_b921d5e5-5a22-4d2a-a4c6-5e706ba8dd21.exe"C:\Users\Admin\AppData\Local\Temp\elv_b921d5e5-5a22-4d2a-a4c6-5e706ba8dd21.exe" chrome -o temp_abe_output\chrome -v -f3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"4⤵PID:1224
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Windows\Caches\extra.exe
- Size 10.1MB
- SHA256 01e844ae69d2e7c2695edd31e2a1677e79f268b4325d15fcea71da5280bc045f
- MD5 51079567b1c059af984b7031cc62d039
- SHA1 fe5684b2c73bfb1ca8beb7920277bea11adf91de
- SHA512 3cb7c5526544e5a6e31293f4fa1e8417922b99a50fee88c01f9f2442455527ce1f21c707d69f8d505768ed790eabf30e5f09f60cb154cc86d1fd76306e270776
- SSDEEP 196608:+X/ehS1I4useiUK5PGzvaL/Hler6Z9Lt7qHJvYvUITa:+X/e01nufiUKdGzvarH+kR7qHdI+
- TLSH T118B63374A17988F3D2E6E631A5569683B8397200872045DB631C993D2F07BC06EBF77B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\elv_b921d5e5-5a22-4d2a-a4c6-5e706ba8dd21.exe
- Size 1.4MB
- SHA256 671cdb4073a267455050b240df9bafbcf857db2052c578a899ac91707c3bef16
- MD5 7c9b8c74e6c7d2ac95a7e96eb9f44ea5
- SHA1 38ed669edec250bb13c9bad53a79365e5985e61d
- SHA512 15fbd4e99bb70def7d17dced847fb18e82a461580ac55413ec13042dbef7d9b7410c54f9301d5207a5fb3ca0cc3b5ef179debbb1dae5e4659068c7d0e34949e6
- SSDEEP 24576:URQDAx+qUU8KTG7LMBFZE41m2yRwRkY9342P/dsD:URQDuwU1G7QBtoakY9I2P+
- TLSH T1AA65121BA6A400FDE1BBC274C9124A0ADB76FC4A4771E68F13944F951F27BA04E3EB51
- MD5 SHA1 SHA512 SSDEEP TLSH