Overview
overview
10Static
static
7Pumpkhn_Un...1).exe
windows10-2004-x64
9Pumpkhn_Un...1).exe
windows11-ltsc_2024-x64
9Pumpkhn_Un...ep.exe
windows10-2004-x64
10Pumpkhn_Un...ep.exe
windows11-ltsc_2024-x64
10Pumpkhn_Un...IN.exe
windows10-2004-x64
3Pumpkhn_Un...IN.exe
windows11-ltsc_2024-x64
3Pumpkhn_Un...64.exe
windows10-2004-x64
1Pumpkhn_Un...64.exe
windows11-ltsc_2024-x64
1Pumpkhn_Un...16.exe
windows10-2004-x64
Pumpkhn_Un...16.exe
windows11-ltsc_2024-x64
Pumpkhn_Un...IT.exe
windows10-2004-x64
1Pumpkhn_Un...IT.exe
windows11-ltsc_2024-x64
1Pumpkhn_Un...LL.dll
windows10-2004-x64
3Pumpkhn_Un...LL.dll
windows11-ltsc_2024-x64
3Pumpkhn_Un...YS.sys
windows10-2004-x64
3Pumpkhn_Un...YS.sys
windows11-ltsc_2024-x64
3Pumpkhn_Un...64.sys
windows10-2004-x64
3Pumpkhn_Un...64.sys
windows11-ltsc_2024-x64
3Pumpkhn_Un...64.sys
windows10-2004-x64
3Pumpkhn_Un...64.sys
windows11-ltsc_2024-x64
3Pumpkhn_Un...H1.exe
windows10-2004-x64
3Pumpkhn_Un...H1.exe
windows11-ltsc_2024-x64
8Pumpkhn_Un...er.exe
windows10-2004-x64
6Pumpkhn_Un...er.exe
windows11-ltsc_2024-x64
6Pumpkhn_Un...AC.exe
windows10-2004-x64
7Pumpkhn_Un...AC.exe
windows11-ltsc_2024-x64
8Pumpkhn_Un...er.bat
windows10-2004-x64
4Pumpkhn_Un...er.bat
windows11-ltsc_2024-x64
8Analysis
- max time kernel
899s - max time network
463s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/11/2026, 12:59
Behavioral task
behavioral1
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/AppleCleaner (1).exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/AppleCleaner (1).exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/CleanBan_SysPrep.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/CleanBan_SysPrep.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/AMIDEWIN.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/AMIDEWIN.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/AMIDEWINx64.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/AMIDEWINx64.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/DMI16.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/DMI16.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/DMIEDIT.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/DMIEDIT.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/UCOREDLL.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/UCOREDLL.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/UCORESYS.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/UCORESYS.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/UCOREW64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/UCOREW64.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/amifldrv64.sys
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/DmiEdit/amifldrv64.sys
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/FN Cleaner/FortniteTracerCleaner1803-21H1.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/FN Cleaner/FortniteTracerCleaner1803-21H1.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/HWID Key Changer.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/HWID Key Changer.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/TMAC.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/TMAC.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/serial_checker.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/serial_checker.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target Pumpkhn_UnhwidBan/Unhwidban/hwid/FIles/HWID Key Changer.exe
- Size 636KB
- Sample261102-p77pdatwht
- SHA256 2c141c06f7df57f11ef2c62f2a96093484a65df47065b1a475c53784af0e2664
- MD5 c20e96d4e616ce333c19a1c15a1cc137
- SHA1 f79645ec115130ee59958c55a556f564260b7a9e
- SHA512 519fec9955c4a18e45ec68d9e7dc2bcda74721a6ea088e59e634e26b136bfa15f5efedf8839c036a3cfdcdb9780a2121dc2d71f1fdbbfd3df02d9969e5db753b
- SSDEEP 12288:EN1TNRzUSWgDxPWnP0Lamg+hyMU1EUFT99qpDDcZDDR5Id1888888888888W888H:whNRASWgDxPWnP0LamWYC8EOd
- TLSH T188D47D12B3D14437D177563D9C7B92A8AC26BD212EE4984A2EF4FE4C1F787813939263
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: HWID Key Changer.exe File opened (read-only) \??\R: HWID Key Changer.exe File opened (read-only) \??\S: HWID Key Changer.exe File opened (read-only) \??\X: HWID Key Changer.exe File opened (read-only) \??\K: HWID Key Changer.exe File opened (read-only) \??\N: HWID Key Changer.exe File opened (read-only) \??\P: HWID Key Changer.exe File opened (read-only) \??\Q: HWID Key Changer.exe File opened (read-only) \??\U: HWID Key Changer.exe File opened (read-only) \??\Y: HWID Key Changer.exe File opened (read-only) \??\A: HWID Key Changer.exe File opened (read-only) \??\G: HWID Key Changer.exe File opened (read-only) \??\T: HWID Key Changer.exe File opened (read-only) \??\V: HWID Key Changer.exe File opened (read-only) \??\Z: HWID Key Changer.exe File opened (read-only) \??\B: HWID Key Changer.exe File opened (read-only) \??\D: HWID Key Changer.exe File opened (read-only) \??\L: HWID Key Changer.exe File opened (read-only) \??\W: HWID Key Changer.exe File opened (read-only) \??\H: HWID Key Changer.exe File opened (read-only) \??\I: HWID Key Changer.exe File opened (read-only) \??\J: HWID Key Changer.exe File opened (read-only) \??\M: HWID Key Changer.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HWID Key Changer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Pumpkhn_UnhwidBan\Unhwidban\hwid\FIles\HWID Key Changer.exe"C:\Users\Admin\AppData\Local\Temp\Pumpkhn_UnhwidBan\Unhwidban\hwid\FIles\HWID Key Changer.exe"1⤵
- Enumerates connected drives
- System Location Discovery: System Language Discovery
PID:4348
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1144
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵PID:2044