File name:

hwid-spoofer---charlootus-treats.rar

Full analysis: https://app.any.run/tasks/d5685c8d-907f-47fe-922e-13079c67cfe4
Verdict: Malicious activity
Analysis date: April 17, 2020, 22:04:53
OS: Windows 7 Professional Service Pack 1 (build: 7601, 32 bit)
Indicators:
MIME: application/x-rar
File info: RAR archive data, v5
MD5:

371884112A84053B74FA04F8C60EE219

SHA1:

D58A70F3ACF3F8474DBA00604D93B341F305623D

SHA256:

0B478D0CB10B9E9D4201842F827EF4BF5070E3D44A80253F02209806A2A1207D

SSDEEP:

196608:RCAtK1dJMpR6h5VzBMuEW+Em308TJIrdSHhn9EJzrXxp2t6UHqe93apmMbAfRvVJ:Ho1dJgY5VWuEW+Em3V2kR9EFhctFHqeb

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Application was dropped or rewritten from another process

      • hwid.exe (PID: 2340)
      • hwid.exe (PID: 2780)
      • hardware.exe (PID: 1348)
      • NICMACModifTool.exe (PID: 1740)
      • NICMACModifTool.exe (PID: 2748)
      • hardware.exe (PID: 3948)

    • Changes settings of System certificates

      • hardware.exe (PID: 3948)

  • SUSPICIOUS

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 3196)

    • Reads internet explorer settings

      • hardware.exe (PID: 3948)

    • Executed via COM

      • DllHost.exe (PID: 3188)

    • Reads Internet Cache Settings

      • hardware.exe (PID: 3948)

    • Low-level read access rights to disk partition

      • hardware.exe (PID: 3948)

    • Adds / modifies Windows certificates

      • hardware.exe (PID: 3948)

  • INFO

    • Reads settings of System Certificates

      • hardware.exe (PID: 3948)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.rar | RAR compressed archive (v5.0) (61.5)
.rar | RAR compressed archive (gen) (38.4)
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
56
Monitored processes
10
Malicious processes
3
Suspicious processes
0

Behavior graph

Click at the process to see the details
drop and start drop and start drop and start drop and start drop and start drop and start start winrar.exe hardware.exe no specs hardware.exe hwid.exe no specs hwid.exe regedit.exe no specs regedit.exe PhotoViewer.dll no specs nicmacmodiftool.exe no specs nicmacmodiftool.exe

Process information

PID
CMD
Path
Indicators
Parent process
1348"C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Spoofers\hardware.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Spoofers\hardware.exe—WinRAR.exe
User:
admin
Company:
caspue
Integrity Level:
MEDIUM
Description:
caspue
Exit code:
3221226540
Version:
1, 0, 0, 0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3196.45949\hwid spoofer - charlootus' treats\spoofers\hardware.exe
c:\systemroot\system32\ntdll.dll
1740"C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.49351\HWID Spoofer - Charlootus' Treats\Spoofers\NICMACModifTool.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.49351\HWID Spoofer - Charlootus' Treats\Spoofers\NICMACModifTool.exe—WinRAR.exe
User:
admin
Company:
NIC MAC Address Modification Tool
Integrity Level:
MEDIUM
Description:
NIC MAC Address Modification Tool
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3196.49351\hwid spoofer - charlootus' treats\spoofers\nicmacmodiftool.exe
c:\systemroot\system32\ntdll.dll
1780"regedit.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3196.48345\HwProfileGuid_NotFoundFix.reg"C:\Windows\regedit.exe
WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Editor
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
2340"C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.47281\HWID Spoofer - Charlootus' Treats\Spoofers\hwid.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.47281\HWID Spoofer - Charlootus' Treats\Spoofers\hwid.exe—WinRAR.exe
User:
admin
Integrity Level:
MEDIUM
Description:
HWID Changer
Exit code:
3221226540
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3196.47281\hwid spoofer - charlootus' treats\spoofers\hwid.exe
c:\systemroot\system32\ntdll.dll
2748"C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.49351\HWID Spoofer - Charlootus' Treats\Spoofers\NICMACModifTool.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.49351\HWID Spoofer - Charlootus' Treats\Spoofers\NICMACModifTool.exe
WinRAR.exe
User:
admin
Company:
NIC MAC Address Modification Tool
Integrity Level:
HIGH
Description:
NIC MAC Address Modification Tool
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3196.49351\hwid spoofer - charlootus' treats\spoofers\nicmacmodiftool.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\msimg32.dll
2780"C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.47281\HWID Spoofer - Charlootus' Treats\Spoofers\hwid.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.47281\HWID Spoofer - Charlootus' Treats\Spoofers\hwid.exe
WinRAR.exe
User:
admin
Integrity Level:
HIGH
Description:
HWID Changer
Exit code:
0
Version:
1.0.0.0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3196.47281\hwid spoofer - charlootus' treats\spoofers\hwid.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\mscoree.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\microsoft.net\framework\v4.0.30319\mscoreei.dll
2916"regedit.exe" "C:\Users\admin\AppData\Local\Temp\Rar$DIa3196.48345\HwProfileGuid_NotFoundFix.reg"C:\Windows\regedit.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Registry Editor
Exit code:
3221226540
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\regedit.exe
c:\systemroot\system32\ntdll.dll
3188C:\Windows\system32\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}C:\Windows\system32\DllHost.exe—svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
COM Surrogate
Exit code:
0
Version:
6.1.7600.16385 (win7_rtm.090713-1255)
Modules
Images
c:\windows\system32\dllhost.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\ole32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\user32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
3196"C:\Program Files\WinRAR\WinRAR.exe" "C:\Users\admin\AppData\Local\Temp\hwid-spoofer---charlootus-treats.rar"C:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Exit code:
0
Version:
5.60.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
3948"C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Spoofers\hardware.exe" C:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Spoofers\hardware.exe
WinRAR.exe
User:
admin
Company:
caspue
Integrity Level:
HIGH
Description:
caspue
Exit code:
0
Version:
1, 0, 0, 0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa3196.45949\hwid spoofer - charlootus' treats\spoofers\hardware.exe
c:\systemroot\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\lpk.dll
c:\windows\system32\usp10.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\comdlg32.dll
Total events
2 100
Read events
887
Write events
1 213
Delete events
0

Modification events

(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtBMP
Value:
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\Interface\Themes
Operation:writeName:ShellExtIcon
Value:
(PID) Process:(3196) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:LanguageList
Value:
en-US
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\AppData\Local\Temp\hwid-spoofer---charlootus-treats.rar
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(3196) WinRAR.exeKey:HKEY_CURRENT_USER\Software\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3196) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\System32\acppage.dll,-6002
Value:
Windows Batch File
(PID) Process:(3196) WinRAR.exeKey:HKEY_CLASSES_ROOT\Local Settings\MuiCache\12B\52C64B7E
Operation:writeName:@C:\Windows\regedit.exe,-309
Value:
Registration Entries
Executable files
45
Suspicious files
2
Text files
24
Unknown types
1

Dropped files

PID
Process
Filename
Type
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Cleaners\cleaner2.exeexecutable
MD5:4DD9BD80C1B4F2F510918A897882EBE1
SHA256:93F0E9E6D66F60AB58BF0F7B1DD1671CB4AD3C34A52358F30B7C282E22BB2E2F
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Intructions.txttext
MD5:3136A0637669287EA17FDAA203F8D19C
SHA256:FB0918D9E9AB7131A9E411C0D28B0F3B9059061FA07C917F63AE86455E2EBF48
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Cleaners\cleaner4.exeexecutable
MD5:3604C47A7DBD115027EDB98A2E763D1C
SHA256:F333A908A8F7A3AE7B8247EE9A91AAAFA6D48837BB275A9F459185E53952FF46
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Auto Clean.battext
MD5:F3A087B8B8E18F7A1E667B33E5770D07
SHA256:5EE84B3938CF686DB76870EFD479FFE3FBFF7D37B6178CD286D5F3539F88596F
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Auto Spoof.battext
MD5:3F2F4B82B19146D60E7A0C4ED7FF6CF0
SHA256:F8CD6BBD08B82B51920107FB29414181C1D6885F887A09FA8CF4EDA22B8B2FC6
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Cleaners\cleaner3.exeexecutable
MD5:BB36D4578CE201DC932AB6BBC079875C
SHA256:4C831252AA6F193C4474BA74F352BEE7D00099DFAF5AC6E98AB1253E21999B4A
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\EAC Switch\FortniteLauncher.exeexecutable
MD5:F25D5EDBA7076070D774A0E9D1443841
SHA256:8B043784AC5244E4F16F0B95F985BF1C7F893C5ED7061B95A7C51F9D34DC850A
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Credits.txttext
MD5:F5CA2B0B948657F30B0029A284921363
SHA256:CD7B3EFECEC3ECABFAE35C565605D5E67B3732C2EC89562C9A114F2E0FACF84E
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\Cleaners\deluxehwid.sysexecutable
MD5:96756DEAFF1B2667883D4A21E43F4F65
SHA256:1992C044963F5C77AA7B5462E2BB69A37C66BC0E13032524FB1663C0314FD420
3196WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa3196.45949\HWID Spoofer - Charlootus' Treats\EAC Switch\_initswapexecutable
MD5:161FD49A849C935B21924D00B3C90A57
SHA256:804CA28BDDBC7811482D0C0C32EC7858CAF12B0686186D7AD6EF8812C1D90A11
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
2
TCP/UDP connections
4
DNS requests
4
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
3948
hardware.exe
GET
200
137.59.148.97:80
http://www.virtualhardwares.com/English/hardware/hardware.html
IN
html
281 b
malicious
3948
hardware.exe
GET
200
104.18.20.226:80
http://ocsp.globalsign.com/rootr1/MEwwSjBIMEYwRDAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCCwQAAAAAAURO8EJH
US
der
1.49 Kb
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
3948
hardware.exe
137.59.148.97:80
www.virtualhardwares.com
PDR
IN
malicious
3948
hardware.exe
101.89.124.234:443
s22.cnzz.com
China Telecom (Group)
CN
unknown
3948
hardware.exe
104.18.20.226:80
ocsp.globalsign.com
Cloudflare Inc
US
shared

DNS requests

Domain
IP
Reputation
www.virtualhardwares.com
  • 137.59.148.97
unknown
s22.cnzz.com
  • 101.89.124.234
suspicious
ocsp.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted
ocsp2.globalsign.com
  • 104.18.20.226
  • 104.18.21.226
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2026 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
hwid-spoofer---charlootus-treats.rar