File name:

Monotone-HWID-Spoofer-0.0.1.zip

Full analysis: https://app.any.run/tasks/78270553-92e1-4a13-aeb6-aeda3b980cec
Verdict: Malicious activity
Analysis date: April 08, 2025, 11:32:26
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
arch-scr
arch-doc
Indicators:
MIME: application/zip
File info: Zip archive data, at least v1.0 to extract, compression method=store
MD5:

806CFDD8AEDC01685605268BB1778679

SHA1:

7F7818B723FCF707D2B7BB478243E2DD10D5BE56

SHA256:

DB4E12073C2200C86E5F1DDA3ADF7633357906E2BB97853DAC9876680CD44D6C

SSDEEP:

12288:sKSmTFPvU4UE33IqxmRjJiulBy0WO/UP0asQJ5kJOt5iK+0ECJAdKLpB4JtY:sbmpXU4rHIqxSiuW4Uq8+0tgPBCJ4Y79

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7084)

    • Executing a file with an untrusted certificate

      • Volumeid64.exe (PID: 3008)
      • Volumeid64.exe (PID: 1164)

    • Changes powershell execution policy (RemoteSigned)

      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 5360)

  • SUSPICIOUS

    • Drops a system driver (possible attempt to evade defenses)

      • WinRAR.exe (PID: 7084)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7084)
      • Block.exe (PID: 7036)

    • Executing commands from a ".bat" file

      • Monotone.exe (PID: 1764)
      • Block.exe (PID: 7036)
      • Monotone.exe (PID: 4068)
      • Block.exe (PID: 3156)

    • Starts CMD.EXE for commands execution

      • Monotone.exe (PID: 1764)
      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 4996)
      • Block.exe (PID: 7036)
      • Monotone.exe (PID: 4068)
      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 6940)
      • cmd.exe (PID: 2040)
      • cmd.exe (PID: 1600)
      • Block.exe (PID: 3156)

    • The executable file from the user directory is run by the CMD process

      • colorecho-vc10-x86_64.exe (PID: 4452)
      • batbox.exe (PID: 5800)
      • batbox.exe (PID: 812)
      • GetInput.exe (PID: 1056)
      • batbox.exe (PID: 2656)
      • batbox.exe (PID: 1020)
      • batbox.exe (PID: 6108)
      • batbox.exe (PID: 6540)
      • batbox.exe (PID: 5008)
      • GetInput.exe (PID: 6372)
      • Volumeid64.exe (PID: 3008)
      • Block.exe (PID: 7036)
      • batbox.exe (PID: 3180)
      • batbox.exe (PID: 4040)
      • batbox.exe (PID: 3008)
      • batbox.exe (PID: 5408)
      • batbox.exe (PID: 6872)
      • GetInput.exe (PID: 5800)

    • Get information on the list of running processes

      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 6436)
      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 684)

    • Uses REG/REGEDIT.EXE to modify registry

      • cmd.exe (PID: 5720)
      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 2564)
      • cmd.exe (PID: 2432)
      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 2656)

    • Application launched itself

      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 4996)
      • cmd.exe (PID: 7020)
      • cmd.exe (PID: 5756)
      • cmd.exe (PID: 5360)
      • cmd.exe (PID: 6940)
      • cmd.exe (PID: 2040)
      • cmd.exe (PID: 1600)

    • Uses WMIC.EXE to obtain physical disk drive information

      • cmd.exe (PID: 4488)
      • cmd.exe (PID: 6080)
      • cmd.exe (PID: 5124)
      • cmd.exe (PID: 6876)

    • The process executes Powershell scripts

      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 5360)

    • The process hides Powershell's copyright startup banner

      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 5360)

    • Starts POWERSHELL.EXE for commands execution

      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 5360)

    • Converts a string into array of characters (POWERSHELL)

      • powershell.exe (PID: 4244)
      • powershell.exe (PID: 5008)

    • Suspicious use of NETSH.EXE

      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 5360)

    • Reads the date of Windows installation

      • Block.exe (PID: 7036)
      • Block.exe (PID: 3156)

    • The process executes VB scripts

      • cmd.exe (PID: 5512)
      • cmd.exe (PID: 5360)

  • INFO

    • The sample compiled with english language support

      • WinRAR.exe (PID: 7084)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7084)

    • Checks supported languages

      • Monotone.exe (PID: 1764)
      • mode.com (PID: 4988)
      • colorecho-vc10-x86_64.exe (PID: 4452)
      • batbox.exe (PID: 5800)
      • batbox.exe (PID: 812)
      • mode.com (PID: 1348)
      • batbox.exe (PID: 6108)
      • batbox.exe (PID: 1020)
      • batbox.exe (PID: 2656)
      • batbox.exe (PID: 6540)
      • batbox.exe (PID: 5008)
      • Volumeid64.exe (PID: 3008)
      • Block.exe (PID: 7036)
      • mode.com (PID: 6512)
      • batbox.exe (PID: 3180)
      • batbox.exe (PID: 3008)
      • batbox.exe (PID: 6872)
      • batbox.exe (PID: 4040)
      • batbox.exe (PID: 5408)
      • Monotone.exe (PID: 4068)
      • mode.com (PID: 6512)
      • batbox.exe (PID: 6372)
      • batbox.exe (PID: 6668)
      • colorecho-vc10-x86_64.exe (PID: 6136)
      • mode.com (PID: 5164)
      • batbox.exe (PID: 300)
      • batbox.exe (PID: 2064)
      • batbox.exe (PID: 208)
      • batbox.exe (PID: 2152)
      • Volumeid64.exe (PID: 1164)
      • Block.exe (PID: 3156)
      • mode.com (PID: 5232)
      • batbox.exe (PID: 5576)
      • batbox.exe (PID: 4164)
      • batbox.exe (PID: 4424)
      • batbox.exe (PID: 6456)
      • batbox.exe (PID: 4996)

    • Create files in a temporary directory

      • Monotone.exe (PID: 1764)
      • Block.exe (PID: 7036)
      • Monotone.exe (PID: 4068)
      • Block.exe (PID: 3156)

    • Starts MODE.COM to configure console settings

      • mode.com (PID: 4988)
      • mode.com (PID: 1348)
      • mode.com (PID: 6512)
      • mode.com (PID: 6512)
      • mode.com (PID: 5164)
      • mode.com (PID: 5232)

    • Reads security settings of Internet Explorer

      • WMIC.exe (PID: 5332)
      • WMIC.exe (PID: 5360)
      • WMIC.exe (PID: 5156)
      • WMIC.exe (PID: 2984)

    • Reads Windows Product ID

      • reg.exe (PID: 2432)
      • reg.exe (PID: 3888)
      • reg.exe (PID: 5728)
      • reg.exe (PID: 2772)
      • reg.exe (PID: 1012)
      • reg.exe (PID: 7000)

    • Reads Environment values

      • Volumeid64.exe (PID: 3008)

    • Reads product name

      • Volumeid64.exe (PID: 3008)

    • Reads the computer name

      • Volumeid64.exe (PID: 3008)
      • Block.exe (PID: 7036)
      • Block.exe (PID: 3156)

    • Gets data length (POWERSHELL)

      • powershell.exe (PID: 4244)
      • powershell.exe (PID: 5008)

    • Disables trace logs

      • netsh.exe (PID: 5156)
      • netsh.exe (PID: 2420)
      • netsh.exe (PID: 2772)

    • Process checks computer location settings

      • Block.exe (PID: 7036)
      • Block.exe (PID: 3156)

    • Manual execution by a user

      • Monotone.exe (PID: 4068)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 10
ZipBitFlag: -
ZipCompression: None
ZipModifyDate: 2022:05:17 18:34:38
ZipCRC: 0x00000000
ZipCompressedSize: -
ZipUncompressedSize: -
ZipFileName: Monotone-HWID-Spoofer-0.0.1/
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
340
Monitored processes
212
Malicious processes
7
Suspicious processes
3

Behavior graph

Click at the process to see the details
start winrar.exe sppextcomobj.exe no specs slui.exe no specs monotone.exe no specs monotone.exe conhost.exe no specs cmd.exe no specs mode.com no specs ping.exe no specs colorecho-vc10-x86_64.exe no specs batbox.exe no specs batbox.exe no specs getinput.exe no specs tasklist.exe no specs find.exe no specs mode.com no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs getinput.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs volumeid64.exe no specs reg.exe no specs powershell.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs block.exe no specs cmd.exe no specs conhost.exe no specs wscript.exe no specs tasklist.exe no specs find.exe no specs ping.exe no specs mode.com no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs getinput.exe no specs tasklist.exe no specs find.exe no specs ping.exe no specs tasklist.exe no specs find.exe no specs rundll32.exe no specs monotone.exe conhost.exe no specs cmd.exe no specs mode.com no specs ping.exe no specs colorecho-vc10-x86_64.exe no specs batbox.exe no specs batbox.exe no specs getinput.exe no specs tasklist.exe no specs find.exe no specs mode.com no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs getinput.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs cmd.exe no specs cmd.exe no specs cmd.exe no specs find.exe no specs volumeid64.exe no specs reg.exe no specs powershell.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs netsh.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs reg.exe no specs block.exe no specs cmd.exe no specs wscript.exe no specs conhost.exe no specs tasklist.exe no specs find.exe no specs ping.exe no specs mode.com no specs cmd.exe no specs wmic.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs cmd.exe no specs reg.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs batbox.exe no specs getinput.exe no specs reg.exe no specs tasklist.exe no specs find.exe no specs ping.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
208batbox /c 0x0f /g 2 18 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /g 2 17 /a 32 /d " " /a 32 /g 2 16 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /c 0x07C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\batbox.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\monotone-hwid-spoofer-0.0.1\batbox.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
208REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v DigitalProductId /t REG_BINARY /d A4000000000003030312D3836382D303030303030372D383535353700AA0000005831352D3333000000000000000C3AABF26E3BA18B8878E89D26E3000000000000396CC459BD030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000057E26736 /fC:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
300batbox /c 0x0f /g 0 2 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /g 0 1 /a 32 /d " " /a 32 /g 0 0 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /a 32 /c 0x07C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\batbox.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\desktop\monotone-hwid-spoofer-0.0.1\batbox.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
684C:\WINDOWS\system32\cmd.exe /S /D /c" type "mac.txt""C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
684"C:\WINDOWS\system32\cmd.exe" /c "C:\Users\admin\AppData\Local\Temp\9140.tmp\9141.tmp\9142.bat C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\Block.exe"C:\Windows\System32\cmd.exe—Block.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
736C:\WINDOWS\system32\cmd.exe /c reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion" /v "ProductID"C:\Windows\System32\cmd.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Windows Command Processor
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\sechost.dll
812Batbox /g 23 16 /c 0xf0 /d " Enter " /c 0x07C:\Users\admin\AppData\Local\Temp\Rar$EXa7084.27065\Monotone-HWID-Spoofer-0.0.1\batbox.exe—cmd.exe
User:
admin
Integrity Level:
HIGH
Exit code:
0
Modules
Images
c:\users\admin\appdata\local\temp\rar$exa7084.27065\monotone-hwid-spoofer-0.0.1\batbox.exe
c:\windows\system32\ntdll.dll
c:\windows\syswow64\ntdll.dll
c:\windows\system32\wow64.dll
c:\windows\system32\wow64win.dll
c:\windows\system32\wow64cpu.dll
c:\windows\syswow64\kernel32.dll
c:\windows\syswow64\kernelbase.dll
c:\windows\syswow64\apphelp.dll
c:\windows\syswow64\msvcrt.dll
812reg.exe query "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkCards\3" /v "ServiceName"C:\Windows\System32\reg.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Registry Console Tool
Exit code:
1
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\reg.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
856tasklist /NH /FI "imagename eq Monotone.exe" C:\Windows\System32\tasklist.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Lists the current running tasks
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\tasklist.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
856\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
HIGH
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
Total events
20 136
Read events
20 077
Write events
57
Delete events
2

Modification events

(PID) Process:(7084) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7084) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7084) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7084) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\Monotone-HWID-Spoofer-0.0.1.zip
(PID) Process:(7084) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7084) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7084) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7084) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(3008) Volumeid64.exeKey:HKEY_CURRENT_USER\SOFTWARE\Sysinternals\VolumeID
Operation:writeName:EulaAccepted
Value:
1
(PID) Process:(4452) reg.exeKey:HKEY_CURRENT_USER\Monetone
Operation:writeName:VolumeID
Value:
AF90-9435
Executable files
20
Suspicious files
1
Text files
28
Unknown types
0

Dropped files

PID
Process
Filename
Type
7084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7084.27065\Monotone-HWID-Spoofer-0.0.1\Button.battext
MD5:96FEFE69F2FACF74197A8AF3004A6167
SHA256:38AA0C1AD69D96732C776CBD73275F5CCB881D42158158B32815DAD869EF9876
7084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7084.27065\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\Adapters2.exeexecutable
MD5:BB36D4578CE201DC932AB6BBC079875C
SHA256:4C831252AA6F193C4474BA74F352BEE7D00099DFAF5AC6E98AB1253E21999B4A
3008Volumeid64.exe\Device\HarddiskVolume2 —
MD5:—
SHA256:—
7084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7084.27065\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\Adapters.exeexecutable
MD5:934BBC5411C532964F3BBE42CB1C1785
SHA256:B3DE6D10D9F94037B88F736609E50A8A4C4D516CA50107DEDD575797A654C28E
7084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7084.27065\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\AlternateStreamView.cfgtext
MD5:D298348206017D0CB04217887A677334
SHA256:2E44DAD813EFA86DDBD849A53962C5BDCACC9BCC2039DC09BCB2C25C770F3D8B
7084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7084.27065\Monotone-HWID-Spoofer-0.0.1\Commands\Hidden\AlternateStreamView.exeexecutable
MD5:CAEDE4F12AC17F3E0AD8E3C923FD510A
SHA256:669CE40107A2E05FC93DD37DF55C77EB155705B449B2E236423E8BB96B9985F0
7084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7084.27065\Monotone-HWID-Spoofer-0.0.1\README.mdtext
MD5:699D03E1E8ED798AEB721E8FD561682B
SHA256:4ABFD24B7422EE66D5849FDA386DFD1318DB4615F9126899A27FDB5A4FFA3D0D
7084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7084.27065\Monotone-HWID-Spoofer-0.0.1\colorecho-vc10-x86_64.exeexecutable
MD5:E2F377052409BEEEBF852803734E007A
SHA256:76FE5F9CEF2C3A5C4F765D4C45167F4CF26CC6D469031F0D195D96724E9D82A8
7084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7084.27065\Monotone-HWID-Spoofer-0.0.1\hwid.ps1text
MD5:05673D49CC5F31E3D4812B7CB7419641
SHA256:C7C54526B07F457E58D423AB22D61A0EFD78AD112BE2EF0A1EFE6C25013DF185
7084WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$EXa7084.27065\Monotone-HWID-Spoofer-0.0.1\batbox.exeexecutable
MD5:CB4A44BAA20AD26BF74615A7FC515A84
SHA256:9553BC17FA0FD08E026C1865812B3388E3D5495A5394BBF671E5A8F21C79989A
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
4
TCP/UDP connections
17
DNS requests
12
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
5496
MoUsoCoreWorker.exe
GET
200
23.216.77.36:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
6544
svchost.exe
GET
200
2.17.190.73:80
http://ocsp.digicert.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSAUQYBMq2awn1Rh6Doh%2FsBYgFV7gQUA95QNVbRTLtm8KPiGxvDl7I90VUCEAJ0LqoXyo4hxxe7H%2Fz9DKA%3D
unknown
—
—
whitelisted
5392
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Secure%20Server%20CA%202.1.crl
unknown
—
—
whitelisted
5392
SIHClient.exe
GET
200
184.30.21.171:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
4
System
192.168.100.255:137
—
—
—
whitelisted
—
—
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5496
MoUsoCoreWorker.exe
23.216.77.36:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.250:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
6544
svchost.exe
20.190.160.20:443
login.live.com
MICROSOFT-CORP-MSN-AS-BLOCK
NL
whitelisted
6544
svchost.exe
2.17.190.73:80
ocsp.digicert.com
AKAMAI-AS
DE
whitelisted
2104
svchost.exe
40.127.240.158:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
5392
SIHClient.exe
4.175.87.197:443
slscr.update.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
US
whitelisted
5392
SIHClient.exe
184.30.21.171:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 40.127.240.158
whitelisted
google.com
  • 142.250.186.78
whitelisted
crl.microsoft.com
  • 23.216.77.36
  • 23.216.77.42
  • 23.216.77.6
whitelisted
client.wns.windows.com
  • 172.211.123.250
whitelisted
login.live.com
  • 20.190.160.20
  • 20.190.160.66
  • 40.126.32.76
  • 40.126.32.140
  • 40.126.32.68
  • 20.190.160.131
  • 20.190.160.5
  • 40.126.32.133
whitelisted
ocsp.digicert.com
  • 2.17.190.73
whitelisted
slscr.update.microsoft.com
  • 4.175.87.197
whitelisted
www.microsoft.com
  • 184.30.21.171
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN LLC. ALL RIGHTS RESERVED
ANY.RUN
Reports
Monotone-HWID-Spoofer-0.0.1.zip