Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
25-11-2023 23:47
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Ultimate Windows Tweaker 4.8.exe
Resource
win7-20231020-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
Ultimate Windows Tweaker 4.8.exe
Resource
win10v2004-20231023-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
Ultimate Windows Tweaker 4.8.exe
-
Size
660KB
-
MD5
dfd18eabcfa63ce63fdbebe4673e99c8
-
SHA1
e325611de3de808046018993338eca3c2ff09f0a
-
SHA256
b25b8e40616136045f021a9ac1e2143b3460caed08c01606820ca4fa4107e5f2
-
SHA512
0b67457095f0d7821e0c21f358c940af1ac6db2bdf7051b6c859a52423ff4c6f642cc614b7ef580894fa480d616bf173e3870907040180cf2a627d6875c80a83
-
SSDEEP
12288:3XlA18pVM/xw4alNt5ndTJWu4ugmp4AdcK99Pw:3XlAKz9vndTWAKI4
Score
1/10
Malware Config
Signatures
-
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DesktopBackground\Shell\UWTSettings Ultimate Windows Tweaker 4.8.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\DesktopBackground\Shell\UWTSettings\Shell Ultimate Windows Tweaker 4.8.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2516 Ultimate Windows Tweaker 4.8.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2644 2516 Ultimate Windows Tweaker 4.8.exe 28 PID 2516 wrote to memory of 2644 2516 Ultimate Windows Tweaker 4.8.exe 28 PID 2516 wrote to memory of 2644 2516 Ultimate Windows Tweaker 4.8.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ultimate Windows Tweaker 4.8.exe"C:\Users\Admin\AppData\Local\Temp\Ultimate Windows Tweaker 4.8.exe"1⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2516 -s 8402⤵PID:2644
-