Overview
overview
7Static
static
1!!BEST TWE...he.exe
windows7-x64
1!!BEST TWE...he.exe
windows10-2004-x64
1!!BEST TWE...ng.bat
windows7-x64
1!!BEST TWE...ng.bat
windows10-2004-x64
1!!BEST TWE...SE.bat
windows7-x64
1!!BEST TWE...SE.bat
windows10-2004-x64
1!!BEST TWE...me.lnk
windows7-x64
3!!BEST TWE...me.lnk
windows10-2004-x64
7!!BEST TWE...rs.url
windows7-x64
1!!BEST TWE...rs.url
windows10-2004-x64
1!!BEST TWE...rs.url
windows7-x64
1!!BEST TWE...rs.url
windows10-2004-x64
1!!BEST TWE...rs.url
windows7-x64
1!!BEST TWE...rs.url
windows10-2004-x64
1!!BEST TWE...Us.cmd
windows7-x64
1!!BEST TWE...Us.cmd
windows10-2004-x64
4!!BEST TWE...ll.lnk
windows7-x64
3!!BEST TWE...ll.lnk
windows10-2004-x64
7!!BEST TWE...ps.lnk
windows7-x64
3!!BEST TWE...ps.lnk
windows10-2004-x64
3!!BEST TWE...er.ps1
windows7-x64
3!!BEST TWE...er.ps1
windows10-2004-x64
3!!BEST TWE...er.ps1
windows7-x64
3!!BEST TWE...er.ps1
windows10-2004-x64
3!!BEST TWE...ck.ps1
windows7-x64
3!!BEST TWE...ck.ps1
windows10-2004-x64
3!!BEST TWE...ts.ps1
windows7-x64
3!!BEST TWE...ts.ps1
windows10-2004-x64
3!!BEST TWE...or.ps1
windows7-x64
3!!BEST TWE...or.ps1
windows10-2004-x64
3!!BEST TWE...il.ps1
windows7-x64
3!!BEST TWE...il.ps1
windows10-2004-x64
3Analysis
-
max time kernel
133s -
max time network
109s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
01-07-2024 01:29
Static task
static1
Behavioral task
behavioral1
Sample
!!BEST TWEAKS/PC Cleanup/Clear Memory Cache.exe
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral2
Sample
!!BEST TWEAKS/PC Cleanup/Clear Memory Cache.exe
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
!!BEST TWEAKS/Registry _ Batch/Disable USB Powersaving.bat
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral4
Sample
!!BEST TWEAKS/Registry _ Batch/Disable USB Powersaving.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
!!BEST TWEAKS/Registry _ Batch/EnableFSE.bat
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral6
Sample
!!BEST TWEAKS/Registry _ Batch/EnableFSE.bat
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/# Get Network Drivers/# Get Network Adapter Name.lnk
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral8
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/# Get Network Drivers/# Get Network Adapter Name.lnk
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/# Get Network Drivers/Intel Ethernet Drivers.url
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral10
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/# Get Network Drivers/Intel Ethernet Drivers.url
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/# Get Network Drivers/Intel Wifi Drivers.url
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral12
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/# Get Network Drivers/Intel Wifi Drivers.url
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/# Get Network Drivers/Realtek Ethernet Drivers.url
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral14
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/# Get Network Drivers/Realtek Ethernet Drivers.url
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/1 Disable WUs/2 Disable WUs.cmd
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral16
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/1 Disable WUs/2 Disable WUs.cmd
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/# Revert/PowerShell.lnk
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/# Revert/PowerShell.lnk
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/# Uninstall Apps.lnk
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral20
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/# Uninstall Apps.lnk
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall 3D Builder.ps1
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral22
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall 3D Builder.ps1
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall 3D Viewer - Mixed Reality Viewer.ps1
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral24
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall 3D Viewer - Mixed Reality Viewer.ps1
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall Alarms and Clock.ps1
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral26
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall Alarms and Clock.ps1
Resource
win10v2004-20240611-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall Bing Sports.ps1
Resource
win7-20240508-en
windows7-x64
Behavioral task
behavioral28
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall Bing Sports.ps1
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall Calculator.ps1
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall Calculator.ps1
Resource
win10v2004-20240508-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall Calendar and Mail.ps1
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral32
Sample
!!BEST TWEAKS/Windows Post-Installation Pack/2 Debloat Windows/Safe Method/Uninstall Calendar and Mail.ps1
Resource
win10v2004-20240611-en
windows10-2004-x64
General
-
Target
!!BEST TWEAKS/Windows Post-Installation Pack/# Get Network Drivers/# Get Network Adapter Name.lnk
-
Size
955B
-
MD5
aa5867f911fb896987b51e49d8d5ef3e
-
SHA1
b9ecc79da1f3a173c902365dc2241dfa4562c3c7
-
SHA256
1fdbccc0e6bac7303f23427650c180384e25d633fd8fdfade1443bb476765f09
-
SHA512
f538c36075f43c2da3fb0d0d260dd349bf942f14b826dfa0c5872363d225856a2d69bd10fa951c9aa0223fb5eef9de47b084d7ebcbc8eef5db8e9bf1bb9b620e
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000\Control Panel\International\Geo\Nation cmd.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\devmgmt.msc mmc.exe -
Drops file in Windows directory 57 IoCs
description ioc Process File created C:\Windows\INF\c_fssystemrecovery.PNF mmc.exe File created C:\Windows\INF\c_fsencryption.PNF mmc.exe File created C:\Windows\INF\c_fscfsmetadataserver.PNF mmc.exe File created C:\Windows\INF\c_monitor.PNF mmc.exe File created C:\Windows\INF\miradisp.PNF mmc.exe File created C:\Windows\INF\c_sslaccel.PNF mmc.exe File created C:\Windows\INF\c_diskdrive.PNF mmc.exe File created C:\Windows\INF\c_volume.PNF mmc.exe File created C:\Windows\INF\c_fscontinuousbackup.PNF mmc.exe File created C:\Windows\INF\c_fscopyprotection.PNF mmc.exe File created C:\Windows\INF\c_fsundelete.PNF mmc.exe File created C:\Windows\INF\c_netdriver.PNF mmc.exe File created C:\Windows\INF\c_camera.PNF mmc.exe File created C:\Windows\INF\c_fshsm.PNF mmc.exe File created C:\Windows\INF\wsdprint.PNF mmc.exe File created C:\Windows\INF\c_extension.PNF mmc.exe File created C:\Windows\INF\c_linedisplay.PNF mmc.exe File created C:\Windows\INF\c_proximity.PNF mmc.exe File created C:\Windows\INF\c_computeaccelerator.PNF mmc.exe File created C:\Windows\INF\remoteposdrv.PNF mmc.exe File created C:\Windows\INF\digitalmediadevice.PNF mmc.exe File created C:\Windows\INF\c_scmvolume.PNF mmc.exe File created C:\Windows\INF\c_holographic.PNF mmc.exe File created C:\Windows\INF\c_fsvirtualization.PNF mmc.exe File created C:\Windows\INF\c_magneticstripereader.PNF mmc.exe File created C:\Windows\INF\c_display.PNF mmc.exe File created C:\Windows\INF\c_swcomponent.PNF mmc.exe File created C:\Windows\INF\c_fsphysicalquotamgmt.PNF mmc.exe File created C:\Windows\INF\c_fsquotamgmt.PNF mmc.exe File created C:\Windows\INF\ts_generic.PNF mmc.exe File created C:\Windows\INF\dc1-controller.PNF mmc.exe File created C:\Windows\INF\c_scmdisk.PNF mmc.exe File created C:\Windows\INF\c_apo.PNF mmc.exe File created C:\Windows\INF\rawsilo.PNF mmc.exe File created C:\Windows\INF\c_fsreplication.PNF mmc.exe File created C:\Windows\INF\c_media.PNF mmc.exe File created C:\Windows\INF\c_cashdrawer.PNF mmc.exe File created C:\Windows\INF\PerceptionSimulationSixDof.PNF mmc.exe File created C:\Windows\INF\c_fsopenfilebackup.PNF mmc.exe File created C:\Windows\INF\c_smrvolume.PNF mmc.exe File created C:\Windows\INF\oposdrv.PNF mmc.exe File created C:\Windows\INF\c_barcodescanner.PNF mmc.exe File created C:\Windows\INF\c_fsinfrastructure.PNF mmc.exe File created C:\Windows\INF\c_fscompression.PNF mmc.exe File created C:\Windows\INF\c_fssystem.PNF mmc.exe File created C:\Windows\INF\c_fsantivirus.PNF mmc.exe File created C:\Windows\INF\c_fsactivitymonitor.PNF mmc.exe File created C:\Windows\INF\c_fssecurityenhancer.PNF mmc.exe File created C:\Windows\INF\c_fscontentscreener.PNF mmc.exe File created C:\Windows\INF\c_smrdisk.PNF mmc.exe File created C:\Windows\INF\c_receiptprinter.PNF mmc.exe File created C:\Windows\INF\c_mcx.PNF mmc.exe File created C:\Windows\INF\xusb22.PNF mmc.exe File created C:\Windows\INF\c_processor.PNF mmc.exe File created C:\Windows\INF\rdcameradriver.PNF mmc.exe File created C:\Windows\INF\c_ucm.PNF mmc.exe File created C:\Windows\INF\c_firmware.PNF mmc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 20 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Phantom mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Phantom mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001 mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 mmc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags mmc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A mmc.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4204450073-1267028356-951339405-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2136 mmc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2136 mmc.exe Token: SeIncBasePriorityPrivilege 2136 mmc.exe Token: 33 2136 mmc.exe Token: SeIncBasePriorityPrivilege 2136 mmc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2136 mmc.exe 2136 mmc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 3632 wrote to memory of 2136 3632 cmd.exe 85 PID 3632 wrote to memory of 2136 3632 cmd.exe 85
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\!!BEST TWEAKS\Windows Post-Installation Pack\# Get Network Drivers\# Get Network Adapter Name.lnk"1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\System32\devmgmt.msc"2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2136
-