Overview
overview
10Static
static
10Ultimate Tweaks.exe
windows7-x64
7Ultimate Tweaks.exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDI...ll.dll
windows7-x64
3$PLUGINSDI...ll.dll
windows10-2004-x64
3$PLUGINSDIR/app-64.7z
windows7-x64
3$PLUGINSDIR/app-64.7z
windows10-2004-x64
3LICENSE.electron.txt
windows7-x64
1LICENSE.electron.txt
windows10-2004-x64
1LICENSES.c...m.html
windows7-x64
3LICENSES.c...m.html
windows10-2004-x64
3Ultimate Tweaks.exe
windows7-x64
1Ultimate Tweaks.exe
windows10-2004-x64
7chrome_100...nt.pak
windows7-x64
3chrome_100...nt.pak
windows10-2004-x64
3chrome_200...nt.pak
windows7-x64
3chrome_200...nt.pak
windows10-2004-x64
3d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1resources/elevate.exe
windows7-x64
3resources/elevate.exe
windows10-2004-x64
3snapshot_blob.bin
windows7-x64
3Analysis
-
max time kernel
147s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09-08-2024 12:03
Behavioral task
behavioral1
Sample
Ultimate Tweaks.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Ultimate Tweaks.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240729-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/WinShell.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/WinShell.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/app-64.7z
Resource
win7-20240705-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/app-64.7z
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
LICENSE.electron.txt
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
LICENSE.electron.txt
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
LICENSES.chromium.html
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
LICENSES.chromium.html
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
Ultimate Tweaks.exe
Resource
win7-20240705-en
Behavioral task
behavioral18
Sample
Ultimate Tweaks.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
chrome_100_percent.pak
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
chrome_100_percent.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
chrome_200_percent.pak
Resource
win7-20240729-en
Behavioral task
behavioral22
Sample
chrome_200_percent.pak
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
d3dcompiler_47.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral24
Sample
ffmpeg.dll
Resource
win7-20240704-en
Behavioral task
behavioral25
Sample
ffmpeg.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral26
Sample
libEGL.dll
Resource
win7-20240708-en
Behavioral task
behavioral27
Sample
libEGL.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral28
Sample
libGLESv2.dll
Resource
win7-20240704-en
Behavioral task
behavioral29
Sample
libGLESv2.dll
Resource
win10v2004-20240802-en
Behavioral task
behavioral30
Sample
resources/elevate.exe
Resource
win7-20240705-en
Behavioral task
behavioral31
Sample
resources/elevate.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral32
Sample
snapshot_blob.bin
Resource
win7-20240708-en
General
-
Target
ffmpeg.dll
-
Size
2.7MB
-
MD5
bf09deeeb497aeddaf6194e695776b8b
-
SHA1
e7d8719d6d0664b8746581b88eb03a486f588844
-
SHA256
450d5e6a11dc31dc6e1a7af472cd08b7e7a78976b1f0aa1c62055a0a720f5080
-
SHA512
38d3cac922634df85ddfd8d070b38cf4973bba8f37d3246453377f30165cc4377b4e67c4e0bca0ffe3c3fa0e024b23a31ec009e16d0ab3042593b5a6e164669f
-
SSDEEP
49152:2gUBJTIe17EwJvr3OXtgTyFBcCen6yfUvUUP/bkLmV:ZY1vreXOuFePUP/bay
Malware Config
Signatures
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\ffmpeg.dll,#11⤵PID:4036
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3276
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
379KB
MD5e82a04e0fb81f191657344f699ba1c82
SHA1c1ad7de3a147196f2da49f6d9b0b6afe723ed4bb
SHA256ea22ca3b9b88286977a2a6545feb804b94427f1b62a0a5a1b7c06595ff3ade72
SHA512f2dcfd64b6c5a217212bb64d2968a8162f9153c8178e2660e4d52cee82ea7b08a99f8efab8b0b25b6b3fed905f66f43cd8bf17e0b2d3ccc4ec75c58f0aa96f19
-
Filesize
85KB
MD571a1818f177d2c254918ccb6f302bdb4
SHA102eea6e8ad7c8bfa387b3a5846ee6e45448d3c1e
SHA2567dacff8c8942e412292dbe72d47c1c68807c9864111c07b46c20251d66d8dcb4
SHA512fbdc63fd13d08ab24e216b8ef0386bbd49b5fc51f8e4557a0a5da9721c002b028ac8a4f532cf2407a73c3071be83906fa9818f4767f898a4d7bf8b4340c8c42e
-
Filesize
396KB
MD574d439662f1baa3cd2a9a2cb51d214a8
SHA1f18d2e85801f8d099a7af89913811248001e3781
SHA256b356e16e95f35f59d53e7ac2e7d49b6eebfdf7086d0a9de30b33316b922169a3
SHA512605a9c8fd032d70b4ca87c11a7655c563afe50e2b398bf0532bf13efed2bc9305a1358ec5da2c3d6dc14043bee8502af6e317eb60efd200411956272851181c1
-
Filesize
81KB
MD50201196d5834d6c89431d2c8f0434a61
SHA1dfb65bf430ad3494515047e5ea64b5635434633b
SHA256ad7313359bb2f92e3210b2095ade8b469a59d0ed0b09a4640b33cb7ff807eb43
SHA512f3a339002f15f0245c1a2ffc0ad9801b2fa235c6d3fd5fb1f43036e7f07dd447e53baebd13c3a813bd90a0eecc64dccdb402ec7cfcf5cf48415d60c7d37802a6
-
Filesize
168KB
MD59309266949345de937670193ce61b239
SHA168452ec48111c0028da49e5668a2b00ed064acae
SHA256e5c03a3d1d3f6e397bb7bbc136bd598983b7e66d405b571393bdbd63fcc11094
SHA51261f023505dc320349e091b36632e2f7bd965c18a679280b0d98d82d5fba0f66924b32085d7c491884ba8b86a154e02eedbfa13ccea43240af938553c16e9935e
-
Filesize
195KB
MD54b14ae7158933b55485e18920d3820f1
SHA1fd4b62ffa97f84deaea38193ce244ee55837113b
SHA256882be998ca836522a2dad2c163bb0afc98cfe396f06811d17e7d0dc95f294b19
SHA5129180e5408af15fb252f0838e410ffd1a39d29af99d49541b652cface30eb49d55d37257a3cd1fc6b7ded37e6641093f142a1bb12afa5bf639fa55259bd6556c5
-
Filesize
171KB
MD54c87cf4f31abcdf2be38858cf94565d7
SHA1a83358abe9dedb1269d457f064e4c8cb4e145f0d
SHA256d632af47dc9919ef8d0859d9f0e926ca30d1959ebf52c2f3313852b3d55bc25f
SHA512cfa33531035384ce6efb9d710aae62f95ec31daabd6077548a8c13f3d0131561396c423d64443860d05c01965d76d0b992190ff0c7d64b6fb1ea86497cdcfe99
-
Filesize
208KB
MD5283cfe4c3d8c6b44735ec08094e70e17
SHA1a7bb306a4dce52d159f729d26a971d5666f3bd35
SHA256baf8931e4e99ea4710853bf9056f047bdbc8d2bbf36633c2bdc624369a0dca9f
SHA512946fdb1fb08df2388a0aef34682cec3115bb3527a7f3549d478c4f90248e2ed6b4f41662f948211bdb6c2cb3630178c5d85ef724262e4366eda287a9465ff9bc
-
Filesize
170KB
MD5f620712021ab95aa12b3992193bba339
SHA13b39fc0c437a9ace37feca332e4f38dc470b40c2
SHA256a1954fb13c3c33f78f4e24abd1d7c808d3b554a6b045c39a87a77b2456eac035
SHA5126d0361fea75cfd19e32804c66c9cce24c946620b8205ec34cd5e5e618d3e9f002f04aae3fc94129c86e62fc5639acea21245a63fb4eb90d03f180b7ae48daacd
-
Filesize
191KB
MD5c73ace71a48d3fdf63fbeab5aa924992
SHA1f16ccf4f2f96e8ae77d235b219421efc43d53399
SHA256d2d75126b4eca48a20f324f89bdd072f2d57501a3a01fef9096c9099aaa93e3d
SHA5125c52d72b3c0e4d3573747cae120929b858a97055425dce6a88ba06d8c6c5836acd6d9c5ac35d591d95386678fa00e8d9a11739ce9c2c5e82534a1b0a1fba6073
-
Filesize
170KB
MD595a930466e96f84b26b4f1a659811765
SHA1da159980b006c7c56eae8291f2f6d4db11a763e8
SHA25617a36ee54e7cc5829b4b4a9b0cdf389ede32ade1ac7e7655ae47e5a6c73cadbc
SHA5121d1bc1af23ccdb9f31b42404ed26e1189d8d6622fd49b98f8bd76ebb88530f37a9d547e6f2dda03eb14aed98e0392de05772b045a595e81761e5811465ed70d3
-
Filesize
198KB
MD5111353e7a16ed7ccf4dc2505d56c6e89
SHA190443390193e9df0a16385d2d443610994014dc1
SHA256b7277aff679663eb4287bbfcc4c04154aaf0363654130a3511aeb8367a4c2ba4
SHA512d26e398e9794093240d72a67812b3dfbfaa85a0ecf7d0c3d2f7f5f5fa376cd9cbe35f0c934d2cbbf152d2a624f8570925cbf66f3da8f5a51752d9ca61c7ab7d1
-
Filesize
123KB
MD552ce577176374fcf11b11cb78a54b7bd
SHA1d719809abd329ba0c4b92aa828ed26512b53555b
SHA2560e7065d103181464e7f9de1ae14e3daf985a4b3696fb678045675d8706c91556
SHA51230384e49d3d4fe2e6d166b5450e5c1920ff2b29c4cc8ce8c8ad7384a757d82ad09e9b8b0052d1f52062224746d6145a7f9168c2552b19ef5b5c2178079d025a1
-
Filesize
129KB
MD586da56adb4713bf9ce6306018dbf2b94
SHA17ad9430fdb1be208917b3a1b81ab5efe1bf17566
SHA2563ae35027814f61d6d9b99952d08078f5b492985a201eb347a08f2fd943824eb0
SHA51281bc9f8a89ada920fc94ba15b8526495d2c81c238dcbb14bc2ec8c22763aecd8f1f766822121577511877e90ae25b043f589376bc6028e889f3e09d0b8f1f14f
-
Filesize
123KB
MD5b934f6d7498069148d536c4f2fd53311
SHA1f9d6a69b63d460e13eb988634c2d70f61e319276
SHA256e8ab070852f12f61cd709c28e383064e77d2a2d3a0e4324274192df591c2ff9d
SHA512f9414835acf30851e0e317f43c6b2db9ad85ecc52285289aba8a1e938f8a670c63e5c187e9ced2ba72a14960d1d164e106f2a0517cc9e90c58805dce73238902
-
Filesize
135KB
MD5114f9b3aa7984c48df488233aafaac71
SHA1587dc6d952a75698fd4b42438ff1eed7c0ccbe5d
SHA256cc68a580d7f25db15ae241621c5b926c8f19022f1e408a9fe84ba4065dd67163
SHA51257013955f8fc3a5a1f20711fe593f98d72e84957721c0532182683cec5769569dff524aa1c8db62dcc888f25d03d8746c1b486ddbbb6a3ec7550dae9f5032edd