Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22-08-2024 08:18
Behavioral task
behavioral1
Sample
Tweaks.exe
Resource
win7-20240708-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Tweaks.exe
Resource
win10v2004-20240802-en
skuldcredential_accessdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationspywarestealer
windows10-2004-x64
23 signatures
150 seconds
General
-
Target
Tweaks.exe
-
Size
9.5MB
-
MD5
4fbe55e3f7e5ff9681998687690a72f2
-
SHA1
2ba2e3d31379e85f3fccc24e217df465d0093596
-
SHA256
f59a429ac78e9623a311a3395fbc8c60cf4280284885fbf36e78aa0ba0ac3449
-
SHA512
10f3789c9a37dc307ce987975f349a1d3fa885ffd49b3df23b525d637041de4290a7dc73b5d61089c5329c0630f727e1642944b3ca450d1a4ba690395235dc27
-
SSDEEP
98304:PPlSsz0vq91ncrORvs0SSK2g8RwTEplESF8S2jC:4e0vqvKes0SSvgeplv2jC
Score
1/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2388 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2388 taskmgr.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe -
Suspicious use of SendNotifyMessage 34 IoCs
pid Process 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe 2388 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tweaks.exe"C:\Users\Admin\AppData\Local\Temp\Tweaks.exe"1⤵PID:2412
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2388