Analysis
-
max time kernel
148s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:38
Static task
static1
Behavioral task
behavioral1
Sample
Tweaks.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
Tweaks.exe
Resource
win10v2004-20241007-en
General
-
Target
Tweaks.exe
-
Size
1.4MB
-
MD5
e12573c2603b2e3d18faac68f42c36ec
-
SHA1
77e7dadde05bef60480866cf389a086141e2c22a
-
SHA256
40409fa2936a49876d650e74644bb18366cbbfb3d28a97aad6f833b02394ab2a
-
SHA512
9bbed974100cabf0b0dc497a98201dbcd5d41c03024356c28f28425408a3bf02bf97c71a74272ca4b40cc2dd5446906cb52d1899216ecdd7221f414754851039
-
SSDEEP
24576:qGxbVqOuF8HcZb6eKdQvpqyLsUoeHfL9Om5aIImgD9cQqQ2Yg86pJfySuN2L/FJD:9VqOQs86ldQvjsoFTMcjYg8kfyxN23hX
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
Processes:
Tweaks.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions Tweaks.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
Processes:
Tweaks.exedescription ioc process Key opened \REGISTRY\MACHINE\SOFTWARE\VMware, Inc.\VMware Tools Tweaks.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Tweaks.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Tweaks.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Tweaks.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
Tweaks.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Tweaks.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 Tweaks.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
Tweaks.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Tweaks.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Tweaks.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Tweaks.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
Tweaks.exepid process 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe 4740 Tweaks.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Tweaks.exedescription pid process Token: SeDebugPrivilege 4740 Tweaks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Tweaks.exe"C:\Users\Admin\AppData\Local\Temp\Tweaks.exe"1⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Maps connected drives based on registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4740