Overview
overview
7Static
static
7腾龙工�...om.url
windows10-2004-x64
1腾龙工�...om.url
windows11-21h2-x64
1App/ImageT...er.chm
windows10-2004-x64
1App/ImageT...er.chm
windows11-21h2-x64
1App/ImageT...er.exe
windows10-2004-x64
4App/ImageT...er.exe
windows11-21h2-x64
3App/ImageT...32.dll
windows10-2004-x64
3App/ImageT...32.dll
windows11-21h2-x64
3App/ImageT...pr.dll
windows10-2004-x64
3App/ImageT...pr.dll
windows11-21h2-x64
3App/ImageT...er.chm
windows10-2004-x64
1App/ImageT...er.chm
windows11-21h2-x64
1App/ImageT...er.exe
windows10-2004-x64
3App/ImageT...er.exe
windows11-21h2-x64
3App/ImageT...lc.exe
windows10-2004-x64
3App/ImageT...lc.exe
windows11-21h2-x64
3App/ImageT...64.dll
windows10-2004-x64
1App/ImageT...64.dll
windows11-21h2-x64
1App/ImageT...pr.dll
windows10-2004-x64
3App/ImageT...pr.dll
windows11-21h2-x64
3ImageTuner...le.exe
windows10-2004-x64
7ImageTuner...le.exe
windows11-21h2-x64
7$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-21h2-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-21h2-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows11-21h2-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows11-21h2-x64
3$PLUGINSDI...sh.dll
windows10-2004-x64
3$PLUGINSDI...sh.dll
windows11-21h2-x64
3Analysis
- max time kernel
149s - max time network
94s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows - submitted
18/04/2026, 00:57
Behavioral task
behavioral1
Sample
腾龙工作室 - TenlonStudio.Com.url
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
腾龙工作室 - TenlonStudio.Com.url
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral3
Sample
App/ImageTuner32/ImageTuner.chm
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
App/ImageTuner32/ImageTuner.chm
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral5
Sample
App/ImageTuner32/ImageTuner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
App/ImageTuner32/ImageTuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral7
Sample
App/ImageTuner32/ielib32.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
App/ImageTuner32/ielib32.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral9
Sample
App/ImageTuner32/itpr.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
App/ImageTuner32/itpr.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral11
Sample
App/ImageTuner64/ImageTuner.chm
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
App/ImageTuner64/ImageTuner.chm
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral13
Sample
App/ImageTuner64/ImageTuner.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
App/ImageTuner64/ImageTuner.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral15
Sample
App/ImageTuner64/balc.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
App/ImageTuner64/balc.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral17
Sample
App/ImageTuner64/ielib64.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
App/ImageTuner64/ielib64.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral19
Sample
App/ImageTuner64/itpr.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
App/ImageTuner64/itpr.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral21
Sample
ImageTunerPortable.exe
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
ImageTunerPortable.exe
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/MoreInfo.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/System.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral27
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
$PLUGINSDIR/UAC.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/execDos.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/execDos.dll
Resource
win11-20260130-en
windows11-21h2-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win10v2004-20260130-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/newadvsplash.dll
Resource
win11-20260130-en
windows11-21h2-x64
General
- Target App/ImageTuner32/ImageTuner.exe
- Size 7.5MB
- Sample260418-baxagset3s
- SHA256 4cd0283d69649e660f3eb6b0cff1c487357020f1143a1d087f00309458ef6050
- MD5 9383ae2bc8bb3bc3f6154530ed026181
- SHA1 2287747b4f9afb452cbd83260d2369f8e0c8e146
- SHA512 abd5d77243a3853ac969e176377bd36690eafab8dbad616f853c02d1ad52f99eacfc0673317b5158bc8afdf7191e30ffb684b2d21fd2f830d8979fae248cd127
- SSDEEP 196608:d47Rvw8sRDMLmcFwWhKUzJvDqWMcLkwj52:d4Fvw8sRDMLNwWhKUzJveWMYB5
- TLSH T164869E13B249607FC0AB1B358C3BDB98593BBB216B268D6757B41C4C4F356807A2BB47
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ImageTuner.exe - Modifies registry class 36 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\FLAGS\ = "0" ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\VersionIndependentProgID\ ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\InprocServer32 ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\ProgID\ = "MSVidCtl.MSVidAudioRendererDevices.1" ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C} ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\0\win32 ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\0\win64\ = "C:\\Windows\\SysWow64\\MsraLegacy.tlb" ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\ = "Miwiro Igaxek Omogolo object" ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\Programmable ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\ ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\0 ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\0\ ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\FLAGS ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\TypeLib ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038} ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\0\win64\ ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\Version\ ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\Version\ = "1.0" ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\VersionIndependentProgID\ = "MSVidCtl.MSVidAudioRendererDevices" ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\ProgID\ ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\ ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\VersionIndependentProgID ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\Implemented Categories ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\InprocServer32\ = "C:\\Windows\\SysWOW64\\msvidctl.dll" ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\Programmable\ ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\0\win64 ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\TypeLib\ = "{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}" ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\Implemented Categories\ ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\ProgID ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0 ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\0\win32\ ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\TypeLib\ ImageTuner.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\Version ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF3AF86A-8CFE-491D-569B-11C4F0954038}\InprocServer32\ ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\ = "Help Service 1.0 Type Library" ImageTuner.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{21A5D62E-04F5-B2E8-7076-5E179AD74A4C}\1.0\FLAGS\ ImageTuner.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1076 ImageTuner.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1076 ImageTuner.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1076 ImageTuner.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\App\ImageTuner32\ImageTuner.exe"C:\Users\Admin\AppData\Local\Temp\App\ImageTuner32\ImageTuner.exe"1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1076