2e365109f189757eaa491b3cba03bb5470a038c662f6a0f158e306bbbb3353f1

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/05/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tweekbest.exe
Size 298KB
Sample260528-s19ryaew6y
SHA256 2e365109f189757eaa491b3cba03bb5470a038c662f6a0f158e306bbbb3353f1
MD5 892aeee46893b92a83673808ae3befd9
SHA1 980d2bbd8e6d39b35bab9c0490143780dfd42bbe
SHA512 2862c2999ff52a14d954979628e97c62daf1d290720a24430b49726cc5d875fd4527d3c69dc108de1b39359576625a5aaa89a8b233ac66fbdd041958e171c270
SSDEEP 6144:54M3gH/T0gUvLDI/jfeFhIqyJe5EIcby9wUKsHIR:KwHkoqFsGIeUKs
TLSH
T1CC546D3DA26510FAF97BC579CA538902EF717C4207509ADB27A009962F335E18F3DB19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion discovery evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Modifies boot configuration data using bcdedit 1 TTPs 9 IoCs

ransomware evasion

Inhibit System Recovery

T1490

pid	Process
3376	bcdedit.exe
4244	bcdedit.exe
4596	bcdedit.exe
4296	bcdedit.exe
4556	bcdedit.exe
924	bcdedit.exe
456	bcdedit.exe
2616	bcdedit.exe
1260	bcdedit.exe

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
34	4792	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
456	powershell.exe
4792	powershell.exe
1460	powershell.exe

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 64 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM.exe\PerfOptions	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2699_GTAProcess.exe\MitigationOptions = "572662306"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2944_GTAProcess.exe\PerfOptions\CpuPriorityClass = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2944_GTAProcess.exe\MitigationOptions = "572662306"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3570_GTAProcess.exe	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3570_GTAProcess.exe\MitigationOptions = "572662306"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM.exe	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2060_GTAProcess.exe	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2060_GTAProcess.exe\PerfOptions\IoPriority = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2545_GTAProcess.exe\PerfOptions\PagePriority = "5"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2612_GTAProcess.exe\PerfOptions\CpuPriorityClass = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2802_GTAProcess.exe\PerfOptions\PagePriority = "5"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3095_GTAProcess.exe\MitigationOptions = "572662306"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3407_GTAProcess.exe\PerfOptions\PagePriority = "5"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_GTAProcess.exe	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_GTAProcess.exe\PerfOptions\IoPriority = "3"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2612_GTAProcess.exe	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3095_GTAProcess.exe\PerfOptions	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3407_GTAProcess.exe\MitigationOptions = "572662306"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3570_GTAProcess.exe\PerfOptions\IoPriority = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM.exe\MitigationOptions = "572662306"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CitizenFX_SubProcess_game.exe\PerfOptions	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3407_GTAProcess.exe	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2802_GTAProcess.exe	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2802_GTAProcess.exe\PerfOptions\IoPriority = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3095_GTAProcess.exe\PerfOptions\CpuPriorityClass = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3258_GTAProcess.exe\PerfOptions\PagePriority = "5"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2612_GTAProcess.exe\PerfOptions\IoPriority = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM.exe\PerfOptions\CpuPriorityClass = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CitizenFX_SubProcess_game.exe\PerfOptions\IoPriority = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CitizenFX_SubProcess_game.exe\MitigationOptions = "572662306"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2189_GTAProcess.exe\PerfOptions\PagePriority = "5"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2545_GTAProcess.exe\PerfOptions	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2699_GTAProcess.exe	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3258_GTAProcess.exe\MitigationOptions = "572662306"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_GTAProcess.exe\MitigationOptions = "572662306"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CitizenFX.exe	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2060_GTAProcess.exe\PerfOptions\CpuPriorityClass = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2060_GTAProcess.exe\PerfOptions\PagePriority = "5"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2189_GTAProcess.exe\PerfOptions	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3095_GTAProcess.exe	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3570_GTAProcess.exe\PerfOptions	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_GTAProcess.exe\PerfOptions\CpuPriorityClass = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CitizenFX.exe\PerfOptions\CpuPriorityClass = "3"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2944_GTAProcess.exe\PerfOptions	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2944_GTAProcess.exe	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2060_GTAProcess.exe\PerfOptions	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2372_GTAProcess.exe\PerfOptions\PagePriority = "5"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2545_GTAProcess.exe\PerfOptions\IoPriority = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2612_GTAProcess.exe\MitigationOptions = "572662306"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2189_GTAProcess.exe\PerfOptions\CpuPriorityClass = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2699_GTAProcess.exe\PerfOptions\CpuPriorityClass = "3"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2802_GTAProcess.exe\PerfOptions	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3258_GTAProcess.exe\PerfOptions\IoPriority = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3407_GTAProcess.exe\PerfOptions\IoPriority = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM.exe\PerfOptions\IoPriority = "3"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CitizenFX_SubProcess_game.exe\PerfOptions\CpuPriorityClass = "3"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2372_GTAProcess.exe\PerfOptions	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3095_GTAProcess.exe\PerfOptions\PagePriority = "5"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3258_GTAProcess.exe	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b3570_GTAProcess.exe\PerfOptions\PagePriority = "5"	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CitizenFX_SubProcess_game.exe\PerfOptions\PagePriority = "5"	tweekbest.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2189_GTAProcess.exe	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FiveM_b2189_GTAProcess.exe\PerfOptions\IoPriority = "3"	tweekbest.exe

Stops running service(s) 4 TTPs
defense_evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Power Settings 1 TTPs 16 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
2740	cmd.exe
4908	powercfg.exe
1704	cmd.exe
3676	cmd.exe
1412	powercfg.exe
3528	powercfg.exe
1536	cmd.exe
3188	powercfg.exe
2836	powercfg.exe
4104	powercfg.exe
4232	cmd.exe
2080	cmd.exe
3056	powercfg.exe
5084	cmd.exe
3728	cmd.exe
3992	powercfg.exe

Launches sc.exe 16 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2584	sc.exe
2568	sc.exe
4460	sc.exe
2012	sc.exe
4860	sc.exe
4204	sc.exe
3032	sc.exe
4168	sc.exe
4476	sc.exe
404	sc.exe
900	sc.exe
2220	sc.exe
1888	sc.exe
1152	sc.exe
3024	sc.exe
3376	sc.exe

Event Triggered Execution: Netsh Helper DLL 1 TTPs 27 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

System Time Discovery 1 TTPs 2 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
640	cmd.exe
4636	netsh.exe

Disables Windows logging functionality 2 TTPs
Changes registry settings to disable Windows Event logging.

Disable or Modify Tools
T1562.001

Modify Registry
T1112

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
3884	ipconfig.exe

Modifies Control Panel 14 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\MenuShowDelay = "0"	tweekbest.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Mouse	tweekbest.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Mouse\MouseThreshold2 = "0"	tweekbest.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Keyboard	tweekbest.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Accessibility\StickyKeys	tweekbest.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Accessibility\StickyKeys\Flags = "506"	tweekbest.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Accessibility\ToggleKeys	tweekbest.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Accessibility\ToggleKeys\Flags = "58"	tweekbest.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop	tweekbest.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Desktop\UserPreferencesMask = 9012038010000000	tweekbest.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Mouse\MouseSpeed = "0"	tweekbest.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Mouse\MouseThreshold1 = "0"	tweekbest.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Keyboard\KeyboardDelay = "0"	tweekbest.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\Keyboard\KeyboardSpeed = "31"	tweekbest.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
456	powershell.exe
456	powershell.exe
456	powershell.exe
1460	powershell.exe
1460	powershell.exe
1460	powershell.exe
4964	tweekbest.exe
4964	tweekbest.exe
4792	powershell.exe
4792	powershell.exe
4792	powershell.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3056	powercfg.exe
Token: SeCreatePagefilePrivilege	3056	powercfg.exe
Token: SeShutdownPrivilege	2836	powercfg.exe
Token: SeCreatePagefilePrivilege	2836	powercfg.exe
Token: SeShutdownPrivilege	2836	powercfg.exe
Token: SeCreatePagefilePrivilege	2836	powercfg.exe
Token: SeShutdownPrivilege	4908	powercfg.exe
Token: SeCreatePagefilePrivilege	4908	powercfg.exe
Token: SeShutdownPrivilege	4104	powercfg.exe
Token: SeCreatePagefilePrivilege	4104	powercfg.exe
Token: SeShutdownPrivilege	1412	powercfg.exe
Token: SeCreatePagefilePrivilege	1412	powercfg.exe
Token: SeShutdownPrivilege	3528	powercfg.exe
Token: SeCreatePagefilePrivilege	3528	powercfg.exe
Token: SeShutdownPrivilege	3188	powercfg.exe
Token: SeCreatePagefilePrivilege	3188	powercfg.exe
Token: SeShutdownPrivilege	3992	powercfg.exe
Token: SeCreatePagefilePrivilege	3992	powercfg.exe
Token: SeDebugPrivilege	456	powershell.exe
Token: SeIncreaseQuotaPrivilege	456	powershell.exe
Token: SeSecurityPrivilege	456	powershell.exe
Token: SeTakeOwnershipPrivilege	456	powershell.exe
Token: SeLoadDriverPrivilege	456	powershell.exe
Token: SeSystemProfilePrivilege	456	powershell.exe
Token: SeSystemtimePrivilege	456	powershell.exe
Token: SeProfSingleProcessPrivilege	456	powershell.exe
Token: SeIncBasePriorityPrivilege	456	powershell.exe
Token: SeCreatePagefilePrivilege	456	powershell.exe
Token: SeBackupPrivilege	456	powershell.exe
Token: SeRestorePrivilege	456	powershell.exe
Token: SeShutdownPrivilege	456	powershell.exe
Token: SeDebugPrivilege	456	powershell.exe
Token: SeSystemEnvironmentPrivilege	456	powershell.exe
Token: SeRemoteShutdownPrivilege	456	powershell.exe
Token: SeUndockPrivilege	456	powershell.exe
Token: SeManageVolumePrivilege	456	powershell.exe
Token: 33	456	powershell.exe
Token: 34	456	powershell.exe
Token: 35	456	powershell.exe
Token: 36	456	powershell.exe
Token: SeDebugPrivilege	1460	powershell.exe
Token: SeProfSingleProcessPrivilege	4964	tweekbest.exe
Token: SeDebugPrivilege	4792	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 4352	4964	tweekbest.exe	90
PID 4964 wrote to memory of 2740	4964	tweekbest.exe	100
PID 2740 wrote to memory of 3056	2740	cmd.exe	101
PID 4964 wrote to memory of 5084	4964	tweekbest.exe	102
PID 5084 wrote to memory of 2836	5084	cmd.exe	103
PID 4964 wrote to memory of 3676	4964	tweekbest.exe	104
PID 3676 wrote to memory of 4908	3676	cmd.exe	105
PID 4964 wrote to memory of 3728	4964	tweekbest.exe	106
PID 3728 wrote to memory of 4104	3728	cmd.exe	107
PID 4964 wrote to memory of 4232	4964	tweekbest.exe	108
PID 4232 wrote to memory of 1412	4232	cmd.exe	109
PID 4964 wrote to memory of 2080	4964	tweekbest.exe	110
PID 2080 wrote to memory of 3528	2080	cmd.exe	111
PID 4964 wrote to memory of 1536	4964	tweekbest.exe	112
PID 1536 wrote to memory of 3188	1536	cmd.exe	113
PID 4964 wrote to memory of 1704	4964	tweekbest.exe	114
PID 1704 wrote to memory of 3992	1704	cmd.exe	115
PID 4964 wrote to memory of 4528	4964	tweekbest.exe	116
PID 4528 wrote to memory of 3376	4528	cmd.exe	117
PID 4964 wrote to memory of 4436	4964	tweekbest.exe	118
PID 4436 wrote to memory of 4244	4436	cmd.exe	119
PID 4964 wrote to memory of 1712	4964	tweekbest.exe	120
PID 1712 wrote to memory of 4596	1712	cmd.exe	121
PID 4964 wrote to memory of 4320	4964	tweekbest.exe	122
PID 4320 wrote to memory of 3812	4320	cmd.exe	123
PID 4964 wrote to memory of 4152	4964	tweekbest.exe	124
PID 4152 wrote to memory of 2220	4152	cmd.exe	125
PID 4964 wrote to memory of 3996	4964	tweekbest.exe	126
PID 3996 wrote to memory of 456	3996	cmd.exe	127
PID 4964 wrote to memory of 5080	4964	tweekbest.exe	128
PID 5080 wrote to memory of 2584	5080	cmd.exe	129
PID 4964 wrote to memory of 2520	4964	tweekbest.exe	130
PID 2520 wrote to memory of 2568	2520	cmd.exe	131
PID 4964 wrote to memory of 3776	4964	tweekbest.exe	132
PID 3776 wrote to memory of 2616	3776	cmd.exe	133
PID 4964 wrote to memory of 2116	4964	tweekbest.exe	134
PID 2116 wrote to memory of 2444	2116	cmd.exe	135
PID 4964 wrote to memory of 2244	4964	tweekbest.exe	136
PID 2244 wrote to memory of 2156	2244	cmd.exe	137
PID 4964 wrote to memory of 4284	4964	tweekbest.exe	138
PID 4284 wrote to memory of 4636	4284	cmd.exe	139
PID 4964 wrote to memory of 4212	4964	tweekbest.exe	140
PID 4212 wrote to memory of 2064	4212	cmd.exe	141
PID 4964 wrote to memory of 1012	4964	tweekbest.exe	142
PID 1012 wrote to memory of 3884	1012	cmd.exe	143
PID 4964 wrote to memory of 2660	4964	tweekbest.exe	144
PID 2660 wrote to memory of 1888	2660	cmd.exe	145
PID 4964 wrote to memory of 2608	4964	tweekbest.exe	146
PID 2608 wrote to memory of 2012	2608	cmd.exe	147
PID 4964 wrote to memory of 4344	4964	tweekbest.exe	148
PID 4344 wrote to memory of 404	4344	cmd.exe	149
PID 4964 wrote to memory of 4484	4964	tweekbest.exe	150
PID 4484 wrote to memory of 1152	4484	cmd.exe	151
PID 4964 wrote to memory of 3768	4964	tweekbest.exe	152
PID 3768 wrote to memory of 4460	3768	cmd.exe	153
PID 4964 wrote to memory of 4132	4964	tweekbest.exe	154
PID 4132 wrote to memory of 3024	4132	cmd.exe	155
PID 4964 wrote to memory of 4428	4964	tweekbest.exe	156
PID 4428 wrote to memory of 4860	4428	cmd.exe	157
PID 4964 wrote to memory of 1156	4964	tweekbest.exe	158
PID 1156 wrote to memory of 3376	1156	cmd.exe	159
PID 4964 wrote to memory of 4696	4964	tweekbest.exe	160
PID 4696 wrote to memory of 4204	4696	cmd.exe	161
PID 4964 wrote to memory of 3276	4964	tweekbest.exe	162

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection	tweekbest.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\AllowTelemetry = "0"	tweekbest.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tweekbest.exe
"C:\Users\Admin\AppData\Local\Temp\tweekbest.exe"
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c cls
  2⤵
  PID:4352
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61 >nul 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:2740
- - C:\Windows\system32\powercfg.exe
    powercfg -duplicatescheme e9a42b02-d5df-448d-aa00-03f14749eb61
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3056
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -h off >nul 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Windows\system32\powercfg.exe
    powercfg -h off
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:2836
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -setacvalueindex scheme_current 54533251-82be-4824-96c1-47b60b740d00 893dee8e-2bef-41e0-89c6-b55d0929964c 100 >nul 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3676
- - C:\Windows\system32\powercfg.exe
    powercfg -setacvalueindex scheme_current 54533251-82be-4824-96c1-47b60b740d00 893dee8e-2bef-41e0-89c6-b55d0929964c 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4908
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -setacvalueindex scheme_current 54533251-82be-4824-96c1-47b60b740d00 bc5038f7-23e0-4960-96da-33abaf5935ec 100 >nul 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\system32\powercfg.exe
    powercfg -setacvalueindex scheme_current 54533251-82be-4824-96c1-47b60b740d00 bc5038f7-23e0-4960-96da-33abaf5935ec 100
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:4104
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -setacvalueindex scheme_current 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0 >nul 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\system32\powercfg.exe
    powercfg -setacvalueindex scheme_current 2a737441-1930-4402-8d77-b2bebba308a3 48e6b7a6-50f5-4782-a5d4-53bb8f07e226 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -setacvalueindex scheme_current 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5 0 >nul 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:2080
- - C:\Windows\system32\powercfg.exe
    powercfg -setacvalueindex scheme_current 501a4d13-42af-4429-9fd1-a8218c268e20 ee12f906-d277-404b-b6da-e5fa1a576df5 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3528
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -setactive scheme_current >nul 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Windows\system32\powercfg.exe
    powercfg -setactive scheme_current
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3188
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powercfg -setacvalueindex scheme_current 54533251-82be-4824-96c1-47b60b740d00 be337238-0d82-4146-a960-4f3749d470c7 0 >nul 2>&1
  2⤵
  - Power Settings
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\system32\powercfg.exe
    powercfg -setacvalueindex scheme_current 54533251-82be-4824-96c1-47b60b740d00 be337238-0d82-4146-a960-4f3749d470c7 0
    3⤵
    - Power Settings
    - Suspicious use of AdjustPrivilegeToken
    PID:3992
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set disabledynamictick yes >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4528
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set disabledynamictick yes
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set useplatformtick yes >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set useplatformtick yes
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4244
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /deletevalue useplatformclock >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\system32\bcdedit.exe
    bcdedit /deletevalue useplatformclock
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4596
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /change /tn "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}" /disable >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "NvTmMon_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}" /disable
    3⤵
    PID:3812
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c schtasks /change /tn "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}" /disable >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4152
- - C:\Windows\system32\schtasks.exe
    schtasks /change /tn "NvTmRep_{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}" /disable
    3⤵
    PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "Disable-MMAgent -MemoryCompression" >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3996
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "Disable-MMAgent -MemoryCompression"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config SysMain start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\system32\sc.exe
    sc config SysMain start=disabled
    3⤵
    - Launches sc.exe
    PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop SysMain >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2520
- - C:\Windows\system32\sc.exe
    sc stop SysMain
    3⤵
    - Launches sc.exe
    PID:2568
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c fsutil behavior set disablelastaccess 1 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3776
- - C:\Windows\system32\fsutil.exe
    fsutil behavior set disablelastaccess 1
    3⤵
    PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c fsutil behavior set disable8dot3 1 >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2116
- - C:\Windows\system32\fsutil.exe
    fsutil behavior set disable8dot3 1
    3⤵
    PID:2444
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global rss=enabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global rss=enabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2156
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global autotuninglevel=normal >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global autotuninglevel=normal
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global ecncapability=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4212
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global ecncapability=disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:2064
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\system32\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - Gathers network information
    PID:3884
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config DiagTrack start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2660
- - C:\Windows\system32\sc.exe
    sc config DiagTrack start=disabled
    3⤵
    - Launches sc.exe
    PID:1888
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop DiagTrack >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\sc.exe
    sc stop DiagTrack
    3⤵
    - Launches sc.exe
    PID:2012
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config dmwappushservice start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Windows\system32\sc.exe
    sc config dmwappushservice start=disabled
    3⤵
    - Launches sc.exe
    PID:404
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop dmwappushservice >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4484
- - C:\Windows\system32\sc.exe
    sc stop dmwappushservice
    3⤵
    - Launches sc.exe
    PID:1152
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config MapsBroker start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3768
- - C:\Windows\system32\sc.exe
    sc config MapsBroker start=disabled
    3⤵
    - Launches sc.exe
    PID:4460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop MapsBroker >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4132
- - C:\Windows\system32\sc.exe
    sc stop MapsBroker
    3⤵
    - Launches sc.exe
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config Fax start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\sc.exe
    sc config Fax start=disabled
    3⤵
    - Launches sc.exe
    PID:4860
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop Fax >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1156
- - C:\Windows\system32\sc.exe
    sc stop Fax
    3⤵
    - Launches sc.exe
    PID:3376
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config RetailDemo start=disabled >nul 2>&1
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4696
- - C:\Windows\system32\sc.exe
    sc config RetailDemo start=disabled
    3⤵
    - Launches sc.exe
    PID:4204
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop RetailDemo >nul 2>&1
  2⤵
  PID:3276
- - C:\Windows\system32\sc.exe
    sc stop RetailDemo
    3⤵
    - Launches sc.exe
    PID:900
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config lfsvc start=disabled >nul 2>&1
  2⤵
  PID:1040
- - C:\Windows\system32\sc.exe
    sc config lfsvc start=disabled
    3⤵
    - Launches sc.exe
    PID:2220
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop lfsvc >nul 2>&1
  2⤵
  PID:3812
- - C:\Windows\system32\sc.exe
    sc stop lfsvc
    3⤵
    - Launches sc.exe
    PID:3032
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc config RemoteRegistry start=disabled >nul 2>&1
  2⤵
  PID:2180
- - C:\Windows\system32\sc.exe
    sc config RemoteRegistry start=disabled
    3⤵
    - Launches sc.exe
    PID:4168
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c sc stop RemoteRegistry >nul 2>&1
  2⤵
  PID:4548
- - C:\Windows\system32\sc.exe
    sc stop RemoteRegistry
    3⤵
    - Launches sc.exe
    PID:4476
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set hypervisorlaunchtype off >nul 2>&1
  2⤵
  PID:2932
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set hypervisorlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4296
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set vsmlaunchtype off >nul 2>&1
  2⤵
  PID:2528
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set vsmlaunchtype off
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:4556
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set nx OptIn >nul 2>&1
  2⤵
  PID:2268
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set nx OptIn
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:924
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set allowedinmemorysettings 0x0 >nul 2>&1
  2⤵
  PID:4960
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set allowedinmemorysettings 0x0
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:456
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set isolatedcontext No >nul 2>&1
  2⤵
  PID:4352
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set isolatedcontext No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:2616
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c bcdedit /set vm No >nul 2>&1
  2⤵
  PID:4196
- - C:\Windows\system32\bcdedit.exe
    bcdedit /set vm No
    3⤵
    - Modifies boot configuration data using bcdedit
    PID:1260
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global rsc=disabled >nul 2>&1
  2⤵
  PID:3652
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global rsc=disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:896
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global timestamps=disabled >nul 2>&1
  2⤵
  - System Time Discovery
  PID:640
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global timestamps=disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    - System Time Discovery
    PID:4636
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global initialRto=2000 >nul 2>&1
  2⤵
  PID:1572
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global initialRto=2000
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1840
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set global nonsackrttresiliency=disabled >nul 2>&1
  2⤵
  PID:5100
- - C:\Windows\system32\netsh.exe
    netsh int tcp set global nonsackrttresiliency=disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:1964
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set heuristics disabled >nul 2>&1
  2⤵
  PID:912
- - C:\Windows\system32\netsh.exe
    netsh int tcp set heuristics disabled
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:928
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c netsh int tcp set supplemental Internet congestionprovider=ctcp >nul 2>&1
  2⤵
  PID:4220
- - C:\Windows\system32\netsh.exe
    netsh int tcp set supplemental Internet congestionprovider=ctcp
    3⤵
    - Event Triggered Execution: Netsh Helper DLL
    PID:768
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener" /v Start /t REG_DWORD /d 0 /f >nul 2>&1
  2⤵
  PID:1152
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AutoLogger-Diagtrack-Listener" /v Start /t REG_DWORD /d 0 /f
    3⤵
    PID:1412
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger" /v Start /t REG_DWORD /d 0 /f >nul 2>&1
  2⤵
  PID:2912
- - C:\Windows\system32\reg.exe
    reg add "HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\Circular Kernel Context Logger" /v Start /t REG_DWORD /d 0 /f
    3⤵
    PID:3024
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c PowerShell -Command "Set-ProcessMitigation -System -Disable CFG,SEHOP,DEP,ASLR,BottomUp,HighEntropy" >nul 2>&1
  2⤵
  PID:3816
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PowerShell -Command "Set-ProcessMitigation -System -Disable CFG,SEHOP,DEP,ASLR,BottomUp,HighEntropy"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1460
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c powershell -Command "$ProgressPreference='SilentlyContinue'; $u=(Invoke-RestMethod 'https://api.github.com/repos/Orbmu2k/nvidiaProfileInspector/releases/latest').assets[0].browser_download_url; Invoke-WebRequest $u -OutFile 'C:\Users\Admin\AppData\Local\Temp\npi.zip'; Expand-Archive 'C:\Users\Admin\AppData\Local\Temp\npi.zip' 'C:\Users\Admin\AppData\Local\Temp\NPI' -Force; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\npi.zip'" >nul 2>&1
  2⤵
  PID:3032
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -Command "$ProgressPreference='SilentlyContinue'; $u=(Invoke-RestMethod 'https://api.github.com/repos/Orbmu2k/nvidiaProfileInspector/releases/latest').assets[0].browser_download_url; Invoke-WebRequest $u -OutFile 'C:\Users\Admin\AppData\Local\Temp\npi.zip'; Expand-Archive 'C:\Users\Admin\AppData\Local\Temp\npi.zip' 'C:\Users\Admin\AppData\Local\Temp\NPI' -Force; Remove-Item 'C:\Users\Admin\AppData\Local\Temp\npi.zip'"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Power Settings

T1653

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 70c3ecbaa6df88e88df4efc70968502955e890a2248269641c4e2d4668ef61bf
MD5 661739d384d9dfd807a089721202900b
SHA1 5b2c5d6a7122b4ce849dc98e79a7713038feac55
SHA512 81b48ae5c4064c4d9597303d913e32d3954954ba1c8123731d503d1653a0d848856812d2ee6951efe06b1db2b91a50e5d54098f60c26f36bc8390203f4c8a2d8
TLSH
T1DC51FE323375F0D4C8567F07293819D463BF4386EA94AF58B258621ED93641B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 5f03b722ec2fe948a07d9cbd5eb0c6ae6bad616c562c4361efc6a788c3f0d1bb
MD5 c563a752fedc1386a5a3c062d7e82564
SHA1 29cc3c11b00695d5dbda53c3b71ada05cd9b9ecb
SHA512 932577fd21e44c83d25907764c3e15c752a4328f26a685d6417bdaab80cfdf703f8fbd06c2784282f502c90f05496490690a240030477e22eda7146ca1cf96a2
TLSH
T121217823B39D8820CCD6153A108D9C5072A682C781DFCF9F6EC0D21191BFAC8CB21190
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 42ba2251d0e8527ebf041cb394ba82ad12fe9b825ad20125acfda1e722ae6ceb
MD5 24069b14fdeb070136589bad0ce634a9
SHA1 c06edd2d81884fbe1aaadf5d1474969629428c1a
SHA512 53c3bfe938f05912f123f5f2b127c16568c3d954822229ef0fa4c3e5157b9f7f490fa71de9b272b17210cad80a1ccd9f1a0ceb200b200b9874f167726fe83218
TLSH
T198113227B38C89A5C89A553A509CAC5232A686C7C1AFCFDF7EC4C611A4AF584CF22190
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5pscs24e.o3f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5pscs24e.o3f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/456-0-0x000001F3ED4B0000-0x000001F3ED4D2000-memory.dmp

Download

memory/1460-19-0x000001D5F6EE0000-0x000001D5F6EFE000-memory.dmp

Download