60c4632f3bad71f86f738c1104256f581c95bfa84069e2f5fb2c1b2b7795080d

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
30/05/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
AutoTweakerSetup.exe
Size 57.0MB
Sample260530-e7bltsfz7q
SHA256 60c4632f3bad71f86f738c1104256f581c95bfa84069e2f5fb2c1b2b7795080d
MD5 393c8a6312ba5801390d4a1153c1d809
SHA1 45940440bf67bcb2f2f00bbf5e6cc7e3a821fca9
SHA512 b79ee2d1eec436c84bcb88dc159ac4aff826b4d8c5b8740ebfa018ec2d1ddeca7b7480640172b3d52c695e72c477335e1ab8102281bd23370ee5df849e265c2a
SSDEEP 1572864:mnU1HPKRtnP4slDJhjvoxyjUV67611Nx5Qr88D77:mnU1vKRlP4s3vBT7IL47
TLSH
T1FED73372A35408D5EB839071C2AEBB8441739EB730D2E1D27610BE6A2DF4BE7CB19157
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
568	LuminAutoTweaker.exe

Loads dropped DLL 5 IoCs

pid	Process
1880	AutoTweakerSetup.exe
1880	AutoTweakerSetup.exe
568	LuminAutoTweaker.exe
568	LuminAutoTweaker.exe
568	LuminAutoTweaker.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files\AutoTweaker v7\Bridge.exe	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\Bios\SCEWIN_64.exe	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\Executor.exe	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\logo.ico	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\App\H7T4Y2B9J6X3P1D8	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\App\P1X9L6C3J8R2V7T4	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\App\R2M8Q6K3N1F5W9Z7	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\App\Z4Y7K1Q9H8M3P6R2	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\Bios\amigendrv64.sys	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\LuminAutoTweaker.exe	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\App\K8H3Z6N1D5M9Q2W7	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\App\T6V3R1P9J8L4C2X7	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\Nvidia\Reference.xml	AutoTweakerSetup.exe
File opened for modification	C:\Program Files\AutoTweaker v7\AutoTweaker v7.url	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\uninst.exe	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\Bios\amifldrv64.sys	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\App\A9C3L8D6T2V5X1J7	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\App\M5W2Z9Q1F8R6N3K4	AutoTweakerSetup.exe
File created	C:\Program Files\AutoTweaker v7\dependencies\Nvidia\nvidiaProfileInspector.exe.config	AutoTweakerSetup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AutoTweakerSetup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	568	LuminAutoTweaker.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 568	1880	AutoTweakerSetup.exe	83

C:\Users\Admin\AppData\Local\Temp\AutoTweakerSetup.exe
"C:\Users\Admin\AppData\Local\Temp\AutoTweakerSetup.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Program Files\AutoTweaker v7\LuminAutoTweaker.exe
  "C:\Program Files\AutoTweaker v7\LuminAutoTweaker.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  PID:568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D3DCompiler_47_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LuminAutoTweaker\cZ3Y1IRxTrMCBBXwkW_fX4MQ3TAPjII=\D3DCompiler_47_cor3.dll
Size 4.7MB
SHA256 a05d04a270f68c8c6d6ea2d23bebf8cd1d5453b26b5442fa54965f90f1c62082
MD5 a7349236212b0e5cec2978f2cfa49a1a
SHA1 5abb08949162fd1985b89ffad40aaf5fc769017e
SHA512 c7ff4f9146fefedc199360aa04236294349c881b3865ebc58c5646ad6b3f83fca309de1173f5ebf823a14ba65e5ada77b46f20286d1ea62c37e17adbc9a82d02
SSDEEP 49152:FCZnRO4XyM53Rkq4ypQqdoRpmruVNYvkaRwvpiD0N+YEzI4og/RfzHLeHTRhFRNS:EG2QCwmHXnog/pzHAo/A2L
TLSH
T19A367C5673EA40B9C1ABD178CE479213EBB1781403345BEB4190C669AF73BE16A3E734
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LuminAutoTweaker\cZ3Y1IRxTrMCBBXwkW_fX4MQ3TAPjII=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 75fc0d383ea009ea9453a4589fa8d88d149abcac371bb5eb983d6ece8f1243eb
MD5 a5e9f16c6a381a2241bef8eed1c20309
SHA1 574d1412c55cb2321d2d6545cbb439368623e2a5
SHA512 d9509720807f9298caa1af3abbb098348726700815559febd3417d929e57c7839f498391e92e2a02d8c984db9bf786d25170471fea71bc64c9329b29242244e7
SSDEEP 24576:Tl8W6eU6UPXhA+JYCqX4T3MJj7OQ1Niqdhvc7PgNfb4i7fokJMpw5i2k1/m6eg9k:TH6emPXrYCqX4T3Q1Niqzc74xb4izMp7
TLSH
T118453A22D2E642E4C47FC1B8C646972BFBB17409231C66DB47608B652F67FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wpfgfx_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\LuminAutoTweaker\cZ3Y1IRxTrMCBBXwkW_fX4MQ3TAPjII=\wpfgfx_cor3.dll
Size 1.9MB
SHA256 1ccb4943ef0d472d70e1cb4738f89fb457010e12fa82379daf2dc64cf59d6e9b
MD5 62585acd299185da1f109f935b4320ed
SHA1 6f51669ac4581d6f6e58b99f4a2f6d5ee9e55b6c
SHA512 cf7aee56e1443292b8f71c050a78849f663e8d0be492678f7ea74d5b1f62f12782044bf9ea8469434b15360c8e7eba670bf5a78af7c14b718ad5cb641aade38c
SSDEEP 24576:fp3YLMLrT18UP2HTePBDpuZiV1/QcqylsQdS/etT4ZdSAcMGuOk8SlXlTm:am3iUP2HKBDpuSUypM2tWdSAc5uOq5s
TLSH
T1B8953A46B6EC40EAD47AE23CD9D7461BF27278142761A7CF23A0479D6F27BD0097A360
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy34D7.tmp\System.dll
Size 12KB
SHA256 8b4c47c4cf5e76ec57dd5a050d5acd832a0d532ee875d7b44f6cdaf68f90d37c
MD5 9b38a1b07a0ebc5c7e59e63346ecc2db
SHA1 97332a2ffcf12a3e3f27e7c05213b5d7faa13735
SHA512 26e77f8e10f6d8693c92bd036b53a3f6e0c523090ef8dfe479815f556ecd2b57fc90ce9f7cceebe70460d464decb27ad1fe240819fd56997764e96506b6a439c
SSDEEP 192:kjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZ40QPi:U/Qlt7wiij/lMRv/9V4b4r
TLSH
T1E8427C1297B089F2F151093419667F2A6FBEAC5D17F405A3CFE304C63D212CB9839243
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

modern-wizard.bmp

Path C:\Users\Admin\AppData\Local\Temp\nsy34D7.tmp\modern-wizard.bmp
Size 25KB
SHA256 3ad2dc318056d0a2024af1804ea741146cfc18cc404649a44610cbf8b2056cf2
MD5 cbe40fd2b1ec96daedc65da172d90022
SHA1 366c216220aa4329dff6c485fd0e9b0f4f0a7944
SHA512 62990cb16e37b6b4eff6ab03571c3a82dcaa21a1d393c3cb01d81f62287777fb0b4b27f8852b5fa71bc975feab5baa486d33f2c58660210e115de7e2bd34ea63
SSDEEP 24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
TLSH
T139C29757DE6B6EA4BE0804EF1A0694931C71FE211AB0CD0561D2B767B4FC93B19A0B3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy34D7.tmp\nsDialogs.dll
Size 9KB
SHA256 b1350f487692057c8ffde75dcc55287a52a3272240d4d4912f24464b27551fc0
MD5 8f0e7415f33843431df308bb8e06af81
SHA1 1314272e6ad3be1985d4a1607b890a34b0bde8b5
SHA512 5450b2070c40b257c28ba9a472d762f91b78928d1e8d4d88e0576992065a61fb9a6513006e6b5947c415c9e02ae80a90a85b58da7e016a424331c8cd596ed684
SSDEEP 96:obEv02zUu56FcS817eTaXx85qHFcUcxSgB5PKtAtoniJninnt3DVEB3YHNqkzfFc:obEvCu5e81785qHFcU0PuAw0uytIFc
TLSH
T19D12F892E2A454B3C5D6523B36AA2F2DCBBD5329B0927C01C7738E4D39395766E38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads