Analysis
- user interaction
yes - max time kernel
36s - max time network
33s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
06/07/2026, 19:19
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
OptiTweaks.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
OptiTweaks.exe
Resource
win11ltsc2024-20260629-en
3 signatures
150 seconds
General
- Target OptiTweaks.exe
- Size 34KB
- Sample260706-x1yf5acs21
- SHA256 680d8f92bf47994c69dcd80d9a0d049a8fa4e73c22ef3be3e69eef8b4440ba5c
- MD5 ef5d9ef07233d739026c2f96dd8f6fbc
- SHA1 19719bb80d695cfc7a2d323a445390ab5972de0d
- SHA512 d6aacb0e754bd1f7e3d5f9207aec00fb21b826bbecedcb8f5638c66623f645415d4a9317b1f0dc82eb49f35191912013b3f1c76601eb2ae0b7ef190870a1ab5f
- SSDEEP 768:zEk+s5HUS6EQkEYqKRrWbcp+2/e5NEm+I:ozC0S61kTqmrec82/GK
- TLSH T1AEF2B819CD1691ABE71D8DB8CA134905DE62BCC7DBE2B5CB67400CD20DA6AD49F3E302
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Run\OptiWeaksInjector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\OptiTweaks.exe" OptiTweaks.exe Set value (str) \REGISTRY\USER\S-1-5-21-1991999443-3181470666-3272020885-1000\Software\Microsoft\Windows\CurrentVersion\Run\OptiWeaksInjector = "C:\\Users\\Admin\\AppData\\Local\\Temp\\OptiTweaks.exe" OptiTweaks.exe - Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 788 OptiTweaks.exe 788 OptiTweaks.exe 3520 OptiTweaks.exe 3520 OptiTweaks.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 788 OptiTweaks.exe 788 OptiTweaks.exe 3520 OptiTweaks.exe 3520 OptiTweaks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\OptiTweaks.exe"C:\Users\Admin\AppData\Local\Temp\OptiTweaks.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:788
-
C:\Users\Admin\AppData\Local\Temp\OptiTweaks.exeC:\Users\Admin\AppData\Local\Temp\OptiTweaks.exe1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3520