7f9cf6df866e61a09e63c646b8659358a7ff86b65659e23f23ab537f80527492

Analysis

max time kernel
149s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 14:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Socials Free Tweaking Utility v2.0.bat
Size 47KB
Sample260712-rmyxvabv5q
SHA256 7f9cf6df866e61a09e63c646b8659358a7ff86b65659e23f23ab537f80527492
MD5 fa54cbd03e8db3342e3792ebd1f62b4b
SHA1 e7027390208847c1220ad05b9a9f2805fed85933
SHA512 2b80f801521a500f60c82630b4b38a74b9bfe493e5d28c9ff3fdca01b21ef0a2c03363565b196748e4cfa03b32f5801c1a123990c6207391b7ccfce751c98466
SSDEEP 768:p+pfZFpPQBZs7c2+fnbM9tGnRy6I23/zk4D9Nz/1tBvY:XTIYNzttBvY
TLSH
T1DD233231E9240322C675BE2098F7CC19B7A5E2C39A22EB4578DF215E1F7B643C8791D6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

defense_evasion execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
204	powershell.exe
5060	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Delays execution with timeout.exe 6 IoCs

defense_evasion

pid	Process
1544	timeout.exe
2924	timeout.exe
5612	timeout.exe
2308	timeout.exe
5228	timeout.exe
2956	timeout.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	powershell.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings	powershell.exe

Modifies registry key 1 TTPs 3 IoCs

Modify Registry

T1112

pid	Process
1232	reg.exe
1580	reg.exe
5864	reg.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1568	powershell.exe
1568	powershell.exe
4372	powershell.exe
4372	powershell.exe
204	powershell.exe
204	powershell.exe
5060	powershell.exe
5060	powershell.exe

Suspicious use of AdjustPrivilegeToken 15 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	powershell.exe
Token: SeDebugPrivilege	4372	powershell.exe
Token: SeDebugPrivilege	204	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeBackupPrivilege	5244	vssvc.exe
Token: SeRestorePrivilege	5244	vssvc.exe
Token: SeAuditPrivilege	5244	vssvc.exe
Token: SeBackupPrivilege	5936	srtasks.exe
Token: SeRestorePrivilege	5936	srtasks.exe
Token: SeSecurityPrivilege	5936	srtasks.exe
Token: SeTakeOwnershipPrivilege	5936	srtasks.exe
Token: SeBackupPrivilege	5936	srtasks.exe
Token: SeRestorePrivilege	5936	srtasks.exe
Token: SeSecurityPrivilege	5936	srtasks.exe
Token: SeTakeOwnershipPrivilege	5936	srtasks.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 1568	4876	cmd.exe	87
PID 1568 wrote to memory of 1768	1568	powershell.exe	88
PID 1768 wrote to memory of 3392	1768	cmd.exe	90
PID 3392 wrote to memory of 1580	3392	cmd.exe	91
PID 1768 wrote to memory of 1232	1768	cmd.exe	92
PID 1768 wrote to memory of 3832	1768	cmd.exe	93
PID 3832 wrote to memory of 4372	3832	cmd.exe	95
PID 4372 wrote to memory of 4252	4372	powershell.exe	96
PID 4252 wrote to memory of 3212	4252	cmd.exe	98
PID 3212 wrote to memory of 5864	3212	cmd.exe	99
PID 4252 wrote to memory of 204	4252	cmd.exe	100
PID 4252 wrote to memory of 3680	4252	cmd.exe	103
PID 4252 wrote to memory of 5060	4252	cmd.exe	104
PID 4252 wrote to memory of 4992	4252	cmd.exe	111
PID 4252 wrote to memory of 4820	4252	cmd.exe	112
PID 4252 wrote to memory of 2308	4252	cmd.exe	113
PID 4252 wrote to memory of 4180	4252	cmd.exe	114
PID 4252 wrote to memory of 5228	4252	cmd.exe	115
PID 4252 wrote to memory of 2228	4252	cmd.exe	116
PID 4252 wrote to memory of 2416	4252	cmd.exe	117
PID 4252 wrote to memory of 2956	4252	cmd.exe	118
PID 4252 wrote to memory of 1544	4252	cmd.exe	119
PID 4252 wrote to memory of 2924	4252	cmd.exe	121
PID 4252 wrote to memory of 5612	4252	cmd.exe	122
PID 4252 wrote to memory of 1348	4252	cmd.exe	123
PID 4252 wrote to memory of 3424	4252	cmd.exe	124
PID 4252 wrote to memory of 5740	4252	cmd.exe	125
PID 4252 wrote to memory of 3372	4252	cmd.exe	126

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\Socials Free Tweaking Utility v2.0.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell start -verb runas '"C:\Users\Admin\AppData\Local\Temp\Socials Free Tweaking Utility v2.0.bat"' am_admin
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1568
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\Socials Free Tweaking Utility v2.0.bat" am_admin
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1768
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c Reg query HKCU\CONSOLE /v VirtualTerminalLevel 2>nul
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3392
    - - C:\Windows\system32\reg.exe
        
        Reg query HKCU\CONSOLE /v VirtualTerminalLevel
        5⤵
        Modifies registry key
        
        PID:1580
  - - C:\Windows\system32\reg.exe
      Reg add HKCU\CONSOLE /v VirtualTerminalLevel /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:1232
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Local\Temp\SOCIAL~1.BAT"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3832
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell start -verb runas 'C:\Users\Admin\AppData\Local\Temp\SOCIAL~1.BAT' am_admin
        5⤵
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4372
      - C:\Windows\System32\cmd.exe
        
        "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Local\Temp\SOCIAL~1.BAT" am_admin
        6⤵
        Modifies registry class
        Suspicious use of WriteProcessMemory
        
        PID:4252
        
        C:\Windows\system32\cmd.exe
        
        C:\Windows\system32\cmd.exe /c Reg query HKCU\CONSOLE /v VirtualTerminalLevel 2>nul
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:3212
        
        C:\Windows\system32\reg.exe
        
        Reg query HKCU\CONSOLE /v VirtualTerminalLevel
        8⤵
        Modifies registry key
        
        PID:5864
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        Powershell.exe -command "& {Enable-ComputerRestore -Drive "C:"}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:204
        
        C:\Windows\system32\reg.exe
        
        REG ADD "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore" /V "SystemRestorePointCreationFrequency" /T REG_DWORD /D 0 /F
        7⤵
        
        PID:3680
        
        C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        PowerShell -NoProfile -ExecutionPolicy Bypass -Command "& {Checkpoint-Computer -Description "BeforeSocialsFreeUtil"}"
        7⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:5060
        
        C:\Windows\system32\curl.exe
        
        curl -L https://tweakssocial.com/PowerRun.exe -o "C:\Windows\PowerRun.exe"
        7⤵
        
        PID:4992
        
        C:\Windows\System32\WScript.exe
        
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\msgbox.vbs"
        7⤵
        
        PID:4820
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        7⤵
        Delays execution with timeout.exe
        
        PID:2308
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:4180
        
        C:\Windows\system32\timeout.exe
        
        timeout 3
        7⤵
        Delays execution with timeout.exe
        
        PID:5228
        
        C:\Windows\system32\mode.com
        
        MODE CON COLS=50 LINES=3
        7⤵
        
        PID:2228
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:2416
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        7⤵
        Delays execution with timeout.exe
        
        PID:2956
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        7⤵
        Delays execution with timeout.exe
        
        PID:1544
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        7⤵
        Delays execution with timeout.exe
        
        PID:2924
        
        C:\Windows\system32\timeout.exe
        
        timeout 1
        7⤵
        Delays execution with timeout.exe
        
        PID:5612
        
        C:\Windows\system32\mode.com
        
        MODE CON COLS=169 LINES=50
        7⤵
        
        PID:1348
        
        C:\Windows\system32\chcp.com
        
        chcp 65001
        7⤵
        
        PID:3424
        
        C:\Windows\system32\reg.exe
        
        reg add "HKCU\CONSOLE" /v "VirtualTerminalLevel" /t REG_DWORD /d "1" /f
        7⤵
        
        PID:5740
        
        C:\Windows\system32\choice.exe
        
        choice /c yn /m "[92mY[97m/[91mN" /n
        7⤵
        
        PID:3372

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5244

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 7778e3c0960eac5fa1f0f93871cc43b77d5bae152614ed02b10f0319560a0500
MD5 f4ee75fed97e37f471be9fdad727103a
SHA1 f726d3b40b0283e33be5699c8c718ee81ff0aec1
SHA512 e55829243bb1453a0697968c81f165e2bf1bd947d393e4962ae68d892a6a892e6a3b5820b0de7d6421383ef61ff104f671c4e2bde275ae3369c7c715a8c65bbb
TLSH
T181115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BB784D149B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 bcf8325db72c06bb7f6a8df3c4648a150d766a1857214c6b533c467029424ce8
MD5 e6bcee6109b84febc5ffa8c6d9b2a547
SHA1 eb5de5de4575f11fea9fb8a5f72aee1c8b5b3dab
SHA512 3081253140a770e4c68087b76b905286143feb2fbafa1e0b284b50f69ec736153f85fad9305d7e7f1309d98cf470edea4ab89da3941e068631116d03cccf5333
TLSH
T1C6115733B3CC8624CC9A403650CEAC1036B587DB509EDF6BBB84D145B83F599DE61260
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 60292489db6d4ba2a3e4448639fbe7fa2261be477f63ef09bca0b55e520a4777
MD5 9db254dd0cf5e2b1153ff5cde0ed8885
SHA1 de97945a57babdd2498693fbb2b3d8bc548da209
SHA512 a86e71b1b09215d626067d2fab0d7111a5718937c4097b826e77402d32aa3bf64d73a8886104f7b0ae434dcafb9abab4d04d2c053cb65510d611c069d04f7011
TLSH
T19A115733B3CC8624C89A413650CEAC1036B587DB519ECE6BBB84D154B43F59ADE61260
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yhg2sxry.t0i.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yhg2sxry.t0i.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

msgbox.vbs

Path C:\Users\Admin\msgbox.vbs
Size 84B
SHA256 30d8f66b8648fbf3904c8d565686d2bf8c0b72c4b23d3085ce6ec22e999fd3e0
MD5 e616d09a157421d3382875e0dc7e8152
SHA1 d7d63a41c18b5b83b2e0f07e71f66981b242d5b7
SHA512 6f7409385a26822892863402f01ed47ae10857618cabfea77bc9cb1a73a2997e82b13b4925d6e31e1cab0ee1b4ba2ee5fd31a9d7dce5c63ea557da2f16e73a0b
TLSH
T139A01257618227B088CCC2C429063446A2210B74430F5800ACE8201080E6C44807A018
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1568-5-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1568-8-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1568-10-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1568-11-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1568-7-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1568-6-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download

memory/1568-0-0x00007FFA3123F000-0x00007FFA31240000-memory.dmp

Download

memory/1568-4-0x0000023363190000-0x00000233631B2000-memory.dmp

Download

memory/1568-3-0x00007FFA310B0000-0x00007FFA31A54000-memory.dmp

Download