Analysis
- max time kernel
899s - max time network
897s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/07/2026, 14:37
General
- Target SimplyTweaksInstaller.exe
- Size 60.5MB
- Sample260717-ry481adt7l
- SHA256 829357c489c494f3290d0448e46c12be3d18d51839ce845dff8c6d27ceec3dd9
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
- Loads dropped DLL 3 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 3 IoCs
Inno Setup installer
- Modifies registry class 14 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SimplyTweaksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\SimplyTweaksInstaller.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-NYMIWZS0N9.tmp\SimplyTweaksInstaller.tmp"C:\Users\Admin\AppData\Local\Temp\is-NYMIWZS0N9.tmp\SimplyTweaksInstaller.tmp" /SL5="$400B8,61971464,835584,C:\Users\Admin\AppData\Local\Temp\SimplyTweaksInstaller.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe"C:\Users\Admin\AppData\Local\simply_tweaks_free\simply_tweaks.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\System32\SecurityHealthHost.exe\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
SimplyTweaksInstaller.tmp
memory/3820-7-0x0000000000830000-0x000000000090B000-memory.dmp
memory/3820-1-0x0000000000830000-0x000000000090B000-memory.dmp
memory/3820-51-0x0000000000830000-0x000000000090B000-memory.dmp
memory/4148-8-0x0000000000890000-0x0000000000D72000-memory.dmp
memory/4148-11-0x0000000000890000-0x0000000000D72000-memory.dmp
memory/4148-22-0x0000000000890000-0x0000000000D72000-memory.dmp
memory/4148-9-0x0000000001270000-0x0000000001271000-memory.dmp
memory/4148-6-0x0000000001270000-0x0000000001271000-memory.dmp
memory/4148-50-0x0000000000890000-0x0000000000D72000-memory.dmp