f3d6696101be185e9cb621adbfa0e4c7350ef4aff1fef2d71aebaee79399d0f1

Analysis

max time kernel
149s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 11:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PRIVATE TWEAK UTIL CRACKED BY @butimlarping.exe
Size 447KB
Sample260728-nn71csgp4x
SHA256 f3d6696101be185e9cb621adbfa0e4c7350ef4aff1fef2d71aebaee79399d0f1
MD5 5f0eb6d77ebb228d3ba6cedbc5b690b8
SHA1 0740bf621222afdcf05579e599d786579cd23b29
SHA512 3c21a105452bd4b9dcf63d20c6d35a317b802353533a9ff8b448fd112444a1c0666000323c00e58c4025b003e29bcb39e7ef5be81b1111f9a16f2f1abcfadb41
SSDEEP 12288:ItzE5elwLz9TrNW9qDfG7l4bTtX6lAMGVn3C:ItA4KdTZWgDHV62rVy
TLSH
T1B1A4CE527390D09ADBA141BAD8564786EB703C318B25A3EB372477BB17364C28F3D3A5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
108	powershell.exe

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4144	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4144	cmd.exe
3380	PING.EXE
476	PRIVATE TWEAK UTIL CRACKED BY @butimlarping.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ad3b1fc6af0fc0350000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801ad3b1fc60000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101ad3b1fc6000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3ad3b1fc600000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6ad3b1fc600000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
3380	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
108	powershell.exe
108	powershell.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	108	powershell.exe
Token: SeBackupPrivilege	5032	vssvc.exe
Token: SeRestorePrivilege	5032	vssvc.exe
Token: SeAuditPrivilege	5032	vssvc.exe
Token: SeBackupPrivilege	4552	srtasks.exe
Token: SeRestorePrivilege	4552	srtasks.exe
Token: SeSecurityPrivilege	4552	srtasks.exe
Token: SeTakeOwnershipPrivilege	4552	srtasks.exe
Token: SeBackupPrivilege	4552	srtasks.exe
Token: SeRestorePrivilege	4552	srtasks.exe
Token: SeSecurityPrivilege	4552	srtasks.exe
Token: SeTakeOwnershipPrivilege	4552	srtasks.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 476 wrote to memory of 4144	476	PRIVATE TWEAK UTIL CRACKED BY @butimlarping.exe	90
PID 4144 wrote to memory of 5568	4144	cmd.exe	92
PID 4144 wrote to memory of 296	4144	cmd.exe	93
PID 4144 wrote to memory of 108	4144	cmd.exe	94
PID 4144 wrote to memory of 3380	4144	cmd.exe	102
PID 4144 wrote to memory of 6064	4144	cmd.exe	103

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\PRIVATE TWEAK UTIL CRACKED BY @butimlarping.exe
"C:\Users\Admin\AppData\Local\Temp\PRIVATE TWEAK UTIL CRACKED BY @butimlarping.exe"
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:476
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd" /c "C:\Users\Admin\AppData\Local\Temp\68C2.tmp\68C3.tmp\68C4.bat "C:\Users\Admin\AppData\Local\Temp\PRIVATE TWEAK UTIL CRACKED BY @butimlarping.exe""
  2⤵
  - Executes a command shell one-liner
  - System Network Configuration Discovery: Internet Connection Discovery
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\system32\chcp.com
    chcp 65001
    3⤵
    PID:5568
- - C:\Windows\system32\mode.com
    mode 720,400
    3⤵
    PID:296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -Command "Checkpoint-Computer -Description 'BEFORE [JUICY] TWEAKING UTILITY' -RestorePointType 'MODIFY_SETTINGS'"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:108
- - C:\Windows\system32\PING.EXE
    ping 127.0.0.1 -n 3
    3⤵
    - System Network Configuration Discovery: Internet Connection Discovery
    - Runs ping.exe
    PID:3380
- - C:\Windows\system32\mode.com
    mode con: cols=180 lines=60
    3⤵
    PID:6064

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5032

C:\Windows\system32\srtasks.exe
C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4552

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68C4.bat

Path C:\Users\Admin\AppData\Local\Temp\68C2.tmp\68C3.tmp\68C4.bat
Size 107KB
SHA256 164fcd06b41ecc760eb61a153e3851961978dcf998d0141e440d89b9710ae198
MD5 a000e6c44e8b2e6a5a04642b02ad2846
SHA1 e27dbf681ea097791e91b24a8a95ab135b251cb3
SHA512 2fcae889920aaad9b1935fb966ec9fbcdd24eaed3f01a1aa5f2aa4a20b231e6684eb730dbd69109a07a8cf5103ca22032e5764e62f90e0de893e16d15abd24b1
SSDEEP 768:vL5HDgbQGjq6bH+Z+p2N8u60I8NwHQ7tphDnVtVnDmryUExVGEeyN5/Y5/U5/Jgo:vLxf7tphDVtJDExFw
TLSH
T120B34422752B0372CA86C714B772DD3A9B77BDC361508741B4BE390A13E7805D87B6EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/108-2-0x00007FFA47CFF000-0x00007FFA47D00000-memory.dmp

Download

memory/108-3-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-6-0x000001F8E4450000-0x000001F8E4472000-memory.dmp

Download

memory/108-7-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-8-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-9-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-10-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-11-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-12-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-13-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-14-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-15-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-16-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-17-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-19-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-20-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-21-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download

memory/108-23-0x00007FFA47B70000-0x00007FFA48514000-memory.dmp

Download