Overview
overview
6Static
static
3Paragon Tw...er.exe
windows10-2004-x64
4Paragon Tw...er.exe
windows11-ltsc_2024-x64
4$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...al.ini
windows10-2004-x64
1$PLUGINSDI...al.ini
windows11-ltsc_2024-x64
1$PLUGINSDI...rd.bmp
windows10-2004-x64
1$PLUGINSDI...rd.bmp
windows11-ltsc_2024-x64
1$PLUGINSDI...ll.exe
windows10-2004-x64
1$PLUGINSDI...ll.exe
windows11-ltsc_2024-x64
1$PLUGINSDI...up.exe
windows10-2004-x64
6$PLUGINSDI...up.exe
windows11-ltsc_2024-x64
6Paragon Tw...ty.exe
windows10-2004-x64
6Paragon Tw...ty.exe
windows11-ltsc_2024-x64
6appicon.ico
windows10-2004-x64
3appicon.ico
windows11-ltsc_2024-x64
3ptu_ascens...er.exe
windows10-2004-x64
1ptu_ascens...er.exe
windows11-ltsc_2024-x64
1ptu_core.dll
windows10-2004-x64
1ptu_core.dll
windows11-ltsc_2024-x64
1updater/updater.exe
windows10-2004-x64
1updater/updater.exe
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
22/08/2026, 10:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Paragon Tweaking Utility-4.4.2-amd64-installer.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Paragon Tweaking Utility-4.4.2-amd64-installer.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
10 signatures
150 seconds
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral7
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
$PLUGINSDIR/ioSpecial.ini
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral10
Sample
$PLUGINSDIR/modern-wizard.bmp
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral11
Sample
$PLUGINSDIR/ptu-preinstall.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral12
Sample
$PLUGINSDIR/ptu-preinstall.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral13
Sample
$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
18 signatures
150 seconds
Behavioral task
behavioral14
Sample
$PLUGINSDIR/webview2bootstrapper/MicrosoftEdgeWebview2Setup.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
17 signatures
150 seconds
Behavioral task
behavioral15
Sample
Paragon Tweaking Utility.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
21 signatures
150 seconds
Behavioral task
behavioral16
Sample
Paragon Tweaking Utility.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
20 signatures
150 seconds
Behavioral task
behavioral17
Sample
appicon.ico
Resource
win10v2004-20260513-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral18
Sample
appicon.ico
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral19
Sample
ptu_ascension_helper.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
ptu_ascension_helper.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
ptu_core.dll
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral22
Sample
ptu_core.dll
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral23
Sample
updater/updater.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral24
Sample
updater/updater.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target Paragon Tweaking Utility-4.4.2-amd64-installer.exe
- Size 49.3MB
- Sample260822-mx3xbstclc
- SHA256 466b389348694a8376b3408f09ae2fb3f721bff2005ac8e9b6729aa1ba46c765
- MD5 fdd289d96e13fb3c984795048007d417
- SHA1 5c15088a1696200c96276de261accccc376805a3
- SHA512 a4ca7753ab0ba28a61b73d9382d9ce55bf8852e62a7955e26e0ee06f1c9cc921df28c625412ee362f9161b8d44d7aef6dcc2a9f79f5254d434dc0367ab2ed511
- SSDEEP 786432:gWIvKpmX6p0vQa81WFtW+nEyIXmvbmiJl+Yk+odQZ5C1UgIfPsAjIerakIhrxig:gtv2mgRD1XVqllGdPUnnduxD
- TLSH T148B733704FB08788EA546CA829B613EC2F72B94135F4BE2580C6191367F7AE5FDDE016
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 6 IoCs
description ioc Process File created C:\Program Files\Paragon Tweaking Utility\Paragon Tweaking Utility\uninstall.exe Paragon Tweaking Utility-4.4.2-amd64-installer.exe File created C:\Program Files\Paragon Tweaking Utility\Paragon Tweaking Utility\Paragon Tweaking Utility.exe Paragon Tweaking Utility-4.4.2-amd64-installer.exe File created C:\Program Files\Paragon Tweaking Utility\Paragon Tweaking Utility\updater\updater.exe Paragon Tweaking Utility-4.4.2-amd64-installer.exe File created C:\Program Files\Paragon Tweaking Utility\Paragon Tweaking Utility\ptu_core.dll Paragon Tweaking Utility-4.4.2-amd64-installer.exe File created C:\Program Files\Paragon Tweaking Utility\Paragon Tweaking Utility\ptu_ascension_helper.exe Paragon Tweaking Utility-4.4.2-amd64-installer.exe File created C:\Program Files\Paragon Tweaking Utility\Paragon Tweaking Utility\appicon.ico Paragon Tweaking Utility-4.4.2-amd64-installer.exe - Executes dropped EXE 1 IoCs
pid Process 432 ptu-preinstall.exe - Loads dropped DLL 3 IoCs
pid Process 1512 Paragon Tweaking Utility-4.4.2-amd64-installer.exe 1512 Paragon Tweaking Utility-4.4.2-amd64-installer.exe 1512 Paragon Tweaking Utility-4.4.2-amd64-installer.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Paragon Tweaking Utility-4.4.2-amd64-installer.exe - Modifies registry class 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Paragon Tweaking Utility\ = "Paragon Tweaking Utility" Paragon Tweaking Utility-4.4.2-amd64-installer.exe Key created \REGISTRY\MACHINE\Software\Classes\Paragon Tweaking Utility Paragon Tweaking Utility-4.4.2-amd64-installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Paragon Tweaking Utility\ Paragon Tweaking Utility-4.4.2-amd64-installer.exe Key created \REGISTRY\MACHINE\Software\Classes\Paragon Tweaking Utility\shell Paragon Tweaking Utility-4.4.2-amd64-installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Paragon Tweaking Utility\shell\ = "open" Paragon Tweaking Utility-4.4.2-amd64-installer.exe Key created \REGISTRY\MACHINE\Software\Classes\Paragon Tweaking Utility\shell\open Paragon Tweaking Utility-4.4.2-amd64-installer.exe Key created \REGISTRY\MACHINE\Software\Classes\Paragon Tweaking Utility\shell\open\command Paragon Tweaking Utility-4.4.2-amd64-installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Paragon Tweaking Utility\shell\open\command\ = "C:\\Program Files\\Paragon Tweaking Utility\\Paragon Tweaking Utility\\Paragon Tweaking Utility.exe \"%1\"" Paragon Tweaking Utility-4.4.2-amd64-installer.exe Key created \REGISTRY\MACHINE\Software\Classes\.Paragon Tweaking Utility Paragon Tweaking Utility-4.4.2-amd64-installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.Paragon Tweaking Utility\Paragon Tweaking Utility_backup Paragon Tweaking Utility-4.4.2-amd64-installer.exe Key created \REGISTRY\MACHINE\Software\Classes\Paragon Tweaking Utility\DefaultIcon Paragon Tweaking Utility-4.4.2-amd64-installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Paragon Tweaking Utility\DefaultIcon\ = "C:\\Program Files\\Paragon Tweaking Utility\\Paragon Tweaking Utility\\appicon.ico" Paragon Tweaking Utility-4.4.2-amd64-installer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Paragon Tweaking Utility\shell\open\ = "Open with Paragon Tweaking Utility" Paragon Tweaking Utility-4.4.2-amd64-installer.exe - Modifies system certificate store 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E ptu-preinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 6b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd20f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd979625483090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd21400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb1d0000000100000010000000885010358d29a38f059b028559c95f900b00000001000000100000005300650063007400690067006f0000000300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e190000000100000010000000ea6089055218053dd01e37e1d806eedf2000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd ptu-preinstall.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\2B8F1B57330DBBA2D07A6C51F70EE90DDAB9AD8E\Blob = 5c000000010000000400000000100000190000000100000010000000ea6089055218053dd01e37e1d806eedf0300000001000000140000002b8f1b57330dbba2d07a6c51f70ee90ddab9ad8e0b00000001000000100000005300650063007400690067006f0000001d0000000100000010000000885010358d29a38f059b028559c95f901400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb620000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd253000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f000000010000003000000066b764a96581128168cf208e374dda479d54e311f32457f4aee0dbd2a6c8d171d531289e1cd22bfdbbd4cfd9796254836b0000000100000020000000e793c9b02fd8aa13e21c31228accb08119643b749c898964b1746d46c3d4cbd22000000001000000e2050000308205de308203c6a003020102021001fd6d30fca3ca51a81bbc640e35032d300d06092a864886f70d01010c0500308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a3423040301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300d06092a864886f70d01010c050003820201005cd47c0dcff7017d4199650c73c5529fcbf8cf99067f1bda43159f9e0255579614f1523c27879428ed1f3a0137a276fc5350c0849bc66b4eba8c214fa28e556291f36915d8bc88e3c4aa0bfdefa8e94b552a06206d55782919ee5f305c4b241155ff249a6e5e2a2bee0b4d9f7ff70138941495430709fb60a9ee1cab128ca09a5ea7986a596d8b3f08fbc8d145af18156490120f73282ec5e2244efc58ecf0f445fe22b3eb2f8ed2d9456105c1976fa876728f8b8c36afbf0d05ce718de6a66f1f6ca67162c5d8d083720cf16711890c9c134c7234dfbcd571dfaa71dde1b96c8c3c125d65dabd5712b6436bffe5de4d661151cf99aeec17b6e871918cde49fedd3571a21527941ccf61e326bb6fa36725215de6dd1d0b2e681b3b82afec836785d4985174b1b9998089ff7f78195c794a602e9240ae4c372a2cc9c762c80e5df7365bcae0252501b4dd1a079c77003fd0dcd5ec3dd4fabb3fcc85d66f7fa92ddfb902f7f5979ab535dac367b0874aa9289e238eff5c276be1b04ff307ee002ed45987cb524195eaf447d7ee6441557c8d590295dd629dc2b9ee5a287484a59bb790c70c07dff589367432d628c1b0b00be09c4cc31cd6fce369b54746812fa282abd3634470c48dff2d33baad8f7bb57088ae3e19cf4028d8fcc890bb5d9922f552e658c51f883143ee881dd7c68e3c436a1da718de7d3d16f162f9ca90a8fd ptu-preinstall.exe - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 432 ptu-preinstall.exe 432 ptu-preinstall.exe 432 ptu-preinstall.exe 432 ptu-preinstall.exe 432 ptu-preinstall.exe 432 ptu-preinstall.exe 432 ptu-preinstall.exe 432 ptu-preinstall.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 1512 wrote to memory of 432 1512 Paragon Tweaking Utility-4.4.2-amd64-installer.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\Paragon Tweaking Utility-4.4.2-amd64-installer.exe"C:\Users\Admin\AppData\Local\Temp\Paragon Tweaking Utility-4.4.2-amd64-installer.exe"1⤵
- Drops file in Program Files directory
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1512 -
C:\Users\Admin\AppData\Local\Temp\nso5933.tmp\ptu-preinstall.exe"C:\Users\Admin\AppData\Local\Temp\nso5933.tmp\ptu-preinstall.exe" --preinstall-stop --preinstall-self-sha256 "356a88e32835d8555263aba8decd58f16d9bb79f7bc17e016ab921e2d721c12f" --install-dir "C:\Program Files\Paragon Tweaking Utility\Paragon Tweaking Utility"2⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
PID:432
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nso5933.tmp\InstallOptions.dll
- Size 15KB
- SHA256 dd0d1a8c4511261333e90a94d9912000592c46731b615aa7a37cd2b3eb6a8d58
- MD5 7854290f8bc473fb9fad1917b0065731
- SHA1 27c0e4731e395dfe612d954bf8793c533c53ef8f
- SHA512 736030a5e1b744d0f96745f9933a57f5b52361288d33aeeaad12e054c47c4bb705cfc7d5cd4a5e3e667a6c6252e1c2a573b2707241d7b73b60c73daf2de52038
- SSDEEP 192:EJGQtZkTktEQUrJaZfuyCnSmUsv3sY7L7cW8Y6Q86QvoT2g11929WtshLAzgSrX8:EJNt+4t7uJalUnGesY7Lt8nC3/Yosa
- TLSH T1E9624D1137D598B3E2E62A797EF373138FA5FB22A4428E0BC7332E0638565805D78311
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso5933.tmp\System.dll
- Size 12KB
- SHA256 996645d7f16a6294babb6da83478062aed7b72318d7a51b66e90ab5d3edc51a5
- MD5 6d08f0d5503bb100b8429fefaad163a6
- SHA1 2a79aac2d3b715326c3dcd3c5cf2e33de3632a0a
- SHA512 e259b1aff39c533e3e31cf4eb323c8eb22b2beeb5d8ce2c929de30702a6d8ab8076aeacc983d724b05d7d99a6de8c4d239bd159642c7e75fb86faef683360a1f
- SSDEEP 192:cjHcQ0qWTlt7wi5Aj/lM0sEWD/wtYbBjpNQybC7y+XZr0QPi:s/Qlt7wiij/lMRv/9V4brr
- TLSH T1A9427C1297B089F2F151093819667F2A6FBEAC5C23F405A3CFE304C63D212CB9879243
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso5933.tmp\ioSpecial.ini
- Size 1KB
- SHA256 18dc4b0d083c117478e8da9ac215c23897a5f2581d517522a5614fe290301ad4
- MD5 330b263b823672fd729fbb5bf771d20d
- SHA1 1367a9e71134ae165a4806b9e2109bcc3508e5c2
- SHA512 27dee9797af557238e21a5a0e432e5b4f33b8aaca0fe4062c286095b9d4c7edb9f6b719fbec6d740f866959803a561dad96508e879b8c0e54084039b25219497
- TLSH T1832183133EFD5118F2BBBB08EFF8407557397856582DC51EA1D10A0E44E56808923BEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso5933.tmp\ioSpecial.ini
- Size 1KB
- SHA256 dce4d9063ec0b576441b3f5e05d7bb3e1050d3deff02a9cbd8f68e6068ea4e60
- MD5 6d82561bac4fff7a667647aab72f9817
- SHA1 d8d983a57d99fedf5ca9b094820f8df386291c82
- SHA512 18495de3f6de4daf0d99c1efdb519eef05755a7e9c812b56a2067ae614c6f830166563f75d67fd77699c80bd45f38db287d169653736806afcdd3aaf64a7c288
- TLSH T18F2192033DFD5118E2BBBB08EBF4407547397856482DD51EA1D10A4F44E66818923BEF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso5933.tmp\ioSpecial.ini
- Size 1KB
- SHA256 bca7c57d95d7bda6986af7f455a6026c4299bd269794f7848951b2b22c11f7db
- MD5 62160f8da16081d9df20fb38d7d58981
- SHA1 ba7b469351b3f0de04078cfba27dddacbac730f9
- SHA512 a73b7611777b6ee32e53925ba976ae35830f869f7bb5f602744728303bb46a662bd045a5bcf24d67349b5414513f19bf9e23a836e1ea523e2ab388a52aedccd0
- TLSH T17431A1037AFD1518F2FBBB14FFB440B49B3A7C16A83DD91D51C0090E08E6A408963BAB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nso5933.tmp\ptu-preinstall.exe
- Size 6.5MB
- SHA256 356a88e32835d8555263aba8decd58f16d9bb79f7bc17e016ab921e2d721c12f
- MD5 74dcbbfae5d1d8a7efee05e4ee206783
- SHA1 81cba987f73bf4a3f425586147cc2cd08f40e594
- SHA512 e30d82b663ce65be3ac3cfb36e697b1ec1e317d1db378830d950763c2b48d425296448394eabb2324c5c01cd584cbc2bdb8ae1c5f7940425b7275c625865d841
- SSDEEP 49152:uIdnuDEkvyuwT4Qvvqo8m3LT4IypILFS9+zJbNEfW8E35MDrddhKQK1K6CNw0B51:uIhQJYJzXIEOScEob
- TLSH T1F8663807EC6515E8C1AED6308A629653BF617C881B3123D71B90F6293F76BD0AEBD350
- MD5 SHA1 SHA512 SSDEEP TLSH