Analysis
- user interaction
yes - max time kernel
149s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
26/08/2026, 00:41
General
- Target 66mods Tweaker.exe
- Size 75.1MB
- Sample260826-a194labc97
- SHA256 b65767ad6e87178e8453d410ab7cb427a40bae509d11dc340a6ef679211c229b
Malware Config
Signatures
- Loads dropped DLL 4 IoCs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Power Settings 1 TTPs 2 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 20 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\66mods Tweaker.exe"C:\Users\Admin\AppData\Local\Temp\66mods Tweaker.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /getactivescheme2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /list2⤵
- Power Settings
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\66mods Tweaker.exe"C:\Users\Admin\AppData\Local\Temp\66mods Tweaker.exe" --optimization-worker 5617560da4c2498780d4870c10366dda2⤵
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
baseline.json
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/3548-352-0x000001A787FB0000-0x000001A787FC0000-memory.dmp
memory/6028-100-0x00000281219C0000-0x0000028121A80000-memory.dmp
memory/6028-84-0x0000028120E20000-0x00000281215C0000-memory.dmp
memory/6028-9-0x0000024088190000-0x00000240890F0000-memory.dmp
memory/6028-29-0x0000024080830000-0x0000024081060000-memory.dmp
memory/6028-53-0x0000024089470000-0x0000024089490000-memory.dmp
memory/6028-49-0x0000024089450000-0x0000024089470000-memory.dmp
memory/6028-41-0x0000024084AB0000-0x0000024084AC0000-memory.dmp
memory/6028-33-0x0000024086B50000-0x0000024086BD0000-memory.dmp
memory/6028-80-0x00000281202C0000-0x0000028120310000-memory.dmp
memory/6028-76-0x00000281201B0000-0x00000281202C0000-memory.dmp
memory/6028-37-0x0000024084C60000-0x0000024084C80000-memory.dmp
memory/6028-69-0x0000024089700000-0x0000024089720000-memory.dmp
memory/6028-65-0x00000240895D0000-0x0000024089600000-memory.dmp
memory/6028-124-0x0000028121B10000-0x0000028121B50000-memory.dmp
memory/6028-57-0x0000024089520000-0x0000024089560000-memory.dmp
memory/6028-128-0x00000240831F0000-0x0000024083200000-memory.dmp
memory/6028-88-0x0000028120010000-0x0000028120040000-memory.dmp
memory/6028-92-0x0000028120430000-0x00000281204C0000-memory.dmp
memory/6028-96-0x0000028120370000-0x00000281203A0000-memory.dmp
memory/6028-5-0x0000024085EC0000-0x0000024086B50000-memory.dmp
memory/6028-108-0x0000028120350000-0x0000028120360000-memory.dmp
memory/6028-116-0x0000028121AF0000-0x0000028121B10000-memory.dmp
memory/6028-17-0x00000240890F0000-0x0000024089250000-memory.dmp
memory/6028-112-0x0000028120610000-0x0000028120660000-memory.dmp
memory/6028-61-0x00000240894B0000-0x00000240894D0000-memory.dmp
memory/6028-120-0x0000028121BB0000-0x0000028121C10000-memory.dmp
memory/6028-104-0x00000281204F0000-0x0000028120510000-memory.dmp
memory/6028-148-0x0000028122750000-0x0000028122760000-memory.dmp
memory/6028-144-0x0000028123560000-0x0000028123660000-memory.dmp
memory/6028-140-0x0000028122760000-0x0000028122780000-memory.dmp
memory/6028-136-0x0000028123270000-0x00000281233E0000-memory.dmp
memory/6028-132-0x0000028122F00000-0x0000028123100000-memory.dmp
memory/6028-45-0x0000024086BD0000-0x0000024086BF0000-memory.dmp
memory/6028-163-0x0000028123660000-0x00000281236B0000-memory.dmp
memory/6028-21-0x0000024084A60000-0x0000024084AB0000-memory.dmp
memory/6028-25-0x0000024084C20000-0x0000024084C60000-memory.dmp
memory/6028-172-0x0000028123720000-0x0000028123790000-memory.dmp
memory/6028-176-0x0000028123990000-0x0000028123AF0000-memory.dmp
memory/6028-180-0x0000028122CD0000-0x0000028122CE0000-memory.dmp
memory/6028-184-0x0000028125C10000-0x0000028125C20000-memory.dmp
memory/6028-202-0x000002812E0E0000-0x000002812E100000-memory.dmp
memory/6028-198-0x000002812DFF0000-0x000002812E020000-memory.dmp
memory/6028-194-0x000002812DFB0000-0x000002812DFF0000-memory.dmp
memory/6028-190-0x000002812DF60000-0x000002812DF90000-memory.dmp
memory/6028-13-0x0000024086E80000-0x00000240870B0000-memory.dmp