065e6224405f066b5dffcd832496544cddd552a5b836200eda4eecf1da1bc8ad

Analysis

max time kernel
150s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 14:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
JUS Tweaks Utility.exe
Size 180.2MB
Sample260907-r3rhpsyepf
SHA256 065e6224405f066b5dffcd832496544cddd552a5b836200eda4eecf1da1bc8ad
MD5 5bd03337717149e86e61d62ae33d8bb3
SHA1 b7d0973f4a7f8bf8a0de790b0d81c4006e1f65f8
SHA512 539d70078223cd0fad331b92efa7ffa04cd3ff49706a35de46dc381f361ee443ecbb0505cf18967a4be832c147c02c5ab3325d7778c0bc9edcb2628f5bcae519
SSDEEP 1572864:jH0f0gqxb0WBFh/LVO9dyKcRmAswCXj5EtV4ga5h0q2ZOADpAyK5/Y3P8kbVr+qI:Asok+hK7
TLSH
T15D988C03F39A50D9E01DD1B58B9B9633EAB1B8854324A2DF27540B512F77EE86B3DB10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 9 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
1268	powershell.exe
4864	powershell.exe
4752	powershell.exe
5000	powershell.exe
748	powershell.exe
560	powershell.exe
5060	powershell.exe
2304	powershell.exe
4076	powershell.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	JUS Tweaks Utility.exe

Hide Artifacts: Ignore Process Interrupts 1 TTPs 2 IoCs

Command interpreters often include specific commands/flags that ignore errors and other hangups.

defense_evasion

Ignore Process Interrupts

T1564.011

pid	Process
4608	powershell.exe
4076	powershell.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1712	cmd.exe
3772	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	JUS Tweaks Utility.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	JUS Tweaks Utility.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	JUS Tweaks Utility.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	JUS Tweaks Utility.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	JUS Tweaks Utility.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	JUS Tweaks Utility.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	JUS Tweaks Utility.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	JUS Tweaks Utility.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	JUS Tweaks Utility.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	JUS Tweaks Utility.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

pid	Process
748	powershell.exe
748	powershell.exe
4076	powershell.exe
4076	powershell.exe
4864	powershell.exe
4864	powershell.exe
2304	powershell.exe
5060	powershell.exe
5060	powershell.exe
2304	powershell.exe
1268	powershell.exe
1268	powershell.exe
4608	powershell.exe
4608	powershell.exe
560	powershell.exe
560	powershell.exe
560	powershell.exe
4752	powershell.exe
4752	powershell.exe
4076	powershell.exe
4864	powershell.exe
5060	powershell.exe
1268	powershell.exe
4608	powershell.exe
2304	powershell.exe
4752	powershell.exe
5000	powershell.exe
5000	powershell.exe
1448	JUS Tweaks Utility.exe
1448	JUS Tweaks Utility.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2720	JUS Tweaks Utility.exe
Token: SeCreatePagefilePrivilege	2720	JUS Tweaks Utility.exe
Token: SeShutdownPrivilege	2720	JUS Tweaks Utility.exe
Token: SeCreatePagefilePrivilege	2720	JUS Tweaks Utility.exe
Token: SeDebugPrivilege	748	powershell.exe
Token: SeShutdownPrivilege	2720	JUS Tweaks Utility.exe
Token: SeCreatePagefilePrivilege	2720	JUS Tweaks Utility.exe
Token: SeDebugPrivilege	4076	powershell.exe
Token: SeShutdownPrivilege	2720	JUS Tweaks Utility.exe
Token: SeCreatePagefilePrivilege	2720	JUS Tweaks Utility.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	2304	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	1268	powershell.exe
Token: SeDebugPrivilege	4608	powershell.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeShutdownPrivilege	2720	JUS Tweaks Utility.exe
Token: SeCreatePagefilePrivilege	2720	JUS Tweaks Utility.exe
Token: SeDebugPrivilege	4752	powershell.exe
Token: SeShutdownPrivilege	2720	JUS Tweaks Utility.exe
Token: SeCreatePagefilePrivilege	2720	JUS Tweaks Utility.exe
Token: SeShutdownPrivilege	2720	JUS Tweaks Utility.exe
Token: SeCreatePagefilePrivilege	2720	JUS Tweaks Utility.exe
Token: SeShutdownPrivilege	2720	JUS Tweaks Utility.exe
Token: SeCreatePagefilePrivilege	2720	JUS Tweaks Utility.exe
Token: SeIncreaseQuotaPrivilege	560	powershell.exe
Token: SeSecurityPrivilege	560	powershell.exe
Token: SeTakeOwnershipPrivilege	560	powershell.exe
Token: SeLoadDriverPrivilege	560	powershell.exe
Token: SeSystemProfilePrivilege	560	powershell.exe
Token: SeSystemtimePrivilege	560	powershell.exe
Token: SeProfSingleProcessPrivilege	560	powershell.exe
Token: SeIncBasePriorityPrivilege	560	powershell.exe
Token: SeCreatePagefilePrivilege	560	powershell.exe
Token: SeBackupPrivilege	560	powershell.exe
Token: SeRestorePrivilege	560	powershell.exe
Token: SeShutdownPrivilege	560	powershell.exe
Token: SeDebugPrivilege	560	powershell.exe
Token: SeSystemEnvironmentPrivilege	560	powershell.exe
Token: SeRemoteShutdownPrivilege	560	powershell.exe
Token: SeUndockPrivilege	560	powershell.exe
Token: SeManageVolumePrivilege	560	powershell.exe
Token: 33	560	powershell.exe
Token: 34	560	powershell.exe
Token: 35	560	powershell.exe
Token: 36	560	powershell.exe
Token: SeShutdownPrivilege	2720	JUS Tweaks Utility.exe
Token: SeCreatePagefilePrivilege	2720	JUS Tweaks Utility.exe
Token: SeIncreaseQuotaPrivilege	5060	powershell.exe
Token: SeSecurityPrivilege	5060	powershell.exe
Token: SeTakeOwnershipPrivilege	5060	powershell.exe
Token: SeLoadDriverPrivilege	5060	powershell.exe
Token: SeSystemProfilePrivilege	5060	powershell.exe
Token: SeSystemtimePrivilege	5060	powershell.exe
Token: SeProfSingleProcessPrivilege	5060	powershell.exe
Token: SeIncBasePriorityPrivilege	5060	powershell.exe
Token: SeCreatePagefilePrivilege	5060	powershell.exe
Token: SeBackupPrivilege	5060	powershell.exe
Token: SeRestorePrivilege	5060	powershell.exe
Token: SeShutdownPrivilege	5060	powershell.exe
Token: SeDebugPrivilege	5060	powershell.exe
Token: SeSystemEnvironmentPrivilege	5060	powershell.exe
Token: SeRemoteShutdownPrivilege	5060	powershell.exe
Token: SeUndockPrivilege	5060	powershell.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 4276	2720	JUS Tweaks Utility.exe	84
PID 2720 wrote to memory of 4276	2720	JUS Tweaks Utility.exe	84
PID 2720 wrote to memory of 3360	2720	JUS Tweaks Utility.exe	85
PID 2720 wrote to memory of 1592	2720	JUS Tweaks Utility.exe	86
PID 2720 wrote to memory of 1592	2720	JUS Tweaks Utility.exe	86
PID 2720 wrote to memory of 1712	2720	JUS Tweaks Utility.exe	87
PID 1712 wrote to memory of 748	1712	cmd.exe	89
PID 2720 wrote to memory of 4076	2720	JUS Tweaks Utility.exe	90
PID 2720 wrote to memory of 4864	2720	JUS Tweaks Utility.exe	91
PID 2720 wrote to memory of 1268	2720	JUS Tweaks Utility.exe	92
PID 2720 wrote to memory of 5060	2720	JUS Tweaks Utility.exe	93
PID 2720 wrote to memory of 2304	2720	JUS Tweaks Utility.exe	94
PID 2720 wrote to memory of 4608	2720	JUS Tweaks Utility.exe	100
PID 2720 wrote to memory of 560	2720	JUS Tweaks Utility.exe	101
PID 2720 wrote to memory of 3772	2720	JUS Tweaks Utility.exe	104
PID 3772 wrote to memory of 4752	3772	cmd.exe	106
PID 2720 wrote to memory of 5000	2720	JUS Tweaks Utility.exe	108
PID 2720 wrote to memory of 1448	2720	JUS Tweaks Utility.exe	120

C:\Users\Admin\AppData\Local\Temp\JUS Tweaks Utility.exe
"C:\Users\Admin\AppData\Local\Temp\JUS Tweaks Utility.exe"
1⤵
- Checks computer location settings
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\JUS Tweaks Utility.exe
  "C:\Users\Admin\AppData\Local\Temp\JUS Tweaks Utility.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\jus-tweaks-utility" --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=1776,i,11371706743775636279,10111676725744593340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1768 /prefetch:2
  2⤵
  PID:4276
- C:\Users\Admin\AppData\Local\Temp\JUS Tweaks Utility.exe
  "C:\Users\Admin\AppData\Local\Temp\JUS Tweaks Utility.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\jus-tweaks-utility" --field-trial-handle=2280,i,11371706743775636279,10111676725744593340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  PID:3360
- C:\Users\Admin\AppData\Local\Temp\JUS Tweaks Utility.exe
  "C:\Users\Admin\AppData\Local\Temp\JUS Tweaks Utility.exe" --type=renderer --user-data-dir="C:\Users\Admin\AppData\Roaming\jus-tweaks-utility" --app-path="C:\Users\Admin\AppData\Local\Temp\resources\app.asar" --enable-sandbox --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=4 --field-trial-handle=2268,i,11371706743775636279,10111676725744593340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:1
  2⤵
  - Checks computer location settings
  PID:1592
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "[bool]([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1712
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "[bool]([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:748
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command " function Get-State($path,$name){ try { $v=(Get-ItemProperty -Path $path -Name $name -ErrorAction Stop).$name; if($v -and $v.Length -gt 0){ return (($v[0] % 2) -eq 0) } } catch {}; return $true } $items=@() foreach($src in @(@('HKCU:','HKCU'),@('HKLM:','HKLM'))){ $run=\"$($src[0])\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\" $app=\"$($src[0])\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run\" try{ $p=Get-ItemProperty -Path $run -ErrorAction Stop; $p.PSObject.Properties | Where-Object { $_.Name -notmatch '^PS' } | ForEach-Object { $items += [pscustomobject]@{ name=$_.Name; key=$_.Name; cmd=[string]$_.Value; source=$src[1]; enabled=(Get-State $app $_.Name) } } }catch{} } $sf=[Environment]::GetFolderPath('Startup') Get-ChildItem -Path $sf -Filter *.lnk -ErrorAction SilentlyContinue | ForEach-Object { $items += [pscustomobject]@{ name=$_.BaseName; key=$_.Name; cmd=$_.FullName; source='Folder'; enabled=(Get-State 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\StartupFolder' $_.Name) } } if($items.Count -eq 1){ ConvertTo-Json @($items) -Compress } else { $items | ConvertTo-Json -Compress } "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4076
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$out=@{}; foreach($s in 'DiagTrack,dmwappushservice,Fax,RetailDemo,MapsBroker,WerSvc,RemoteRegistry,WMPNetworkSvc,PhoneSvc,WpcMonSvc,SEMgrSvc,lfsvc,SysMain,WSearch,Spooler,XblAuthManager,XblGameSave,XboxNetApiSvc,XboxGipSvc,TabletInputService,BluetoothUserService'.Split(',')){ try{ $svc=Get-Service -Name $s -ErrorAction Stop; $out[$s]=@{ status=[string]$svc.Status; start=[string]$svc.StartType } }catch{ $out[$s]=$null } }; $out | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4864
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command " $r=@{} try{ $cs=Get-CimInstance Win32_ComputerSystem; $r.ramGB=[math]::Round($cs.TotalPhysicalMemory/1GB) $r.laptop = ($cs.PCSystemType -eq 2) }catch{} try{ $cpu=Get-CimInstance Win32_Processor | Select-Object -First 1 $r.cores=[int]$cpu.NumberOfCores; $r.threads=[int]$cpu.NumberOfLogicalProcessors $r.cpuName=[string]$cpu.Name }catch{} try{ $m=Get-CimInstance Win32_PhysicalMemory | Select-Object -First 1 $r.ramSpeed=[int]$m.ConfiguredClockSpeed; $r.ramRated=[int]$m.Speed }catch{} try{ $v=Get-CimInstance Win32_VideoController | Where-Object { $_.CurrentRefreshRate -gt 0 } | Select-Object -First 1 $r.gpuName=[string]$v.Name; $r.refreshCur=[int]$v.CurrentRefreshRate; $r.refreshMax=[int]$v.MaxRefreshRate $r.nvidia = ($v.Name -match 'NVIDIA'); $r.amd = ($v.Name -match 'AMD|Radeon') }catch{} try{ $d=Get-PhysicalDisk | Where-Object { $_.DeviceId -eq 0 } | Select-Object -First 1 $r.ssd = ($d.MediaType -eq 'SSD' -or $d.MediaType -eq 4) }catch{ $r.ssd=$true } try{ $os=Get-CimInstance Win32_OperatingSystem $r.osName=[string]$os.Caption; $r.win11 = ($os.BuildNumber -ge 22000) }catch{} try{ $n=Get-NetAdapter -Physical | Where-Object Status -eq 'Up' | Select-Object -First 1 $r.wifi = ($n.MediaType -match '802.11' -or $n.Name -match 'Wi-Fi|WLAN') }catch{} try{ $d=Get-PSDrive C; $r.diskFreePct=[math]::Round($d.Free/($d.Free+$d.Used)*100) }catch{} $r | ConvertTo-Json -Compress "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1268
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$b=Get-CimInstance Win32_BaseBoard @{ maker=$b.Manufacturer; model=$b.Product } | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5060
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$items = '[{\"id\":\"win_game_mode\",\"path\":\"HKCU:\\Software\\Microsoft\\GameBar\",\"name\":\"AutoGameModeEnabled\"},{\"id\":\"win_gamebar_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\GameDVR\",\"name\":\"AppCaptureEnabled\"},{\"id\":\"win_visualfx\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\VisualEffects\",\"name\":\"VisualFXSetting\"},{\"id\":\"win_transparency_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Themes\\Personalize\",\"name\":\"EnableTransparency\"},{\"id\":\"win_menu_delay\",\"path\":\"HKCU:\\Control Panel\\Desktop\",\"name\":\"MenuShowDelay\"},{\"id\":\"win_startup_delay\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Serialize\",\"name\":\"StartupDelayInMSec\"},{\"id\":\"win_show_ext\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\",\"name\":\"HideFileExt\"},{\"id\":\"mem_background_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\BackgroundAccessApplications\",\"name\":\"GlobalUserDisabled\"},{\"id\":\"net_qos_off\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Psched\",\"name\":\"NonBestEffortLimit\"},{\"id\":\"net_do_off\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization\",\"name\":\"DODownloadMode\"},{\"id\":\"sec_adid_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\AdvertisingInfo\",\"name\":\"Enabled\"},{\"id\":\"sec_activity_off\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\",\"name\":\"PublishUserActivities\"},{\"id\":\"sec_tailored_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Privacy\",\"name\":\"TailoredExperiencesWithDiagnosticDataEnabled\"},{\"id\":\"sec_bingsearch_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Search\",\"name\":\"BingSearchEnabled\"},{\"id\":\"sec_consumer_off\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\CloudContent\",\"name\":\"DisableWindowsConsumerFeatures\"},{\"id\":\"sec_location_off\",\"path\":\"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\location\",\"name\":\"Value\"},{\"id\":\"win_widgets_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\",\"name\":\"TaskbarDa\"},{\"id\":\"win_window_anim_off\",\"path\":\"HKCU:\\Control Panel\\Desktop\\WindowMetrics\",\"name\":\"MinAnimate\"},{\"id\":\"win_taskbar_anim_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\",\"name\":\"TaskbarAnimations\"},{\"id\":\"win_stickykeys_off\",\"path\":\"HKCU:\\Control Panel\\Accessibility\\StickyKeys\",\"name\":\"Flags\"},{\"id\":\"win_aeroshake_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\",\"name\":\"DisallowShaking\"},{\"id\":\"win_show_seconds\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\",\"name\":\"ShowSecondsInSystemClock\"},{\"id\":\"win_show_hidden\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\",\"name\":\"Hidden\"},{\"id\":\"win_snap_flyout_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\",\"name\":\"EnableSnapAssistFlyout\"},{\"id\":\"win_recent_docs_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\",\"name\":\"Start_TrackDocs\"},{\"id\":\"win_autoplay_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\AutoplayHandlers\",\"name\":\"DisableAutoplay\"},{\"id\":\"win_startup_sound_off\",\"path\":\"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Authentication\\LogonUI\\BootAnimation\",\"name\":\"DisableStartupSound\"},{\"id\":\"win_error_reporting_off\",\"path\":\"HKLM:\\SOFTWARE\\Microsoft\\Windows\\Windows Error Reporting\",\"name\":\"Disabled\"},{\"id\":\"win_end_task_taskbar\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced\\TaskbarDeveloperSettings\",\"name\":\"TaskbarEndTask\"},{\"id\":\"win_no_autoreboot\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\\AU\",\"name\":\"NoAutoRebootWithLoggedOnUsers\"},{\"id\":\"sec_cortana_off\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\Windows Search\",\"name\":\"AllowCortana\"},{\"id\":\"sec_start_suggestions_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager\",\"name\":\"SystemPaneSuggestionsEnabled\"},{\"id\":\"sec_soft_landing_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\ContentDeliveryManager\",\"name\":\"SoftLandingEnabled\"},{\"id\":\"sec_cloud_clipboard_off\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\System\",\"name\":\"AllowCrossDeviceClipboard\"},{\"id\":\"sec_app_diag_off\",\"path\":\"HKLM:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\CapabilityAccessManager\\ConsentStore\\appDiagnostics\",\"name\":\"Value\"},{\"id\":\"sec_handwriting_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\TabletPC\",\"name\":\"PreventHandwritingDataSharing\"},{\"id\":\"sec_ceip_off\",\"path\":\"HKLM:\\SOFTWARE\\Microsoft\\SQMClient\\Windows\",\"name\":\"CEIPEnable\"},{\"id\":\"in_hover_time\",\"path\":\"HKCU:\\Control Panel\\Mouse\",\"name\":\"MouseHoverTime\"},{\"id\":\"in_filterkeys_off\",\"path\":\"HKCU:\\Control Panel\\Accessibility\\Keyboard Response\",\"name\":\"Flags\"},{\"id\":\"in_togglekeys_off\",\"path\":\"HKCU:\\Control Panel\\Accessibility\\ToggleKeys\",\"name\":\"Flags\"},{\"id\":\"in_xbox_button_off\",\"path\":\"HKCU:\\Software\\Microsoft\\GameBar\",\"name\":\"UseNexusForGameBarEnabled\"},{\"id\":\"aud_ducking_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Multimedia\\Audio\",\"name\":\"UserDuckingPreference\"},{\"id\":\"dsp_dx_settings\",\"path\":\"HKCU:\\Software\\Microsoft\\DirectX\\UserGpuPreferences\",\"name\":\"DirectXUserGlobalSettings\"},{\"id\":\"dsp_dynamic_lighting_off\",\"path\":\"HKLM:\\SOFTWARE\\Microsoft\\Lighting\",\"name\":\"AmbientLightingEnabled\"},{\"id\":\"str_notifications_off\",\"path\":\"HKCU:\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\PushNotifications\",\"name\":\"ToastEnabled\"},{\"id\":\"str_historical_capture_off\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\GameDVR\",\"name\":\"HistoricalCaptureEnabled\"},{\"id\":\"app_chrome_bg_off\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Google\\Chrome\",\"name\":\"BackgroundModeEnabled\"},{\"id\":\"app_edge_bg_off\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Edge\",\"name\":\"BackgroundModeEnabled\"},{\"id\":\"app_edge_boost_off\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Edge\",\"name\":\"StartupBoostEnabled\"},{\"id\":\"win_no_driver_updates\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\WindowsUpdate\",\"name\":\"ExcludeWUDriversInQualityUpdate\"},{\"id\":\"net_sack\",\"path\":\"HKLM:\\SYSTEM\\CurrentControlSet\\Services\\Tcpip\\Parameters\",\"name\":\"SackOpts\"},{\"id\":\"cpu_no_lowdisk\",\"path\":\"HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\",\"name\":\"NoLowDiskSpaceChecks\"},{\"id\":\"mem_large_cache_off\",\"path\":\"HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Session Manager\\Memory Management\",\"name\":\"LargeSystemCache\"},{\"id\":\"win_tasks_maint\",\"path\":\"HKLM:\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Schedule\\Maintenance\",\"name\":\"MaintenanceDisabled\"},{\"id\":\"win_no_bgapps_store\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\AppPrivacy\",\"name\":\"LetAppsRunInBackground\"},{\"id\":\"win_no_delivery\",\"path\":\"HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows\\DeliveryOptimization\",\"name\":\"DODownloadMode\"},{\"id\":\"in_kbd_delay0\",\"path\":\"HKCU:\\Control Panel\\Keyboard\",\"name\":\"KeyboardDelay\"}]' | ConvertFrom-Json; $out = @{}; foreach($i in $items){ try { $v=(Get-ItemProperty -LiteralPath $i.path -Name $i.name -ErrorAction Stop).$($i.name); $out[$i.id]=\"$v\" } catch { $out[$i.id]='__MISSING__' } }; $out | ConvertTo-Json -Compress"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2304
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "$items = Get-Content -Raw -LiteralPath 'C:\Users\Admin\AppData\Roaming\jus-tweaks-utility\slide_check.json' | ConvertFrom-Json; $out = @{}; foreach($i in $items){ $val = (Get-ItemProperty -LiteralPath $i.p -Name $i.n -ErrorAction SilentlyContinue).$($i.n); $out[$i.id] = (\"$val\" -eq $i.v) }; $out | ConvertTo-Json -Compress"
  2⤵
  - Hide Artifacts: Ignore Process Interrupts
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4608
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command " $ErrorActionPreference='SilentlyContinue' $cpu = Get-CimInstance Win32_Processor | Select-Object -First 1 $os = Get-CimInstance Win32_OperatingSystem $used = $os.TotalVisibleMemorySize - $os.FreePhysicalMemory [pscustomobject]@{ cpuName = $cpu.Name.Trim() cores = $cpu.NumberOfLogicalProcessors load = [int]$cpu.LoadPercentage totalGB = [math]::Round($os.TotalVisibleMemorySize/1MB,1) usedGB = [math]::Round($used/1MB,1) ramPct = [math]::Round($used/$os.TotalVisibleMemorySize*100,0) osName = $os.Caption osBuild = \"$($os.BuildNumber)\" uptime = [int]((Get-Date)-$os.LastBootUpTime).TotalSeconds } | ConvertTo-Json -Compress "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:560
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /d /s /c "powershell -NoProfile -NonInteractive -Command "[bool]([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)""
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -NonInteractive -Command "[bool]([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4752
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -NoProfile -ExecutionPolicy Bypass -Command "(Get-CimInstance Win32_VideoController | Where-Object {$_.AdapterRAM -gt 0} | Select-Object -First 1 -ExpandProperty Name)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Users\Admin\AppData\Local\Temp\JUS Tweaks Utility.exe
  "C:\Users\Admin\AppData\Local\Temp\JUS Tweaks Utility.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\jus-tweaks-utility" --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --field-trial-handle=3488,i,11371706743775636279,10111676725744593340,262144 --disable-features=SpareRendererForSitePerProcess,WinDelaySpellcheckServiceInit,WinRetrieveSuggestionsOnlyOnDemand --variations-seed-version --mojo-platform-channel-handle=1156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Ignore Process Interrupts

T1564.011

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...