Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/09/2026, 20:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
unknowntweaks_beta_v1.1.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
unknowntweaks_beta_v1.1.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target unknowntweaks_beta_v1.1.exe
- Size 794KB
- Sample260910-y22evawalc
- SHA256 ede9a252b07f8d75a140f2fec0f822770b056a8c9089921bdf6287d0868412c7
- MD5 2d52d603e1de81677c5f0d2eed007787
- SHA1 41360403694aeab9b524881e8d91a6b90cd64e84
- SHA512 d6061d7661f397e8bde171c980ba759255b200b2ec5f108dc8524c636c93e7aeda9455ae65dc3c3d507ad3f235212c77b0fc73d7d07633625af2a5e4f338c9bb
- SSDEEP 12288:0SCG9KaAhpb4NeQrfXP8Zs68ywMAbU2T2iJ9X9OpbMff0J3:h4J8/179CbM85
- TLSH T14605AE37E6E50A37C2B3213A599F5401FF35416B41151D20B9FC828CAFB986D82FAEA5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Power Settings 1 TTPs 1 IoCs
powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.
pid Process 1196 powercfg.exe -
pid Process 5600 powershell.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 5600 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5600 powershell.exe Token: SeIncreaseQuotaPrivilege 5600 powershell.exe Token: SeSecurityPrivilege 5600 powershell.exe Token: SeTakeOwnershipPrivilege 5600 powershell.exe Token: SeLoadDriverPrivilege 5600 powershell.exe Token: SeSystemProfilePrivilege 5600 powershell.exe Token: SeSystemtimePrivilege 5600 powershell.exe Token: SeProfSingleProcessPrivilege 5600 powershell.exe Token: SeIncBasePriorityPrivilege 5600 powershell.exe Token: SeCreatePagefilePrivilege 5600 powershell.exe Token: SeBackupPrivilege 5600 powershell.exe Token: SeRestorePrivilege 5600 powershell.exe Token: SeShutdownPrivilege 5600 powershell.exe Token: SeDebugPrivilege 5600 powershell.exe Token: SeSystemEnvironmentPrivilege 5600 powershell.exe Token: SeRemoteShutdownPrivilege 5600 powershell.exe Token: SeUndockPrivilege 5600 powershell.exe Token: SeManageVolumePrivilege 5600 powershell.exe Token: 33 5600 powershell.exe Token: 34 5600 powershell.exe Token: 35 5600 powershell.exe Token: 36 5600 powershell.exe Token: SeIncreaseQuotaPrivilege 5600 powershell.exe Token: SeSecurityPrivilege 5600 powershell.exe Token: SeTakeOwnershipPrivilege 5600 powershell.exe Token: SeLoadDriverPrivilege 5600 powershell.exe Token: SeSystemProfilePrivilege 5600 powershell.exe Token: SeSystemtimePrivilege 5600 powershell.exe Token: SeProfSingleProcessPrivilege 5600 powershell.exe Token: SeIncBasePriorityPrivilege 5600 powershell.exe Token: SeCreatePagefilePrivilege 5600 powershell.exe Token: SeBackupPrivilege 5600 powershell.exe Token: SeRestorePrivilege 5600 powershell.exe Token: SeShutdownPrivilege 5600 powershell.exe Token: SeDebugPrivilege 5600 powershell.exe Token: SeSystemEnvironmentPrivilege 5600 powershell.exe Token: SeRemoteShutdownPrivilege 5600 powershell.exe Token: SeUndockPrivilege 5600 powershell.exe Token: SeManageVolumePrivilege 5600 powershell.exe Token: 33 5600 powershell.exe Token: 34 5600 powershell.exe Token: 35 5600 powershell.exe Token: 36 5600 powershell.exe Token: SeIncreaseQuotaPrivilege 5600 powershell.exe Token: SeSecurityPrivilege 5600 powershell.exe Token: SeTakeOwnershipPrivilege 5600 powershell.exe Token: SeLoadDriverPrivilege 5600 powershell.exe Token: SeSystemProfilePrivilege 5600 powershell.exe Token: SeSystemtimePrivilege 5600 powershell.exe Token: SeProfSingleProcessPrivilege 5600 powershell.exe Token: SeIncBasePriorityPrivilege 5600 powershell.exe Token: SeCreatePagefilePrivilege 5600 powershell.exe Token: SeBackupPrivilege 5600 powershell.exe Token: SeRestorePrivilege 5600 powershell.exe Token: SeShutdownPrivilege 5600 powershell.exe Token: SeDebugPrivilege 5600 powershell.exe Token: SeSystemEnvironmentPrivilege 5600 powershell.exe Token: SeRemoteShutdownPrivilege 5600 powershell.exe Token: SeUndockPrivilege 5600 powershell.exe Token: SeManageVolumePrivilege 5600 powershell.exe Token: 33 5600 powershell.exe Token: 34 5600 powershell.exe Token: 35 5600 powershell.exe Token: 36 5600 powershell.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe 5600 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1004 wrote to memory of 5600 1004 unknowntweaks_beta_v1.1.exe 89 PID 5600 wrote to memory of 1736 5600 powershell.exe 91 PID 1736 wrote to memory of 2864 1736 csc.exe 93 PID 5600 wrote to memory of 1196 5600 powershell.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\unknowntweaks_beta_v1.1.exe"C:\Users\Admin\AppData\Local\Temp\unknowntweaks_beta_v1.1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1004 -
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -STA -File "C:\Users\Admin\AppData\Local\unknowntweaks\app\unknowntweaks.ps1"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5600 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kajptfsv\kajptfsv.cmdline"3⤵
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES70D1.tmp" "c:\Users\Admin\AppData\Local\Temp\kajptfsv\CSCD11BAA6F3BE4BC48ADB9CBF9A186E4.TMP"4⤵PID:2864
-
-
-
C:\Windows\system32\powercfg.exe"C:\Windows\system32\powercfg.exe" /getactivescheme3⤵
- Power Settings
PID:1196
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\RES70D1.tmp
- Size 1KB
- SHA256 adfd9c6d4a115d8ec908e41ae1dfb8a04dd4801dd8a5b3b1860cf4d67b618a7f
- MD5 ff0059a20fa6ea09ba2440c7924059d1
- SHA1 a3a8f28c8b0d6abe674a91d7184ac1addc1fce1b
- SHA512 d0c606f499f951840121ec3dc46deadc3fa0f74ce89b404a73c6d15afa47972f34d83d439866cc13026a8d9560405e8e57532e2d3cf2c25108290a1ea643670b
- TLSH T1F021CC0693E94B1EF073473269F6032FA675FDA4EFA2A36A4940022C2C51504EEE0F72
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_msk2idgc.n0x.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\kajptfsv\kajptfsv.dll
- Size 25KB
- SHA256 2b100ca8cfc3ae126ca8c8df44c0ed3f21c04e2ab2ab24de7e0ca93208d4a3fb
- MD5 01eeee0f945907b862d1d57c345b9443
- SHA1 9bc08647c984cdc269f4daaf30287602aa05a250
- SHA512 4238d664bc084db8c8f48d8feb056c38609db6b7a1dc7757eefd93d5c78075af68e0ee4efb2fc0a099003bebf4bcc64c1afdcd710e8900814d98812f1659d826
- SSDEEP 768:U32O88TpVwqp9P2p/DRhyX62bRf+lDMyM:UGOLvbcyXV9h5
- TLSH T113C22A06BBCACD61CA6E1E7D64B70B120374E5852633F78B299C50B56ABB3D401D83D7
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\unknowntweaks\app\unknowntweaks.ps1
- Size 488KB
- SHA256 7b33299991637cb4d1ad802fc0bc0d0343dd0aa5aac553f3b4b86f237933ffd2
- MD5 fe1fb1625a06976728bea8f729c25086
- SHA1 545113889b6a49a3a2e38beb1ff5060d638253b6
- SHA512 afcd2070904a3d650685130ae96a1e64a3995cb0a9a4b40ae435c3e9de68d013cc2b3d9b16824c8fd240e69efd49db5447de13ae4e3ebfe2748b017a1d51832b
- SSDEEP 6144:oPlvapST/+9XaPs+N3RmEBU4+kYtwAwdb/Jp+4N6a49veQrfXP87c32aR9zZDMCu:MSCG9KaAhpb4NeQrfXP8ZsQ
- TLSH T1CEB43A37E6A54A3702B32136AD9F5401FF25417B41191D20B5FC828CAFBA46DC3FAEA5
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\kajptfsv\CSCD11BAA6F3BE4BC48ADB9CBF9A186E4.TMP
- Size 652B
- SHA256 7dded2e8d7175d90ccae0145a388d126661091d3c15a5ee8677585dd2a806832
- MD5 e70184d64d0409189d9973ef2632eaef
- SHA1 5468843c2ad06a26599ac7160ee32d852c0a97fb
- SHA512 d2202357d64f9db675643ec77e13d7686027708020030520a528ed5ca39b9b75e0a9e2d4eb5e8a42a5b96700508d2f35f4da87ea269106e0da69b563d12ddffe
- TLSH T179F05E0A67F8021EF4F34B70BEF6436391A8BC64DE3293ED2840031D2864910CA72FB2
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\kajptfsv\kajptfsv.0.cs
- Size 32KB
- SHA256 372cf7b8ba571a51ef80efe3eecf168655117900a267b70b7c6a38e9cc0c91b5
- MD5 86b83e9ff4bd0a1057c4178a0cb07a65
- SHA1 d1e669b57e179598ccbb828036b71b2ff081ad9f
- SHA512 d7b9d2fd156237b5470daf9955d7b7d5cd3dce8aa41db094c97c89041733c7ae0ac1e516b2a9cac79a131fe9d802ff630d8a4b399c95b1bb27bbbc429ca6c710
- SSDEEP 768:NIUCupXW/kW09l1MxMMNMWEwSizAO54ZyJdG6/Tq7SJin+spm:nX39vWUO54Zyp6K
- TLSH T18BE2B70A2253A03A4563702AEB9A9356F72B853337FFEC10B8BD47605F16164D2F4B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\kajptfsv\kajptfsv.cmdline
- Size 369B
- SHA256 3844390a5146d173747ffe2a7faefb2657275ae359b6f9c96b85a3b4331b9bba
- MD5 88bc8fc8ffe1ae83ce2f87c3993cd0e4
- SHA1 ccd8dd811254ee5b80c90260c8689489020f2b08
- SHA512 5279154441e5a0c5c4937fd9928cd5890335f620ce6128727a3730fe50d459e61c23c2c419dbf92ea1ab0333bba2f7af20018b6b658fb68f04c8dcdd15a25bd3
- TLSH T184E0C02F524ECA7D01DF10072569C4ACC27667973D813FDC9145480DF03700037D2769
- MD5 SHA1 SHA512 TLSH