Overview

overview

5

Static

static

1

ssusetupg_...dl.exe

windows10-2004-x64

5

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    23/09/2026, 19:09

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    ssusetupg_guru99.com-sysweb_pp_dl.exe
  • Size 7.4MB
  • Sample260923-xt892sae39
  • SHA256 a3637b032ea9f84d429a408db113b0a9d4e1397b35c564712803757963d57bee
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
defense_evasiondiscoveryexecutioninstallerpersistencespywaretrojan

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 5 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in Program Files directory 49 IoCs
  • Executes dropped EXE 34 IoCs
  • Loads dropped DLL 24 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • System Location Discovery: System Language Discovery 1 TTPs 25 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

    Inno Setup installer

    installer
  • Kills process with taskkill 13 IoCs
    defense_evasion
  • Modifies registry class 12 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\ssusetupg_guru99.com-sysweb_pp_dl.exe
    "C:\Users\Admin\AppData\Local\Temp\ssusetupg_guru99.com-sysweb_pp_dl.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\is-QRDSU.tmp\ssusetupg_guru99.com-sysweb_pp_dl.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-QRDSU.tmp\ssusetupg_guru99.com-sysweb_pp_dl.tmp" /SL5="$8007A,6784276,1208320,C:\Users\Admin\AppData\Local\Temp\ssusetupg_guru99.com-sysweb_pp_dl.exe"
      2⤵
      • Checks computer location settings
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:5152
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im SystweakSoftwareUpdater.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:2756
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im SystweakSoftwareUpdater.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5652
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "SSUNotifier.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5016
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im SystweakSoftwareUpdater.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3840
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "SSUNotifier.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:1156
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im SystweakSoftwareUpdater.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:6128
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im SystweakSoftwareUpdater.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5864
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "SSUNotifier.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:3832
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C "taskkill /im SystweakSoftwareUpdater.exe /f /t
        3⤵
        • Executes a command shell one-liner
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4428
        • C:\Windows\SysWOW64\taskkill.exe
          taskkill /im SystweakSoftwareUpdater.exe /f /t
          4⤵
          • System Location Discovery: System Language Discovery
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5764
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im SystweakSoftwareUpdater.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5104
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "SSUNotifier.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5420
      • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
        "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" firstinstall loadvalues
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:5636
      • C:\Program Files (x86)\Systweak Software Updater\SSUNotifier.exe
        "C:\Program Files (x86)\Systweak Software Updater\SSUNotifier.exe" createschedule
        3⤵
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4752
        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:5944
        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:5344
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im SystweakSoftwareUpdater.exe
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:5016
      • C:\Windows\SysWOW64\taskkill.exe
        "C:\Windows\System32\taskkill.exe" /f /im "SSUNotifier.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Kills process with taskkill
        • Suspicious use of AdjustPrivilegeToken
        PID:4296
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /tn "NotifierSystweak Software Updater" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5276
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /tn "NotifierSystweak Software Updater_startup" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3756
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /tn "Systweak Software UpdaterNotifier" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:3288
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /tn "Systweak Software UpdaterNotifier_startup" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:5204
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /delete /tn "Systweak Software UpdaterNotifier_trigger" /f
        3⤵
        • System Location Discovery: System Language Discovery
        PID:4164
      • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
        "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" firstinstall autoscan fireafterinstallsilent
        3⤵
        • Executes dropped EXE
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        PID:5124
      • C:\Program Files (x86)\Systweak Software Updater\SSUNotifier.exe
        "C:\Program Files (x86)\Systweak Software Updater\SSUNotifier.exe" createschedule
        3⤵
        • Checks computer location settings
        • Drops file in Program Files directory
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4364
        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:4676
        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:2108
        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1824
        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:3544
        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
          4⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:936
  • C:\Program Files (x86)\Systweak Software Updater\SSUNotifier.exe
    "C:\Program Files (x86)\Systweak Software Updater\SSUNotifier.exe"
    1⤵
    • Checks computer location settings
    • Drops file in Program Files directory
    • Executes dropped EXE
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3624
    • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
      "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:1156
    • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
      "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4412
    • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
      "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2848
    • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
      "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:3548
    • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
      "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
      2⤵
      • Drops file in Program Files directory
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:5004
    • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
      "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1572
    • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
      "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1748
      • C:\Windows\system32\schtasks.exe
        "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
        3⤵
          PID:3788
      • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
        "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:3288
        • C:\Windows\system32\schtasks.exe
          "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
          3⤵
            PID:2600
          • C:\Windows\system32\schtasks.exe
            "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
            3⤵
              PID:1884
        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe"
          1⤵
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1344
        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe"
          1⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          PID:3068
        • C:\Program Files (x86)\Systweak Software Updater\SSUNotifier.exe
          "C:\Program Files (x86)\Systweak Software Updater\SSUNotifier.exe" startup neweventtrigger
          1⤵
          • Checks computer location settings
          • Drops file in Program Files directory
          • Executes dropped EXE
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3696
          • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
            "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
            2⤵
            • Executes dropped EXE
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:4092
            • C:\Windows\system32\schtasks.exe
              "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
              3⤵
                PID:1240
              • C:\Windows\system32\schtasks.exe
                "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
                3⤵
                  PID:4892
              • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
                "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
                2⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3776
                • C:\Windows\system32\schtasks.exe
                  "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
                  3⤵
                    PID:1156
                  • C:\Windows\system32\schtasks.exe
                    "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
                    3⤵
                      PID:4704
                  • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
                    "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe" loadvalues
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2148
                    • C:\Windows\system32\schtasks.exe
                      "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
                      3⤵
                        PID:4400
                      • C:\Windows\system32\schtasks.exe
                        "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
                        3⤵
                          PID:5708
                    • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
                      "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      • Suspicious use of WriteProcessMemory
                      PID:2388
                      • C:\Windows\SYSTEM32\schtasks.exe
                        "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
                        2⤵
                          PID:5356
                        • C:\Windows\SYSTEM32\schtasks.exe
                          "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
                          2⤵
                            PID:4452
                        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
                          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe"
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3496
                          • C:\Windows\SYSTEM32\schtasks.exe
                            "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
                            2⤵
                              PID:4860
                            • C:\Windows\SYSTEM32\schtasks.exe
                              "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
                              2⤵
                                PID:4348
                            • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
                              "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe"
                              1⤵
                              • Executes dropped EXE
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:2752
                              • C:\Windows\SYSTEM32\schtasks.exe
                                "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
                                2⤵
                                  PID:3984
                                • C:\Windows\SYSTEM32\schtasks.exe
                                  "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
                                  2⤵
                                    PID:1216
                                • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
                                  "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe"
                                  1⤵
                                  • Executes dropped EXE
                                  • Suspicious use of AdjustPrivilegeToken
                                  • Suspicious use of WriteProcessMemory
                                  PID:2216
                                  • C:\Windows\SYSTEM32\schtasks.exe
                                    "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
                                    2⤵
                                      PID:4208
                                    • C:\Windows\SYSTEM32\schtasks.exe
                                      "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
                                      2⤵
                                        PID:5204
                                    • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
                                      "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe"
                                      1⤵
                                      • Executes dropped EXE
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious use of WriteProcessMemory
                                      PID:2848
                                      • C:\Windows\SYSTEM32\schtasks.exe
                                        "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
                                        2⤵
                                          PID:4840
                                        • C:\Windows\SYSTEM32\schtasks.exe
                                          "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
                                          2⤵
                                            PID:5148
                                        • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
                                          "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe"
                                          1⤵
                                          • Executes dropped EXE
                                          • Suspicious use of AdjustPrivilegeToken
                                          • Suspicious use of WriteProcessMemory
                                          PID:5852
                                          • C:\Windows\SYSTEM32\schtasks.exe
                                            "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
                                            2⤵
                                              PID:212
                                            • C:\Windows\SYSTEM32\schtasks.exe
                                              "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
                                              2⤵
                                                PID:3820
                                            • C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
                                              "C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe"
                                              1⤵
                                              • Executes dropped EXE
                                              • Suspicious use of AdjustPrivilegeToken
                                              • Suspicious use of WriteProcessMemory
                                              PID:5676
                                              • C:\Windows\SYSTEM32\schtasks.exe
                                                "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier_startup"
                                                2⤵
                                                  PID:4804
                                                • C:\Windows\SYSTEM32\schtasks.exe
                                                  "schtasks.exe" /query /TN "Systweak Software UpdaterNotifier"
                                                  2⤵
                                                    PID:1132

                                                Network

                                                      MITRE ATT&CK Enterprise v16

                                                      Replay Monitor

                                                      Loading Replay Monitor...

                                                      Downloads

                                                      CommonServiceLocator.dll
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\CommonServiceLocator.dll
                                                      • Size 10KB
                                                      • SHA256 102ec956fc5e3275fdd738bbcbe23dbf7215da8fbb1d7c184190317f583c3507
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Microsoft.Win32.TaskScheduler.dll
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\Microsoft.Win32.TaskScheduler.dll
                                                      • Size 112KB
                                                      • SHA256 e3d4a237487e2dcd925c84559957473692bf04cd59b5f95748594345a047231e
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Newtonsoft.Json.dll
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\Newtonsoft.Json.dll
                                                      • Size 659KB
                                                      • SHA256 3598cccad5b535fea6f93662107a4183bfd6167bf1d0f80260436093edc2e3af
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SQLite.Net.Async.dll
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\SQLite.Net.Async.dll
                                                      • Size 20KB
                                                      • SHA256 b3fc98697920703560b57dc969a43f4ae18648184a56853b9e40d3511ef0d258
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SQLite.Net.Platform.Win32.dll
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\SQLite.Net.Platform.Win32.dll
                                                      • Size 15KB
                                                      • SHA256 365c4c46fbd92d22939004a3e9bbefbd97264672cbc9983449bfaadc34b3ee0f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SQLite.Net.dll
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\SQLite.Net.dll
                                                      • Size 78KB
                                                      • SHA256 b1cc1f903a9714e207969cd2e3820030e638c9f15ffc3cc752e0df2bb0b43d69
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SSUNotifier.exe
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\SSUNotifier.exe
                                                      • Size 631KB
                                                      • SHA256 2619321ab0b825cf9444910fd5c1893d33853cf275e5a82c434f9c1c650ff537
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SSUNotifier_log.txt
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\SSUNotifier_log.txt
                                                      • Size 559B
                                                      • SHA256 b12eb7e81c516374055b99f1ef8d3fc8b27ba096edb50598203cd56770457f25
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      SSUNotifier_log.txt
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\SSUNotifier_log.txt
                                                      • Size 1KB
                                                      • SHA256 a88eb05b5be7372bc745bdc2ede3d1101a9685e1988bbe2b2a8642e12fd4d1dc
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      Serilog.Sinks.File.dll
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\Serilog.Sinks.File.dll
                                                      • Size 25KB
                                                      • SHA256 85ad8530adc1dec3b97f2074c720b81528ba5ea6c7274e1a98a906304bccd12f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      Serilog.dll
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\Serilog.dll
                                                      • Size 117KB
                                                      • SHA256 9c8043c51d644c926329caee82cb11590751024c9478bf2af2a8e3f323f42763
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SystweakSoftwareUpdater.exe
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe
                                                      • Size 4.1MB
                                                      • SHA256 0d836d7d209e15f3001c6224207e17478aa8c4d9d62e85c7b99de2d8ef42474d
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SystweakSoftwareUpdater.exe.config
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\SystweakSoftwareUpdater.exe.config
                                                      • Size 4KB
                                                      • SHA256 100a9e0d39867d9f0f7335e963be6e3ec66d2642554c548a258feafa2fe2a110
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      apps.xml
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\apps.xml
                                                      • Size 2.0MB
                                                      • SHA256 8505835b49ddd0f8452d97aa7782af27ee9183d7374b36b5d71c8d2c57e104e8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      notifier.ini
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\notifier.ini
                                                      • Size 520B
                                                      • SHA256 3207a474ed7106ba10cc5d42f6ed9aa55f6992476c945ecfae1ec235c4fc8704
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      notifierlib.dll
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\notifierlib.dll
                                                      • Size 663KB
                                                      • SHA256 e17c5baff609e5d570d40c4437b2e79b58d83d0d453297c90a5f6cdb3f29b410
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      ssu_en.ini
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\ssu_en.ini
                                                      • Size 62KB
                                                      • SHA256 0f4c7438ef129df3d7b34ae2a21e645e8ad5db99ae76d1823159db35560137b2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      SQLite.Interop.dll
                                                      • Path C:\Program Files (x86)\Systweak Software Updater\x64\SQLite.Interop.dll
                                                      • Size 1.5MB
                                                      • SHA256 10c77e8572bf7967728bc327b609279c46d0f3e0dd260f547592fd50088cabd8
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
                                                      • Size 1KB
                                                      • SHA256 ccc942749e766256b31503706a3209b76a1c1222048327fa19ba50cf881f81ce
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      A1D627669EFC8CD4F21BCF387D97F9B5_D00DE129CCA323044635214D2B93BDC7
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A1D627669EFC8CD4F21BCF387D97F9B5_D00DE129CCA323044635214D2B93BDC7
                                                      • Size 1KB
                                                      • SHA256 dfd13b3d9e4119245afffe6df80a848c62d9e1d4e903fa99c09d049a2575fcea
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9CB4373A4252DE8D2212929836304EC5_6C354C532D063DF5607A63BA827F5164
                                                      • Size 532B
                                                      • SHA256 90bd68520fba232b66668b4874dc9283921177394311472dd8d92468964cb70c
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      A1D627669EFC8CD4F21BCF387D97F9B5_D00DE129CCA323044635214D2B93BDC7
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_D00DE129CCA323044635214D2B93BDC7
                                                      • Size 540B
                                                      • SHA256 0d4f38296ae9cd29fa43620c29195df444d1fe6039ca431b919618c82a1ce292
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      A1D627669EFC8CD4F21BCF387D97F9B5_D00DE129CCA323044635214D2B93BDC7
                                                      • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A1D627669EFC8CD4F21BCF387D97F9B5_D00DE129CCA323044635214D2B93BDC7
                                                      • Size 540B
                                                      • SHA256 f2939fca90db8c940a9cebc22ed5b11a9f51a33d537117249e50c899c1fd2318
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      SystweakSoftwareUpdater.exe.log
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\SystweakSoftwareUpdater.exe.log
                                                      • Size 2KB
                                                      • SHA256 871b826b60dce1c97a6d977381227997d623e6c4e8cab1d5175132c4ccf57340
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      SSUNotifier.exe.log
                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SSUNotifier.exe.log
                                                      • Size 1KB
                                                      • SHA256 55bd45b05184cb1dc5bf10dd64a963b86469762d8da1a81c87e8681600ba6822
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      ssusetupg_guru99.com-sysweb_pp_dl.tmp
                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-QRDSU.tmp\ssusetupg_guru99.com-sysweb_pp_dl.tmp
                                                      • Size 3.3MB
                                                      • SHA256 f383c65b4629b2d8a230875d438fd85846fdfe17007ad473512c663ef22bf02b
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      idp.dll
                                                      • Path C:\Users\Admin\AppData\Local\Temp\is-STCDL.tmp\idp.dll
                                                      • Size 232KB
                                                      • SHA256 54e7e0ad32a22b775131a6288f083ed3286a9a436941377fc20f85dd9ad983ed
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      backup6.bin
                                                      • Path C:\Users\Admin\AppData\Roaming\SYSSU\backup6.bin
                                                      • Size 513B
                                                      • SHA256 3e631ac1c68f39688f85959360288f717c8f409d2422c33a8124dcacf1a42959
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      log-202609.txt
                                                      • Path C:\Users\Admin\AppData\Roaming\Systweak\Systweak Software Updater\Logs\log-202609.txt
                                                      • Size 556B
                                                      • SHA256 db408a9ac0c1505b6227f867c7d017bec08387ad5d6f7c645ab0d174dae74f16
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      log-202609.txt
                                                      • Path C:\Users\Admin\AppData\Roaming\Systweak\Systweak Software Updater\Logs\log-202609.txt
                                                      • Size 1KB
                                                      • SHA256 4133e7be65d7fb24f94ceb03f10e0ff5f82c745c90d642e476bec6d00e83cf1e
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      log-202609.txt
                                                      • Path C:\Users\Admin\AppData\Roaming\Systweak\Systweak Software Updater\Logs\log-202609.txt
                                                      • Size 3KB
                                                      • SHA256 4bbcd96802310081b5ee7270cd4cedb139d07604e325e0ada0669dde3ec2ba12
                                                      • MD5 SHA1 SHA512 TLSH
                                                      Submit Download

                                                      log-202609.txt
                                                      • Path C:\Users\Admin\AppData\Roaming\Systweak\Systweak Software Updater\Logs\log-202609.txt
                                                      • Size 5KB
                                                      • SHA256 5b55d6bf31c738dac3a60efba7d86942b1dcfb1d220a9a99dbad3b0d9f505968
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      log-202609.txt
                                                      • Path C:\Users\Admin\AppData\Roaming\Systweak\Systweak Software Updater\Logs\log-202609.txt
                                                      • Size 7KB
                                                      • SHA256 651521744cafc67993d146945ea27244934f877b3d22385855caf88351c205d2
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      log-202609.txt
                                                      • Path C:\Users\Admin\AppData\Roaming\Systweak\Systweak Software Updater\Logs\log-202609.txt
                                                      • Size 8KB
                                                      • SHA256 6de4058b73ce8c6dcdff105d9d45affc7b7fe3796331c2fba2933d1d411207dd
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      log-202609.txt
                                                      • Path C:\Users\Admin\AppData\Roaming\Systweak\Systweak Software Updater\Logs\log-202609.txt
                                                      • Size 10KB
                                                      • SHA256 66eca1802ce38041a071ee5b555266e3afd5f74a2f7093a7b1617c90fb283af7
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      log-202609.txt
                                                      • Path C:\Users\Admin\AppData\Roaming\Systweak\Systweak Software Updater\Logs\log-202609.txt
                                                      • Size 11KB
                                                      • SHA256 020be71a0730f1985fab9596b68098f8c6c88b1cca76fb6bb5e5aeb930632c1f
                                                      • MD5 SHA1 SHA512 SSDEEP TLSH
                                                      Submit Download

                                                      ntfrUpdate.ini
                                                      • Path C:\Users\Admin\AppData\Roaming\Systweak\Systweak Software Updater\ntfrUpdate.ini
                                                      • Size 20B
                                                      • SHA256 cce80367748928a4cb008228ebd915c32f35d9d5f9a7b781df3f432592a05c08
                                                      • MD5 SHA1 SHA512
                                                      Submit Download

                                                      memory/1344-366-0x00000173AE860000-0x00000173AE882000-memory.dmp
                                                      Download

                                                      memory/1344-367-0x00000173AF4B0000-0x00000173AF4D2000-memory.dmp
                                                      Download

                                                      memory/2688-159-0x0000000000400000-0x0000000000534000-memory.dmp
                                                      Download

                                                      memory/2688-11-0x0000000000400000-0x0000000000534000-memory.dmp
                                                      Download

                                                      memory/2688-0-0x0000000000400000-0x0000000000534000-memory.dmp
                                                      Download

                                                      memory/3624-362-0x0000000008980000-0x00000000089BC000-memory.dmp
                                                      Download

                                                      memory/3624-361-0x0000000008920000-0x0000000008932000-memory.dmp
                                                      Download

                                                      memory/4364-228-0x0000000006DE0000-0x0000000006DEA000-memory.dmp
                                                      Download

                                                      memory/4364-285-0x0000000007900000-0x0000000007922000-memory.dmp
                                                      Download

                                                      memory/4752-132-0x00000000053B0000-0x0000000005458000-memory.dmp
                                                      Download

                                                      memory/4752-136-0x0000000005980000-0x00000000059E6000-memory.dmp
                                                      Download

                                                      memory/4752-128-0x00000000008C0000-0x000000000095E000-memory.dmp
                                                      Download

                                                      memory/4752-133-0x0000000005F30000-0x00000000064D4000-memory.dmp
                                                      Download

                                                      memory/4752-134-0x0000000005850000-0x00000000058E2000-memory.dmp
                                                      Download

                                                      memory/5152-156-0x0000000000400000-0x0000000000756000-memory.dmp
                                                      Download

                                                      memory/5152-5-0x0000000000A30000-0x0000000000A31000-memory.dmp
                                                      Download

                                                      memory/5152-12-0x0000000000400000-0x0000000000756000-memory.dmp
                                                      Download

                                                      memory/5152-13-0x0000000000A30000-0x0000000000A31000-memory.dmp
                                                      Download

                                                      memory/5344-202-0x0000028360570000-0x0000028360578000-memory.dmp
                                                      Download

                                                      memory/5344-191-0x00000283601E0000-0x00000283601EA000-memory.dmp
                                                      Download

                                                      memory/5344-189-0x00000283601D0000-0x00000283601D8000-memory.dmp
                                                      Download

                                                      memory/5344-186-0x000002835F320000-0x000002835F32A000-memory.dmp
                                                      Download

                                                      memory/5344-188-0x00000283601C0000-0x00000283601CC000-memory.dmp
                                                      Download

                                                      memory/5344-185-0x00000283601A0000-0x00000283601BA000-memory.dmp
                                                      Download

                                                      memory/5344-203-0x00000283611B0000-0x00000283611B8000-memory.dmp
                                                      Download

                                                      memory/5344-193-0x0000028360200000-0x0000028360208000-memory.dmp
                                                      Download

                                                      memory/5344-192-0x00000283601F0000-0x00000283601F8000-memory.dmp
                                                      Download

                                                      memory/5344-196-0x0000028360220000-0x0000028360228000-memory.dmp
                                                      Download

                                                      memory/5344-194-0x0000028360210000-0x0000028360218000-memory.dmp
                                                      Download

                                                      memory/5344-195-0x0000028360230000-0x0000028360238000-memory.dmp
                                                      Download

                                                      memory/5344-200-0x0000028360550000-0x0000028360558000-memory.dmp
                                                      Download

                                                      memory/5344-201-0x0000028360560000-0x0000028360568000-memory.dmp
                                                      Download

                                                      memory/5636-115-0x00000179ADF70000-0x00000179ADF94000-memory.dmp
                                                      Download

                                                      memory/5636-117-0x00000179AC780000-0x00000179AC78C000-memory.dmp
                                                      Download

                                                      memory/5636-112-0x00000179C8F10000-0x00000179C9096000-memory.dmp
                                                      Download

                                                      memory/5636-111-0x00000179ABE00000-0x00000179AC21E000-memory.dmp
                                                      Download

                                                      memory/5944-141-0x0000023D522D0000-0x0000023D524A4000-memory.dmp
                                                      Download

                                                      memory/5944-143-0x0000023D361A0000-0x0000023D361A8000-memory.dmp
                                                      Download

                                                      memory/5944-145-0x0000023D52640000-0x0000023D526EA000-memory.dmp
                                                      Download