1d6d1019d2ee3ccf602791a9fa4889d65ba5852566483c029ebc5f4e0bfb0418

Analysis

user interaction
yes
max time kernel
598s
max time network
471s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecretTweak/!loader.exe
Size 421KB
Sample261011-c82taset21
SHA256 1d6d1019d2ee3ccf602791a9fa4889d65ba5852566483c029ebc5f4e0bfb0418
MD5 119c35d23debb20c766cab505438abe7
SHA1 1caa0727edd5ea7cfc60cf3a1b3d53ee52ef55d5
SHA512 279692272c5b8d752d10a667aa56823a9c2a5181fc3caa69c2372fd1bd969bc3248fea2e8123bc8ee44fc4d169e232c9df483332a2ed238447744f431edfaa10
SSDEEP 6144:+dQz/gH4HHb/gWjOMqhhcjyxiVGE1DHldU:+y/uSHb39GcjykV1DFO
TLSH
T108947D03F6B1D0A8D446C0B4970B9B534B63F4891B11A6EF2BE535142FA9BE28F3B354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecretTweak.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecretTweak.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecretTweak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecretTweak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecretTweak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecretTweak.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3904	SecretTweak.exe
5448	SecretTweak.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6060	cmd.exe
5672	cmd.exe
2332	cmd.exe
3092	cmd.exe
4532	cmd.exe
3240	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5888	schtasks.exe
5716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3904	SecretTweak.exe
3904	SecretTweak.exe
5448	SecretTweak.exe
5448	SecretTweak.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	3904	SecretTweak.exe
Token: SeDebugPrivilege	5448	SecretTweak.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 3904	1028	!loader.exe	87
PID 3904 wrote to memory of 6060	3904	SecretTweak.exe	98
PID 6060 wrote to memory of 1424	6060	cmd.exe	100
PID 3904 wrote to memory of 5672	3904	SecretTweak.exe	101
PID 5672 wrote to memory of 5888	5672	cmd.exe	104
PID 3904 wrote to memory of 2332	3904	SecretTweak.exe	107
PID 2332 wrote to memory of 5092	2332	cmd.exe	109
PID 3964 wrote to memory of 5448	3964	!loader.exe	112
PID 5448 wrote to memory of 3092	5448	SecretTweak.exe	119
PID 3092 wrote to memory of 1496	3092	cmd.exe	121
PID 5448 wrote to memory of 4532	5448	SecretTweak.exe	122
PID 4532 wrote to memory of 5716	4532	cmd.exe	125
PID 5448 wrote to memory of 3240	5448	SecretTweak.exe	127
PID 3240 wrote to memory of 5644	3240	cmd.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SecretTweak\!loader.exe
"C:\Users\Admin\AppData\Local\Temp\SecretTweak\!loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe
  "C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c w32tm /resync /force >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync /force
      4⤵
      PID:1424
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5672
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5888
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C schtasks /query /tn "SecretTweak" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /tn "SecretTweak"
      4⤵
      PID:5092

C:\Users\Admin\AppData\Local\Temp\SecretTweak\!loader.exe
C:\Users\Admin\AppData\Local\Temp\SecretTweak\!loader.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:3964
- C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe
  "C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5448
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c w32tm /resync /force >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3092
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync /force
      4⤵
      PID:1496
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4532
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5716
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C schtasks /query /tn "SecretTweak" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3240
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /tn "SecretTweak"
      4⤵
      PID:5644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Debugger Evasion

T1622

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecretTweak_AutoStart.xml

Path C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml
Size 2KB
SHA256 6655fe7ef0812d2a9489a4a7a1c2b4dc1c68b35edefc21148c4f015035c72289
MD5 602bab025d08efedb997b6910bef5201
SHA1 94048358f59c65e441610d26bf81b03a0ee140dc
SHA512 c0fb817a8b8f0df6bcd2e5c70d6a8faff035272b59bca4ae10af47c9260646f14507175fbf40ba44c853fe34805fd071b880f747f9e700c573f4cf65e7ce6794
TLSH
T1D65180536BEE1119F1F7AB9CBEB754424EA7BD591C34D86D00AC020D0FB3962C960B3A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3904-14-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3904-0-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3904-3-0x0000000141A00000-0x0000000141A01000-memory.dmp

Download

memory/3904-4-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3904-5-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3904-6-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3904-2-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3904-1-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/5448-18-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/5448-16-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/5448-15-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/5448-19-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/5448-20-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/5448-21-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/5448-24-0x0000000140000000-0x00000001419D7000-memory.dmp

Download