1d6d1019d2ee3ccf602791a9fa4889d65ba5852566483c029ebc5f4e0bfb0418

Analysis

max time kernel
599s
max time network
467s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SecretTweak/!loader.exe
Size 421KB
Sample261011-c82taset21
SHA256 1d6d1019d2ee3ccf602791a9fa4889d65ba5852566483c029ebc5f4e0bfb0418
MD5 119c35d23debb20c766cab505438abe7
SHA1 1caa0727edd5ea7cfc60cf3a1b3d53ee52ef55d5
SHA512 279692272c5b8d752d10a667aa56823a9c2a5181fc3caa69c2372fd1bd969bc3248fea2e8123bc8ee44fc4d169e232c9df483332a2ed238447744f431edfaa10
SSDEEP 6144:+dQz/gH4HHb/gWjOMqhhcjyxiVGE1DHldU:+y/uSHb39GcjykV1DFO
TLSH
T108947D03F6B1D0A8D446C0B4970B9B534B63F4891B11A6EF2BE535142FA9BE28F3B354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

defense_evasion execution persistence

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs

defense_evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecretTweak.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	SecretTweak.exe

Checks BIOS information in registry 2 TTPs 4 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecretTweak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecretTweak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	SecretTweak.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	SecretTweak.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 2 IoCs

defense_evasion

Debugger Evasion

T1622

pid	Process
3556	SecretTweak.exe
4052	SecretTweak.exe

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3188	cmd.exe
4804	cmd.exe
4620	cmd.exe
3376	cmd.exe
924	cmd.exe
6084	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5988	schtasks.exe
5560	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3556	SecretTweak.exe
3556	SecretTweak.exe
4052	SecretTweak.exe
4052	SecretTweak.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	SecretTweak.exe
Token: 33	3556	SecretTweak.exe
Token: SeIncBasePriorityPrivilege	3556	SecretTweak.exe
Token: SeDebugPrivilege	4052	SecretTweak.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3556	SecretTweak.exe
3556	SecretTweak.exe
3556	SecretTweak.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
3556	SecretTweak.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 3556	3532	!loader.exe	90
PID 3556 wrote to memory of 4620	3556	SecretTweak.exe	91
PID 4620 wrote to memory of 6036	4620	cmd.exe	93
PID 3556 wrote to memory of 3376	3556	SecretTweak.exe	94
PID 3376 wrote to memory of 5988	3376	cmd.exe	96
PID 3556 wrote to memory of 924	3556	SecretTweak.exe	98
PID 924 wrote to memory of 1096	924	cmd.exe	100
PID 4840 wrote to memory of 4052	4840	!loader.exe	105
PID 4052 wrote to memory of 6084	4052	SecretTweak.exe	107
PID 6084 wrote to memory of 6072	6084	cmd.exe	109
PID 4052 wrote to memory of 3188	4052	SecretTweak.exe	111
PID 3188 wrote to memory of 5560	3188	cmd.exe	113
PID 4052 wrote to memory of 4804	4052	SecretTweak.exe	115
PID 4804 wrote to memory of 2928	4804	cmd.exe	117

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SecretTweak\!loader.exe
"C:\Users\Admin\AppData\Local\Temp\SecretTweak\!loader.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe
  "C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3556
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c w32tm /resync /force >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync /force
      4⤵
      PID:6036
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3376
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5988
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C schtasks /query /tn "SecretTweak" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:924
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /tn "SecretTweak"
      4⤵
      PID:1096

C:\Users\Admin\AppData\Local\Temp\SecretTweak\!loader.exe
C:\Users\Admin\AppData\Local\Temp\SecretTweak\!loader.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe
  "C:\Users\Admin\AppData\Local\Temp\SecretTweak\SecretTweak.exe"
  2⤵
  - Identifies VirtualBox via ACPI registry values (likely anti-VM)
  - Checks BIOS information in registry
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4052
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /c w32tm /resync /force >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:6084
  - - C:\Windows\system32\w32tm.exe
      w32tm /resync /force
      4⤵
      PID:6072
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /xml "C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml" /tn "SecretTweak" /f
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5560
- - C:\Windows\SYSTEM32\cmd.exe
    cmd.exe /C schtasks /query /tn "SecretTweak" >nul 2>&1
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4804
  - - C:\Windows\system32\schtasks.exe
      schtasks /query /tn "SecretTweak"
      4⤵
      PID:2928

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Debugger Evasion

T1622

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Debugger Evasion

T1622

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

SecretTweak_AutoStart.xml

Path C:\Users\Admin\AppData\Local\Temp\SecretTweak_AutoStart.xml
Size 2KB
SHA256 31e1005ff00cc6e5801f767325c0adf83a075bcc975c03bbd357a2a910c349db
MD5 d57dbdbc4416720a40269ef4d5aa3282
SHA1 514c43cf5b0ce134b1fc7e75c9fd9c754a0ea398
SHA512 79b4695e8da12cad1b865141af3acc6ef6b98cca9c883e61fabe9a3aba67f04a4b104876a99cdd620b213627e3376294f8c3a8ab5d4ec9fa66216572a055c5a6
TLSH
T1B6518E5367EE1109F1F7AB9DBAB764428E67BD595C30C86D00EC060D0BB3972C960B3A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3556-4-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3556-15-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3556-3-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3556-0-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3556-5-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3556-6-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3556-7-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/3556-2-0x0000000141A00000-0x0000000141A01000-memory.dmp

Download

memory/3556-1-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/4052-16-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/4052-17-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/4052-19-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/4052-20-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/4052-22-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/4052-21-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/4052-23-0x0000000140000000-0x00000001419D7000-memory.dmp

Download

memory/4052-26-0x0000000140000000-0x00000001419D7000-memory.dmp

Download