Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
27/10/2026, 04:47
General
- Target TrueTweaks.exe
- Size 68.9MB
- Sample261027-feqeysaw4v
- SHA256 8b1fe17108b3adfda82da7caee582246e494e8aa7835700f1e97ae73c9940be8
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 62 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TrueTweaks.exe"C:\Users\Admin\AppData\Local\Temp\TrueTweaks.exe"1⤵
- Loads dropped DLL
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
D3DCompiler_47_cor3.dll
PresentationNative_cor3.dll
wpfgfx_cor3.dll
memory/5984-38-0x000002D5C06A0000-0x000002D5C06C0000-memory.dmp
memory/5984-62-0x000002D5C3FF0000-0x000002D5C4010000-memory.dmp
memory/5984-70-0x000002D5C4330000-0x000002D5C4350000-memory.dmp
memory/5984-50-0x000002D5C3F70000-0x000002D5C3F90000-memory.dmp
memory/5984-85-0x000002D5C44C0000-0x000002D5C44F0000-memory.dmp
memory/5984-89-0x000002D5C4590000-0x000002D5C45D0000-memory.dmp
memory/5984-93-0x000002D5C46F0000-0x000002D5C47B0000-memory.dmp
memory/5984-97-0x000002D584D60000-0x000002D584DF0000-memory.dmp
memory/5984-113-0x000002D584E70000-0x000002D584EC0000-memory.dmp
memory/5984-109-0x000002D5BED20000-0x000002D5BED30000-memory.dmp
memory/5984-105-0x000002D5C4BE0000-0x000002D5C4C00000-memory.dmp
memory/5984-101-0x000002D5C45F0000-0x000002D5C4620000-memory.dmp
memory/5984-81-0x000002D584530000-0x000002D584CD0000-memory.dmp
memory/5984-77-0x000002D5C4470000-0x000002D5C44C0000-memory.dmp
memory/5984-66-0x000002D5C42D0000-0x000002D5C4300000-memory.dmp
memory/5984-22-0x000002D5C06E0000-0x000002D5C0730000-memory.dmp
memory/5984-58-0x000002D5C4060000-0x000002D5C40A0000-memory.dmp
memory/5984-54-0x000002D5C3FD0000-0x000002D5C3FF0000-memory.dmp
memory/5984-46-0x000002D5C2EA0000-0x000002D5C2EC0000-memory.dmp
memory/5984-42-0x000002D5C06C0000-0x000002D5C06D0000-memory.dmp
memory/5984-34-0x000002D5C3EE0000-0x000002D5C3F60000-memory.dmp
memory/5984-6-0x000002D5C1AB0000-0x000002D5C2740000-memory.dmp
memory/5984-30-0x000002D5817A0000-0x000002D581FD0000-memory.dmp
memory/5984-26-0x000002D5C2E60000-0x000002D5C2EA0000-memory.dmp
memory/5984-166-0x000002D586180000-0x000002D586190000-memory.dmp
memory/5984-117-0x000002D584EC0000-0x000002D584EE0000-memory.dmp
memory/5984-125-0x000002D584EE0000-0x000002D584EF0000-memory.dmp
memory/5984-121-0x000002D584FA0000-0x000002D585000000-memory.dmp
memory/5984-130-0x000002D585BD0000-0x000002D585CD0000-memory.dmp
memory/5984-133-0x000002D585F60000-0x000002D586110000-memory.dmp
memory/5984-137-0x000002D586110000-0x000002D586180000-memory.dmp
memory/5984-141-0x000002D586280000-0x000002D586330000-memory.dmp
memory/5984-145-0x000002D586610000-0x000002D586810000-memory.dmp
memory/5984-149-0x000002D586B50000-0x000002D586BA0000-memory.dmp
memory/5984-10-0x000002D580000000-0x000002D580F70000-memory.dmp
memory/5984-18-0x000002D5C2D00000-0x000002D5C2E60000-memory.dmp
memory/5984-158-0x000002D586C10000-0x000002D586C80000-memory.dmp
memory/5984-162-0x000002D586E80000-0x000002D586FE0000-memory.dmp
memory/5984-14-0x000002D5C2AD0000-0x000002D5C2D00000-memory.dmp
memory/5984-170-0x000002D586330000-0x000002D586340000-memory.dmp
memory/5984-174-0x000002D586CF0000-0x000002D586D00000-memory.dmp
memory/5984-180-0x000002D58E120000-0x000002D58E290000-memory.dmp
memory/5984-182-0x000002D58C1C0000-0x000002D58C250000-memory.dmp
memory/5984-194-0x000002D58C3A0000-0x000002D58C3C0000-memory.dmp
memory/5984-190-0x000002D58E350000-0x000002D58E380000-memory.dmp
memory/5984-186-0x000002D58C250000-0x000002D58C270000-memory.dmp