Overview
overview
9Static
static
3SecretTweaks.zip
windows10-2004-x64
1SecretTweaks.zip
windows11-ltsc_2024-x64
1SecretTwea...OL.exe
windows10-2004-x64
1SecretTwea...OL.exe
windows11-ltsc_2024-x64
1SecretTwea...ss.dll
windows10-2004-x64
1SecretTwea...ss.dll
windows11-ltsc_2024-x64
1SecretTwea...ss.log
windows10-2004-x64
1SecretTwea...ss.log
windows11-ltsc_2024-x64
1SecretTwea...ER.exe
windows10-2004-x64
4SecretTwea...ER.exe
windows11-ltsc_2024-x64
4SecretTwea...xy.log
windows10-2004-x64
1SecretTwea...xy.log
windows11-ltsc_2024-x64
1SecretTwea...KM.exe
windows10-2004-x64
1SecretTwea...ak.exe
windows10-2004-x64
9SecretTwea...ak.exe
windows11-ltsc_2024-x64
9SecretTwea...de.cfg
windows10-2004-x64
3SecretTwea...de.cfg
windows11-ltsc_2024-x64
3SecretTwea...64.dll
windows10-2004-x64
1SecretTwea...64.dll
windows11-ltsc_2024-x64
1SecretTwea...lp.dll
windows10-2004-x64
1SecretTwea...p.json
windows10-2004-x64
3SecretTwea...p.json
windows11-ltsc_2024-x64
3SecretTwea...de.cfg
windows10-2004-x64
3SecretTwea...de.cfg
windows11-ltsc_2024-x64
3SecretTwea...es.cfg
windows10-2004-x64
3SecretTwea...es.cfg
windows11-ltsc_2024-x64
3SecretTwea...ey.txt
windows10-2004-x64
1SecretTwea...ey.txt
windows11-ltsc_2024-x64
1SecretTwea...rs.cfg
windows10-2004-x64
3SecretTwea...rs.cfg
windows11-ltsc_2024-x64
3SecretTwea...ng.txt
windows10-2004-x64
1SecretTwea...ng.txt
windows11-ltsc_2024-x64
1Analysis
- max time kernel
150s - max time network
131s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/10/2026, 22:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SecretTweaks.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecretTweaks.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SecretTweaks/SecretTweak/BYND-TOOL.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
SecretTweaks/SecretTweak/BYND-TOOL.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
SecretTweaks/SecretTweak/Bypass.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
SecretTweaks/SecretTweak/Bypass.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
SecretTweaks/SecretTweak/Bypass.log
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
SecretTweaks/SecretTweak/Bypass.log
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
SecretTweaks/SecretTweak/Proxy.log
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
SecretTweaks/SecretTweak/Proxy.log
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
SecretTweaks/SecretTweak/STKM.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
SecretTweaks/SecretTweak/SecretTweak.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral15
Sample
SecretTweaks/SecretTweak/SecretTweak.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral16
Sample
SecretTweaks/SecretTweak/SecretTweakGameMode.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
SecretTweaks/SecretTweak/SecretTweakGameMode.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
SecretTweaks/SecretTweak/SecureEngineSDK64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
SecretTweaks/SecretTweak/SecureEngineSDK64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
SecretTweaks/SecretTweak/dbghelp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
SecretTweaks/SecretTweak/device_settings_backup.json
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
SecretTweaks/SecretTweak/device_settings_backup.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
SecretTweaks/SecretTweak/exit_gamemode.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
SecretTweaks/SecretTweak/exit_gamemode.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
SecretTweaks/SecretTweak/games_priorities.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
SecretTweaks/SecretTweak/games_priorities.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
SecretTweaks/SecretTweak/key.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
SecretTweaks/SecretTweak/key.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
SecretTweaks/SecretTweak/launchers.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
SecretTweaks/SecretTweak/launchers.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
SecretTweaks/SecretTweak/logs/logging.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
SecretTweaks/SecretTweak/logs/logging.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe
- Size 1.0MB
- Sample261030-2tatpsff95
- SHA256 47dd88032a72ce856522713e3e0ecfe023f133fd43bb7273fdbf48533a309304
- MD5 e83f0a7d6edbfe60a1aaf1211b39c67d
- SHA1 74bdf3ec109440b04d58260c6d4c8f4e41c9167b
- SHA512 0796a79a7eabf7c89024d5a02f9fc41d7ea61ce50455711f0462536211bbf97f0aff64494815020af93042686663cdc4071319ae484910eab5461645a909e9f9
- SSDEEP 12288:M0uXRoDAPnOj43fazF5OMEFepGybspDvlgciDGwaA7Xs/OMjbJS:t46aA7Xs/OMjbJS
- TLSH T18935F83A7DAA9926D2C7203E1CDA94047E2A6037410C4E647DDC92C4EF997BCC7F4B99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log pnputil.exe File opened for modification C:\Windows\INF\setupapi.dev.log pnputil.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DEVICE-TWEAKER.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Mfg pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2} pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80497100-8c73-48b9-aad9-ce387e19c56e}\0006 pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0003 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Phantom pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\LocationInformation pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceCharacteristics pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\LocationInformation pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0007 pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0003 pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000C pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0006\ pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\DeviceDesc pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2} pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80497100-8c73-48b9-aad9-ce387e19c56e}\0006 pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\ConfigFlags pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009\ pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UINumber pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80497100-8c73-48b9-aad9-ce387e19c56e}\0006 pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0003 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0003 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{80497100-8c73-48b9-aad9-ce387e19c56e} pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000E pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ pnputil.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29} pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000D pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters\Storport pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UINumber pnputil.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6} pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003\ pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ConfigFlags pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0007 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0064 pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0066 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0006\ pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 pnputil.exe - Checks processor information in registry 2 TTPs 25 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Current Record Version DEVICE-TWEAKER.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Record Type DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Meta Data DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Record Version DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Preferred Record Version DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Configuration Used DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Status DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Environment DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Previous Update Revision DEVICE-TWEAKER.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor DEVICE-TWEAKER.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DEVICE-TWEAKER.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Patch Source DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Platform Specific Field 1 DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CPU Family Model Stepping DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Firmware Record Version DEVICE-TWEAKER.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4144 DEVICE-TWEAKER.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4144 DEVICE-TWEAKER.exe Token: SeIncreaseQuotaPrivilege 4144 DEVICE-TWEAKER.exe Token: SeSecurityPrivilege 4144 DEVICE-TWEAKER.exe Token: SeTakeOwnershipPrivilege 4144 DEVICE-TWEAKER.exe Token: SeLoadDriverPrivilege 4144 DEVICE-TWEAKER.exe Token: SeSystemProfilePrivilege 4144 DEVICE-TWEAKER.exe Token: SeSystemtimePrivilege 4144 DEVICE-TWEAKER.exe Token: SeProfSingleProcessPrivilege 4144 DEVICE-TWEAKER.exe Token: SeIncBasePriorityPrivilege 4144 DEVICE-TWEAKER.exe Token: SeCreatePagefilePrivilege 4144 DEVICE-TWEAKER.exe Token: SeBackupPrivilege 4144 DEVICE-TWEAKER.exe Token: SeRestorePrivilege 4144 DEVICE-TWEAKER.exe Token: SeShutdownPrivilege 4144 DEVICE-TWEAKER.exe Token: SeDebugPrivilege 4144 DEVICE-TWEAKER.exe Token: SeSystemEnvironmentPrivilege 4144 DEVICE-TWEAKER.exe Token: SeRemoteShutdownPrivilege 4144 DEVICE-TWEAKER.exe Token: SeUndockPrivilege 4144 DEVICE-TWEAKER.exe Token: SeManageVolumePrivilege 4144 DEVICE-TWEAKER.exe Token: 33 4144 DEVICE-TWEAKER.exe Token: 34 4144 DEVICE-TWEAKER.exe Token: 35 4144 DEVICE-TWEAKER.exe Token: 36 4144 DEVICE-TWEAKER.exe Token: SeIncreaseQuotaPrivilege 4144 DEVICE-TWEAKER.exe Token: SeSecurityPrivilege 4144 DEVICE-TWEAKER.exe Token: SeTakeOwnershipPrivilege 4144 DEVICE-TWEAKER.exe Token: SeLoadDriverPrivilege 4144 DEVICE-TWEAKER.exe Token: SeSystemProfilePrivilege 4144 DEVICE-TWEAKER.exe Token: SeSystemtimePrivilege 4144 DEVICE-TWEAKER.exe Token: SeProfSingleProcessPrivilege 4144 DEVICE-TWEAKER.exe Token: SeIncBasePriorityPrivilege 4144 DEVICE-TWEAKER.exe Token: SeCreatePagefilePrivilege 4144 DEVICE-TWEAKER.exe Token: SeBackupPrivilege 4144 DEVICE-TWEAKER.exe Token: SeRestorePrivilege 4144 DEVICE-TWEAKER.exe Token: SeShutdownPrivilege 4144 DEVICE-TWEAKER.exe Token: SeDebugPrivilege 4144 DEVICE-TWEAKER.exe Token: SeSystemEnvironmentPrivilege 4144 DEVICE-TWEAKER.exe Token: SeRemoteShutdownPrivilege 4144 DEVICE-TWEAKER.exe Token: SeUndockPrivilege 4144 DEVICE-TWEAKER.exe Token: SeManageVolumePrivilege 4144 DEVICE-TWEAKER.exe Token: 33 4144 DEVICE-TWEAKER.exe Token: 34 4144 DEVICE-TWEAKER.exe Token: 35 4144 DEVICE-TWEAKER.exe Token: 36 4144 DEVICE-TWEAKER.exe Token: SeIncreaseQuotaPrivilege 4144 DEVICE-TWEAKER.exe Token: SeSecurityPrivilege 4144 DEVICE-TWEAKER.exe Token: SeTakeOwnershipPrivilege 4144 DEVICE-TWEAKER.exe Token: SeLoadDriverPrivilege 4144 DEVICE-TWEAKER.exe Token: SeSystemProfilePrivilege 4144 DEVICE-TWEAKER.exe Token: SeSystemtimePrivilege 4144 DEVICE-TWEAKER.exe Token: SeProfSingleProcessPrivilege 4144 DEVICE-TWEAKER.exe Token: SeIncBasePriorityPrivilege 4144 DEVICE-TWEAKER.exe Token: SeCreatePagefilePrivilege 4144 DEVICE-TWEAKER.exe Token: SeBackupPrivilege 4144 DEVICE-TWEAKER.exe Token: SeRestorePrivilege 4144 DEVICE-TWEAKER.exe Token: SeShutdownPrivilege 4144 DEVICE-TWEAKER.exe Token: SeDebugPrivilege 4144 DEVICE-TWEAKER.exe Token: SeSystemEnvironmentPrivilege 4144 DEVICE-TWEAKER.exe Token: SeRemoteShutdownPrivilege 4144 DEVICE-TWEAKER.exe Token: SeUndockPrivilege 4144 DEVICE-TWEAKER.exe Token: SeManageVolumePrivilege 4144 DEVICE-TWEAKER.exe Token: 33 4144 DEVICE-TWEAKER.exe Token: 34 4144 DEVICE-TWEAKER.exe Token: 35 4144 DEVICE-TWEAKER.exe Token: 36 4144 DEVICE-TWEAKER.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4144 wrote to memory of 1228 4144 DEVICE-TWEAKER.exe 90 PID 4144 wrote to memory of 1176 4144 DEVICE-TWEAKER.exe 91 PID 4144 wrote to memory of 4816 4144 DEVICE-TWEAKER.exe 94 PID 4816 wrote to memory of 4648 4816 csc.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecretTweaks\SecretTweak\DEVICE-TWEAKER.exe"C:\Users\Admin\AppData\Local\Temp\SecretTweaks\SecretTweak\DEVICE-TWEAKER.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Windows\SYSTEM32\pnputil.exe"pnputil.exe" /remove-device "SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001"2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1228
-
-
C:\Windows\SYSTEM32\pnputil.exe"pnputil.exe" /remove-device "SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002"2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:1176
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zns4uxnt\zns4uxnt.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:4816 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1BA7.tmp" "c:\Users\Admin\AppData\Local\Temp\zns4uxnt\CSC128DE75440234A12BC70236DD55485E3.TMP"3⤵PID:4648
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\CPMono_v07_Plain.ttf
- Size 25KB
- SHA256 0afe6dfcd891b6d5e9651ea515cd834393f1bd2cde7073f13f064dfb31f70554
- MD5 cec2670064f93d247c30d60ffd375e30
- SHA1 bd4fa7f07e98aa83a4f2d943ec9d9cb3c3d601e6
- SHA512 e501151b114008f7f3c36ef9f84ae5a819203c3cfae3f80041d7d2e9cd17db80146261624ab6f416c7bacb404bab9b841e9e8f6f140d1b0147b14fa9ce806ecc
- SSDEEP 384:zjVc47avA0m2vhEfkG+kctXvPirncq5g9Hw0KpPRtIp8Ji2ZNgUE88n+:FaI0mChAkN1ioqEw0KpPRtIpmi2ZTq+
- TLSH T132B2DF150B77D58DE714CB3081F43B0F7A67B116BE2B9397D24E117D89122918CB8B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RES1BA7.tmp
- Size 1KB
- SHA256 b2e17567bf00ff5220c12d2a8af95fea73c83ace81f12b87129a422b564b2200
- MD5 62bead33de66fce3d5fbe05054169716
- SHA1 2dc1e987869fc3493a2920c11e095013e17f3bf5
- SHA512 3766955378612ed3c4ef501bc133ac4ac361df4ec8c4fd4689fa44e3d410b6dbf0a20a8a004393a26ca7000dc52ac930988b5556ce1eafe117da43030c3fc927
- TLSH T15121C00593EA4B0FF0735B31B9FA035FA279FD54EFA1976A8440422C2C02104EEA1B72
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SecretTweaks\SecretTweak\logs\logging.txt
- Size 96KB
- SHA256 d925a9aa6ca72a2f1a20b2792387d4fb02bbbbef17784182eaf37cc976ac8665
- MD5 40e05b8fc71b87bba8ea39a9daf946ce
- SHA1 5f3cebf728c35767d93eb09ba59fcfbeb9a9e472
- SHA512 0371c23a074ced5c6180f00ba4c5ddd64482a33e91667c787fc1faeebcaedfc5493e8a103870cbc187ce401fae18d38dc76739b685ba400be69218c85a633984
- SSDEEP 1536:aYndiaW0nxUdSsPJ1RZ0GkVm3zNsfsjs7zRsSs2skscsQzE6Bt4BMp/F5QouhTAU:niTykQXOZVzLmLpUkP8
- TLSH T19CA3314A249EA53B448B938A931E7FEA6C1134A3C8675992B3CC67CF378DD057F83452
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wkfcqhit.xaa.psm1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\zns4uxnt\zns4uxnt.dll
- Size 38KB
- SHA256 3509086298931376d5d4e4de3d38076e0b7a6ed9c4d95bd6eb4fd9e56504ca0c
- MD5 839f5272895c0a5a91acc20ff6d32170
- SHA1 8d6f7982cf8e43ad8e5762a1b8fa8e2a7d59513d
- SHA512 4d87221d35b5a7e8270aa8f78dd32c5f9973f4b925cccbe2bbe493dfdd4254cc2f2e85dd8da2bc7fd73ed3845caa8165e4e522c3a58ef7b24135ddb5233d564b
- SSDEEP 768:qdvTpNLV5RuMN6wMiDw5HmjWGwXyimQ2VCr/aWW2/WRQHROdDfv:oN0MnAQrwXt2VCr/LW2/WOHMdDv
- TLSH T195033C0977AC9376C3AE077AA8B10D660174A3C6A023E76D5A58F09F3F2B7D41405BF6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\zns4uxnt\CSC128DE75440234A12BC70236DD55485E3.TMP
- Size 652B
- SHA256 b587b860c24697d3f82125bed502cfd386159a6c042e76c5b2d5a62d9c5316e6
- MD5 c3774923a0513c1f11f5c28cd68afdec
- SHA1 d7a780fd8a10d7b87740a7980794a0b955bf323d
- SHA512 89529ebde956ee40345e887a59a5e8ea7afffa696210e6000c752fac3cd98f55c863b519bf01f0e246553693301037d6de9d2485af5b6ce281e029a24bc03e3c
- TLSH T135F03A0963F8020AF0F34B30B9F6836391ADBC65DE7293ED1450031D6865910C962FB2
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\zns4uxnt\zns4uxnt.0.cs
- Size 65KB
- SHA256 9d356224bfda6427180860dc9a7d4f67f47f00fd7ec463e5d0e149d15e55ee6f
- MD5 2a94e90564511cf59d46821b1bd74409
- SHA1 5d6a9d83326cfc6bfc44917e788773d1443f61f8
- SHA512 bffb2bd797f0f38fbaf3a9b95075e216e1734be3455edc419b6b42d18a94b9505b29c49e2813d97ef9375296ff285b3919d07f96eab4123ad28e2888f7994f38
- SSDEEP 768:irV6JzLLOEVe+L/7vFzMor5am2rK/kVM9B4zmv73RDVygSY4zmvRevZ3RDVygSjo:dOEVdL/LgcVmsOSztL0A4lM4L
- TLSH T1BF63FA411AA349610663603DEFCB4557BA2780130AEEFC2CFE5D83705F4649CE9B9B9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\zns4uxnt\zns4uxnt.cmdline
- Size 494B
- SHA256 08f8793f9a40925284c5262992f42f52b316d5274e20d8d0ea7876505af37eeb
- MD5 0e92d79a19e1d363ddf08242a37c2259
- SHA1 2915abe7b3a26af9200839c3dddf064a1374a398
- SHA512 0f7545b3674088c0f5679249ddb092b56b27d52c4fecbc701975275345e5dd4e9134825f7abaade4fdd281ff6fc8b979959ec977f47f940aa953e724c67b5ae3
- TLSH T1CFF09E3A022BC97945EA280B195EC6ECD2338B573441BF546941C85DE4331111BD2781
- MD5 SHA1 SHA512 TLSH