Overview
overview
9Static
static
3SecretTweaks.zip
windows10-2004-x64
1SecretTweaks.zip
windows11-ltsc_2024-x64
1SecretTwea...OL.exe
windows10-2004-x64
1SecretTwea...OL.exe
windows11-ltsc_2024-x64
1SecretTwea...ss.dll
windows10-2004-x64
1SecretTwea...ss.dll
windows11-ltsc_2024-x64
1SecretTwea...ss.log
windows10-2004-x64
1SecretTwea...ss.log
windows11-ltsc_2024-x64
1SecretTwea...ER.exe
windows10-2004-x64
4SecretTwea...ER.exe
windows11-ltsc_2024-x64
4SecretTwea...xy.log
windows10-2004-x64
1SecretTwea...xy.log
windows11-ltsc_2024-x64
1SecretTwea...KM.exe
windows10-2004-x64
1SecretTwea...ak.exe
windows10-2004-x64
9SecretTwea...ak.exe
windows11-ltsc_2024-x64
9SecretTwea...de.cfg
windows10-2004-x64
3SecretTwea...de.cfg
windows11-ltsc_2024-x64
3SecretTwea...64.dll
windows10-2004-x64
1SecretTwea...64.dll
windows11-ltsc_2024-x64
1SecretTwea...lp.dll
windows10-2004-x64
1SecretTwea...p.json
windows10-2004-x64
3SecretTwea...p.json
windows11-ltsc_2024-x64
3SecretTwea...de.cfg
windows10-2004-x64
3SecretTwea...de.cfg
windows11-ltsc_2024-x64
3SecretTwea...es.cfg
windows10-2004-x64
3SecretTwea...es.cfg
windows11-ltsc_2024-x64
3SecretTwea...ey.txt
windows10-2004-x64
1SecretTwea...ey.txt
windows11-ltsc_2024-x64
1SecretTwea...rs.cfg
windows10-2004-x64
3SecretTwea...rs.cfg
windows11-ltsc_2024-x64
3SecretTwea...ng.txt
windows10-2004-x64
1SecretTwea...ng.txt
windows11-ltsc_2024-x64
1Analysis
- max time kernel
149s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/10/2026, 22:51
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
SecretTweaks.zip
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
SecretTweaks.zip
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
SecretTweaks/SecretTweak/BYND-TOOL.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
SecretTweaks/SecretTweak/BYND-TOOL.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
2 signatures
150 seconds
Behavioral task
behavioral5
Sample
SecretTweaks/SecretTweak/Bypass.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
SecretTweaks/SecretTweak/Bypass.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
SecretTweaks/SecretTweak/Bypass.log
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral8
Sample
SecretTweaks/SecretTweak/Bypass.log
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral9
Sample
SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral10
Sample
SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral11
Sample
SecretTweaks/SecretTweak/Proxy.log
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral12
Sample
SecretTweaks/SecretTweak/Proxy.log
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral13
Sample
SecretTweaks/SecretTweak/STKM.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral14
Sample
SecretTweaks/SecretTweak/SecretTweak.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
10 signatures
150 seconds
Behavioral task
behavioral15
Sample
SecretTweaks/SecretTweak/SecretTweak.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
9 signatures
150 seconds
Behavioral task
behavioral16
Sample
SecretTweaks/SecretTweak/SecretTweakGameMode.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral17
Sample
SecretTweaks/SecretTweak/SecretTweakGameMode.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral18
Sample
SecretTweaks/SecretTweak/SecureEngineSDK64.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral19
Sample
SecretTweaks/SecretTweak/SecureEngineSDK64.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral20
Sample
SecretTweaks/SecretTweak/dbghelp.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral21
Sample
SecretTweaks/SecretTweak/device_settings_backup.json
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral22
Sample
SecretTweaks/SecretTweak/device_settings_backup.json
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral23
Sample
SecretTweaks/SecretTweak/exit_gamemode.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral24
Sample
SecretTweaks/SecretTweak/exit_gamemode.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral25
Sample
SecretTweaks/SecretTweak/games_priorities.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral26
Sample
SecretTweaks/SecretTweak/games_priorities.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral27
Sample
SecretTweaks/SecretTweak/key.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral28
Sample
SecretTweaks/SecretTweak/key.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral29
Sample
SecretTweaks/SecretTweak/launchers.cfg
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral30
Sample
SecretTweaks/SecretTweak/launchers.cfg
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral31
Sample
SecretTweaks/SecretTweak/logs/logging.txt
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral32
Sample
SecretTweaks/SecretTweak/logs/logging.txt
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
General
- Target SecretTweaks/SecretTweak/DEVICE-TWEAKER.exe
- Size 1.0MB
- Sample261030-2tatpsff95
- SHA256 47dd88032a72ce856522713e3e0ecfe023f133fd43bb7273fdbf48533a309304
- MD5 e83f0a7d6edbfe60a1aaf1211b39c67d
- SHA1 74bdf3ec109440b04d58260c6d4c8f4e41c9167b
- SHA512 0796a79a7eabf7c89024d5a02f9fc41d7ea61ce50455711f0462536211bbf97f0aff64494815020af93042686663cdc4071319ae484910eab5461645a909e9f9
- SSDEEP 12288:M0uXRoDAPnOj43fazF5OMEFepGybspDvlgciDGwaA7Xs/OMjbJS:t46aA7Xs/OMjbJS
- TLSH T18935F83A7DAA9926D2C7203E1CDA94047E2A6037410C4E647DDC92C4EF997BCC7F4B99
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
Malware Config
Signatures
- Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log pnputil.exe File opened for modification C:\Windows\INF\setupapi.dev.log pnputil.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain DEVICE-TWEAKER.exe - Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0003 pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0007 pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80497100-8c73-48b9-aad9-ce387e19c56e}\0006 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0004 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Capabilities pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2} pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002\ pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005\ pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0006\ pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912}\000A pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0007 pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008\ pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\UINumber pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0003 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000C pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0067 pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0005 pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0008 pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000E pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Driver pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0003 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UINumberDescFormat pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A\ pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\CompatibleIDs pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{80497100-8c73-48b9-aad9-ce387e19c56e}\0006 pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6} pnputil.exe Delete value \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0006\ pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Device Parameters pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0006\ pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\000A pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ContainerID pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\000A pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\UINumber pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0007 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\ClassGUID pnputil.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Exclusive pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0004 pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3464f7a4-2444-40b1-980a-e0903cb6d912} pnputil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0003 pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0065 pnputil.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 pnputil.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6} pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0002 pnputil.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{a8b865dd-2e3d-4094-ad97-e593a70c75d6}\0009 pnputil.exe - Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\FeatureSet DEVICE-TWEAKER.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DEVICE-TWEAKER.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Component Information DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Configuration Data DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz DEVICE-TWEAKER.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision DEVICE-TWEAKER.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor DEVICE-TWEAKER.exe Key value enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 DEVICE-TWEAKER.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 4748 DEVICE-TWEAKER.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4748 DEVICE-TWEAKER.exe Token: SeIncreaseQuotaPrivilege 4748 DEVICE-TWEAKER.exe Token: SeSecurityPrivilege 4748 DEVICE-TWEAKER.exe Token: SeTakeOwnershipPrivilege 4748 DEVICE-TWEAKER.exe Token: SeLoadDriverPrivilege 4748 DEVICE-TWEAKER.exe Token: SeSystemProfilePrivilege 4748 DEVICE-TWEAKER.exe Token: SeSystemtimePrivilege 4748 DEVICE-TWEAKER.exe Token: SeProfSingleProcessPrivilege 4748 DEVICE-TWEAKER.exe Token: SeIncBasePriorityPrivilege 4748 DEVICE-TWEAKER.exe Token: SeCreatePagefilePrivilege 4748 DEVICE-TWEAKER.exe Token: SeBackupPrivilege 4748 DEVICE-TWEAKER.exe Token: SeRestorePrivilege 4748 DEVICE-TWEAKER.exe Token: SeShutdownPrivilege 4748 DEVICE-TWEAKER.exe Token: SeDebugPrivilege 4748 DEVICE-TWEAKER.exe Token: SeSystemEnvironmentPrivilege 4748 DEVICE-TWEAKER.exe Token: SeRemoteShutdownPrivilege 4748 DEVICE-TWEAKER.exe Token: SeUndockPrivilege 4748 DEVICE-TWEAKER.exe Token: SeManageVolumePrivilege 4748 DEVICE-TWEAKER.exe Token: 33 4748 DEVICE-TWEAKER.exe Token: 34 4748 DEVICE-TWEAKER.exe Token: 35 4748 DEVICE-TWEAKER.exe Token: 36 4748 DEVICE-TWEAKER.exe Token: SeIncreaseQuotaPrivilege 4748 DEVICE-TWEAKER.exe Token: SeSecurityPrivilege 4748 DEVICE-TWEAKER.exe Token: SeTakeOwnershipPrivilege 4748 DEVICE-TWEAKER.exe Token: SeLoadDriverPrivilege 4748 DEVICE-TWEAKER.exe Token: SeSystemProfilePrivilege 4748 DEVICE-TWEAKER.exe Token: SeSystemtimePrivilege 4748 DEVICE-TWEAKER.exe Token: SeProfSingleProcessPrivilege 4748 DEVICE-TWEAKER.exe Token: SeIncBasePriorityPrivilege 4748 DEVICE-TWEAKER.exe Token: SeCreatePagefilePrivilege 4748 DEVICE-TWEAKER.exe Token: SeBackupPrivilege 4748 DEVICE-TWEAKER.exe Token: SeRestorePrivilege 4748 DEVICE-TWEAKER.exe Token: SeShutdownPrivilege 4748 DEVICE-TWEAKER.exe Token: SeDebugPrivilege 4748 DEVICE-TWEAKER.exe Token: SeSystemEnvironmentPrivilege 4748 DEVICE-TWEAKER.exe Token: SeRemoteShutdownPrivilege 4748 DEVICE-TWEAKER.exe Token: SeUndockPrivilege 4748 DEVICE-TWEAKER.exe Token: SeManageVolumePrivilege 4748 DEVICE-TWEAKER.exe Token: 33 4748 DEVICE-TWEAKER.exe Token: 34 4748 DEVICE-TWEAKER.exe Token: 35 4748 DEVICE-TWEAKER.exe Token: 36 4748 DEVICE-TWEAKER.exe Token: SeIncreaseQuotaPrivilege 4748 DEVICE-TWEAKER.exe Token: SeSecurityPrivilege 4748 DEVICE-TWEAKER.exe Token: SeTakeOwnershipPrivilege 4748 DEVICE-TWEAKER.exe Token: SeLoadDriverPrivilege 4748 DEVICE-TWEAKER.exe Token: SeSystemProfilePrivilege 4748 DEVICE-TWEAKER.exe Token: SeSystemtimePrivilege 4748 DEVICE-TWEAKER.exe Token: SeProfSingleProcessPrivilege 4748 DEVICE-TWEAKER.exe Token: SeIncBasePriorityPrivilege 4748 DEVICE-TWEAKER.exe Token: SeCreatePagefilePrivilege 4748 DEVICE-TWEAKER.exe Token: SeBackupPrivilege 4748 DEVICE-TWEAKER.exe Token: SeRestorePrivilege 4748 DEVICE-TWEAKER.exe Token: SeShutdownPrivilege 4748 DEVICE-TWEAKER.exe Token: SeDebugPrivilege 4748 DEVICE-TWEAKER.exe Token: SeSystemEnvironmentPrivilege 4748 DEVICE-TWEAKER.exe Token: SeRemoteShutdownPrivilege 4748 DEVICE-TWEAKER.exe Token: SeUndockPrivilege 4748 DEVICE-TWEAKER.exe Token: SeManageVolumePrivilege 4748 DEVICE-TWEAKER.exe Token: 33 4748 DEVICE-TWEAKER.exe Token: 34 4748 DEVICE-TWEAKER.exe Token: 35 4748 DEVICE-TWEAKER.exe Token: 36 4748 DEVICE-TWEAKER.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 4748 wrote to memory of 3400 4748 DEVICE-TWEAKER.exe 84 PID 3400 wrote to memory of 2912 3400 csc.exe 86 PID 4748 wrote to memory of 4740 4748 DEVICE-TWEAKER.exe 87 PID 4748 wrote to memory of 5052 4748 DEVICE-TWEAKER.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecretTweaks\SecretTweak\DEVICE-TWEAKER.exe"C:\Users\Admin\AppData\Local\Temp\SecretTweaks\SecretTweak\DEVICE-TWEAKER.exe"1⤵
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bzdo2mas\bzdo2mas.cmdline"2⤵
- Suspicious use of WriteProcessMemory
PID:3400 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFB14.tmp" "c:\Users\Admin\AppData\Local\Temp\bzdo2mas\CSC650D72128371475295BBF7BEE0573287.TMP"3⤵PID:2912
-
-
-
C:\Windows\SYSTEM32\pnputil.exe"pnputil.exe" /remove-device "SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000001"2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:4740
-
-
C:\Windows\SYSTEM32\pnputil.exe"pnputil.exe" /remove-device "SCSI\CDROM&VEN_MSFT&PROD_VIRTUAL_DVD-ROM\2&1F4ADFFE&0&000002"2⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
PID:5052
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\CPMono_v07_Plain.ttf
- Size 25KB
- SHA256 0afe6dfcd891b6d5e9651ea515cd834393f1bd2cde7073f13f064dfb31f70554
- MD5 cec2670064f93d247c30d60ffd375e30
- SHA1 bd4fa7f07e98aa83a4f2d943ec9d9cb3c3d601e6
- SHA512 e501151b114008f7f3c36ef9f84ae5a819203c3cfae3f80041d7d2e9cd17db80146261624ab6f416c7bacb404bab9b841e9e8f6f140d1b0147b14fa9ce806ecc
- SSDEEP 384:zjVc47avA0m2vhEfkG+kctXvPirncq5g9Hw0KpPRtIp8Ji2ZNgUE88n+:FaI0mChAkN1ioqEw0KpPRtIpmi2ZTq+
- TLSH T132B2DF150B77D58DE714CB3081F43B0F7A67B116BE2B9397D24E117D89122918CB8B5B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\RESFB14.tmp
- Size 1KB
- SHA256 deb9bc6ec61cccfb9a2238e5bc85b924ed81504df0f47acc3733641da3890c32
- MD5 bfc9359251f28d167b5ad4d442b38727
- SHA1 5183c9ad6420e17a54bd00b852ade091253899f7
- SHA512 698286ede361615be4232c10e7d03191def1e665e4123c58964f217dcbe33850804435e02ee2b4b42ddf22b4600e484061effa7ad70ba3e6dae3055f12e25a12
- TLSH T104218C0593ED471BF0B35732B9F6077FA234FD64EFA2675A8540422C2C41644EEA1AB2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SecretTweaks\SecretTweak\logs\logging.txt
- Size 96KB
- SHA256 4866eca95171e2e04325af2f8e6d1ddb9a3e5df42b9816d6d717c0154fd31420
- MD5 90e1ffc35ca714a7472813f112e3bb3f
- SHA1 16470765ee3224f0bde5fe8e50babfea5621845f
- SHA512 1ee84e9443c083f2233a58c19e4de5e5330a0ebe0fba0aa24cd9aa7bb01812fb13945086bc804170073d1d89c8d6ce5dfea7ddb7b7351676ec6436b8e62c63b4
- SSDEEP 1536:aYndiaW0nxUdSsPJ1RZ0GkVm3zNsfsjs7zRsSs2skscsQzE6Bt4BMp/F5QouhTAb:niTykQXOZVzLmLpUkPD
- TLSH T136A31F4A249EB13B448F6286A31E7FEA2C1134A2C8671996B7DC67CF378DD057F83446
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1frfrwqh.s0x.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\bzdo2mas\bzdo2mas.dll
- Size 38KB
- SHA256 b18c7bf5150dc5128644891575613e3fce3c0581fee6052a010f3087dc090089
- MD5 e2f022c783f63f85bb679903e13cfc53
- SHA1 e3b41192440aaa6bbb8bf85262c5e40b9a7c5768
- SHA512 d6a297b3169526646acf186cc27e54e39cce207eb52eea882932ab07d292be306150caee9505ee7067fc098398229bf4aba70e4cc068188a9043c4b32002f8f1
- SSDEEP 768:gdvTpNLV5RuMN6wMiDw5HmjWGwXyimQy3VCr/aWW2/WRQHxOd5f1:KN0MnAQrwXty3VCr/LW2/WOHsdl1
- TLSH T12B033C0967AC9376C3AE077AA8B10D660174A3C6A023E76D5E58F09F3F2B7D41405BF6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\bzdo2mas\CSC650D72128371475295BBF7BEE0573287.TMP
- Size 652B
- SHA256 d3b4f8d769f53c5535571abb15de6b4b5b205a7defbe6ca72439d66fe5d000b9
- MD5 98a78b1d02120cf4fed6ec9a08096249
- SHA1 9a4dbdb4b6e895ee81dd812b5d81c3d80594bd9f
- SHA512 1f00ea9da4b4b3e5f0c9caa766b66a1b2b1251f5f6b5588129fc5388b64ea413f5da7e346ad684e3fa8b7ac262b8186313979d1b5f7e5efd898d060f61809daa
- TLSH T102F03A4A63F8020AF0F34B30B9F643B391A8BC64DE7293ED1480431D6C646109962FB2
- MD5 SHA1 SHA512 TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\bzdo2mas\bzdo2mas.0.cs
- Size 65KB
- SHA256 9d356224bfda6427180860dc9a7d4f67f47f00fd7ec463e5d0e149d15e55ee6f
- MD5 2a94e90564511cf59d46821b1bd74409
- SHA1 5d6a9d83326cfc6bfc44917e788773d1443f61f8
- SHA512 bffb2bd797f0f38fbaf3a9b95075e216e1734be3455edc419b6b42d18a94b9505b29c49e2813d97ef9375296ff285b3919d07f96eab4123ad28e2888f7994f38
- SSDEEP 768:irV6JzLLOEVe+L/7vFzMor5am2rK/kVM9B4zmv73RDVygSY4zmvRevZ3RDVygSjo:dOEVdL/LgcVmsOSztL0A4lM4L
- TLSH T1BF63FA411AA349610663603DEFCB4557BA2780130AEEFC2CFE5D83705F4649CE9B9B9E
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\c:\Users\Admin\AppData\Local\Temp\bzdo2mas\bzdo2mas.cmdline
- Size 494B
- SHA256 99f5cc9149ca8b7723ee70d92145ba7b6d9c70575945882385c060ab01e25534
- MD5 27ebd68dea65117e840f97b87a3bf180
- SHA1 eaefe63823ea3aae3eccc14428fbeb7bcec14a89
- SHA512 1f09a7aa79e89366561b386d287f76c958aca65938ad62f0f081c68bfca3d993070c831a042741bf36b07105687f7157d65968ae2ccb86ce244518c20c58297a
- TLSH T1C5F0D439032BCBBD49E92007156FC69CC233876F35C17F9465408C1DE5A30003BD2786
- MD5 SHA1 SHA512 TLSH