Overview
overview
8Static
static
3app/ApexTweaks.exe
windows10-2004-x64
8app/ApexTweaks.exe
windows11-ltsc_2024-x64
8app/ApexTweaks.ps1
windows10-2004-x64
3app/ApexTweaks.ps1
windows11-ltsc_2024-x64
3app/Launch...r).bat
windows10-2004-x64
4app/Launch...r).bat
windows11-ltsc_2024-x64
4app/Launch...KS.bat
windows10-2004-x64
4app/Launch...KS.bat
windows11-ltsc_2024-x64
4Analysis
- max time kernel
150s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/10/2026, 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
app/ApexTweaks.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
app/ApexTweaks.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
app/ApexTweaks.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
app/ApexTweaks.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
app/Launch APEX TWEAKS (as administrator).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
app/Launch APEX TWEAKS (as administrator).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
app/Launch APEX TWEAKS.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
app/Launch APEX TWEAKS.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target app/ApexTweaks.exe
- Size 1.8MB
- Sample261030-pfcd6aee73
- SHA256 2bc7646161bc62b8c44e7c9de99d44ddf45eb78294760fc596fe6e89f2f7413d
- MD5 800592c786b3bd7810ef8b6a8c0cd361
- SHA1 acd40f910557f421da5e1bcd35b6b0a4ec1394dd
- SHA512 84fb59aebf20cb68ef026fe7f295a25a0457a5df3087a1475519c06a68fae7ed69fd44c880b1764b0aa6c6c004966797dea38355ee430c3f5c623e3d013ab88e
- SSDEEP 24576:QaehKkVkf//YuQ/HO5RR8Kdn4auMlSPiAGek46zyPkvX:QaMKkKf//BDRRlWaO6
- TLSH T1D4954B47BCE109BAC0AA92318A666292BB71BC590F3263D73E50B33C2F77BD05975744
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 4320 powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4320 powershell.exe 4320 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4320 powershell.exe Token: SeIncreaseQuotaPrivilege 4320 powershell.exe Token: SeSecurityPrivilege 4320 powershell.exe Token: SeTakeOwnershipPrivilege 4320 powershell.exe Token: SeLoadDriverPrivilege 4320 powershell.exe Token: SeSystemProfilePrivilege 4320 powershell.exe Token: SeSystemtimePrivilege 4320 powershell.exe Token: SeProfSingleProcessPrivilege 4320 powershell.exe Token: SeIncBasePriorityPrivilege 4320 powershell.exe Token: SeCreatePagefilePrivilege 4320 powershell.exe Token: SeBackupPrivilege 4320 powershell.exe Token: SeRestorePrivilege 4320 powershell.exe Token: SeShutdownPrivilege 4320 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeSystemEnvironmentPrivilege 4320 powershell.exe Token: SeRemoteShutdownPrivilege 4320 powershell.exe Token: SeUndockPrivilege 4320 powershell.exe Token: SeManageVolumePrivilege 4320 powershell.exe Token: 33 4320 powershell.exe Token: 34 4320 powershell.exe Token: 35 4320 powershell.exe Token: 36 4320 powershell.exe Token: SeIncreaseQuotaPrivilege 4320 powershell.exe Token: SeSecurityPrivilege 4320 powershell.exe Token: SeTakeOwnershipPrivilege 4320 powershell.exe Token: SeLoadDriverPrivilege 4320 powershell.exe Token: SeSystemProfilePrivilege 4320 powershell.exe Token: SeSystemtimePrivilege 4320 powershell.exe Token: SeProfSingleProcessPrivilege 4320 powershell.exe Token: SeIncBasePriorityPrivilege 4320 powershell.exe Token: SeCreatePagefilePrivilege 4320 powershell.exe Token: SeBackupPrivilege 4320 powershell.exe Token: SeRestorePrivilege 4320 powershell.exe Token: SeShutdownPrivilege 4320 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeSystemEnvironmentPrivilege 4320 powershell.exe Token: SeRemoteShutdownPrivilege 4320 powershell.exe Token: SeUndockPrivilege 4320 powershell.exe Token: SeManageVolumePrivilege 4320 powershell.exe Token: 33 4320 powershell.exe Token: 34 4320 powershell.exe Token: 35 4320 powershell.exe Token: 36 4320 powershell.exe Token: SeIncreaseQuotaPrivilege 4320 powershell.exe Token: SeSecurityPrivilege 4320 powershell.exe Token: SeTakeOwnershipPrivilege 4320 powershell.exe Token: SeLoadDriverPrivilege 4320 powershell.exe Token: SeSystemProfilePrivilege 4320 powershell.exe Token: SeSystemtimePrivilege 4320 powershell.exe Token: SeProfSingleProcessPrivilege 4320 powershell.exe Token: SeIncBasePriorityPrivilege 4320 powershell.exe Token: SeCreatePagefilePrivilege 4320 powershell.exe Token: SeBackupPrivilege 4320 powershell.exe Token: SeRestorePrivilege 4320 powershell.exe Token: SeShutdownPrivilege 4320 powershell.exe Token: SeDebugPrivilege 4320 powershell.exe Token: SeSystemEnvironmentPrivilege 4320 powershell.exe Token: SeRemoteShutdownPrivilege 4320 powershell.exe Token: SeUndockPrivilege 4320 powershell.exe Token: SeManageVolumePrivilege 4320 powershell.exe Token: 33 4320 powershell.exe Token: 34 4320 powershell.exe Token: 35 4320 powershell.exe Token: 36 4320 powershell.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 640 wrote to memory of 4320 640 ApexTweaks.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\app\ApexTweaks.exe"C:\Users\Admin\AppData\Local\Temp\app\ApexTweaks.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:640 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exeC:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -NoProfile -NoLogo -ExecutionPolicy Bypass -STA -WindowStyle Hidden -File C:\Users\Admin\AppData\Local\Temp\app\ApexTweaks.ps12⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4320
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2340
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dfh4iy53.5cy.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH