Overview
overview
8Static
static
3app/ApexTweaks.exe
windows10-2004-x64
8app/ApexTweaks.exe
windows11-ltsc_2024-x64
8app/ApexTweaks.ps1
windows10-2004-x64
3app/ApexTweaks.ps1
windows11-ltsc_2024-x64
3app/Launch...r).bat
windows10-2004-x64
4app/Launch...r).bat
windows11-ltsc_2024-x64
4app/Launch...KS.bat
windows10-2004-x64
4app/Launch...KS.bat
windows11-ltsc_2024-x64
4Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
30/10/2026, 12:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
app/ApexTweaks.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
app/ApexTweaks.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
Behavioral task
behavioral3
Sample
app/ApexTweaks.ps1
Resource
win10v2004-20260911-en
windows10-2004-x64
3 signatures
150 seconds
Behavioral task
behavioral4
Sample
app/ApexTweaks.ps1
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
3 signatures
150 seconds
Behavioral task
behavioral5
Sample
app/Launch APEX TWEAKS (as administrator).bat
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral6
Sample
app/Launch APEX TWEAKS (as administrator).bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
Behavioral task
behavioral7
Sample
app/Launch APEX TWEAKS.bat
Resource
win10v2004-20260911-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral8
Sample
app/Launch APEX TWEAKS.bat
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target app/ApexTweaks.ps1
- Size 542KB
- Sample261030-pfcd6aee73
- SHA256 1ff4e71cd67498036380439852ab8b4d5b0a47a336281e53d7c6420221911338
- MD5 3fc4b39f4885499b59031d071c0d2be1
- SHA1 ef4acd73e3e6fab7bfdc7c196e7b7b62d679721c
- SHA512 229bf0bdb1c1beccd6c165e156e9419a8e56d5a8f2b175f159b3bdafb1a8793388bbabb8b3ccadde284c321126c0f0ec6b2a54a95e1d3f3df243e243ebc35de5
- SSDEEP 6144:C65lO//brvMjYzF6KUxiA92A5RjEcdUvSZRrA9zF2:CQAMIuiwH7
- TLSH T1C1C4F82ABDA492314B87D07A5D9EA804FB35006F521D4D24B6ED82C46F90B78C2FEFD5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
-
pid Process 5076 powershell.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5076 powershell.exe 5076 powershell.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5076 powershell.exe Token: SeIncreaseQuotaPrivilege 5076 powershell.exe Token: SeSecurityPrivilege 5076 powershell.exe Token: SeTakeOwnershipPrivilege 5076 powershell.exe Token: SeLoadDriverPrivilege 5076 powershell.exe Token: SeSystemProfilePrivilege 5076 powershell.exe Token: SeSystemtimePrivilege 5076 powershell.exe Token: SeProfSingleProcessPrivilege 5076 powershell.exe Token: SeIncBasePriorityPrivilege 5076 powershell.exe Token: SeCreatePagefilePrivilege 5076 powershell.exe Token: SeBackupPrivilege 5076 powershell.exe Token: SeRestorePrivilege 5076 powershell.exe Token: SeShutdownPrivilege 5076 powershell.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeSystemEnvironmentPrivilege 5076 powershell.exe Token: SeRemoteShutdownPrivilege 5076 powershell.exe Token: SeUndockPrivilege 5076 powershell.exe Token: SeManageVolumePrivilege 5076 powershell.exe Token: 33 5076 powershell.exe Token: 34 5076 powershell.exe Token: 35 5076 powershell.exe Token: 36 5076 powershell.exe Token: SeIncreaseQuotaPrivilege 5076 powershell.exe Token: SeSecurityPrivilege 5076 powershell.exe Token: SeTakeOwnershipPrivilege 5076 powershell.exe Token: SeLoadDriverPrivilege 5076 powershell.exe Token: SeSystemProfilePrivilege 5076 powershell.exe Token: SeSystemtimePrivilege 5076 powershell.exe Token: SeProfSingleProcessPrivilege 5076 powershell.exe Token: SeIncBasePriorityPrivilege 5076 powershell.exe Token: SeCreatePagefilePrivilege 5076 powershell.exe Token: SeBackupPrivilege 5076 powershell.exe Token: SeRestorePrivilege 5076 powershell.exe Token: SeShutdownPrivilege 5076 powershell.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeSystemEnvironmentPrivilege 5076 powershell.exe Token: SeRemoteShutdownPrivilege 5076 powershell.exe Token: SeUndockPrivilege 5076 powershell.exe Token: SeManageVolumePrivilege 5076 powershell.exe Token: 33 5076 powershell.exe Token: 34 5076 powershell.exe Token: 35 5076 powershell.exe Token: 36 5076 powershell.exe Token: SeIncreaseQuotaPrivilege 5076 powershell.exe Token: SeSecurityPrivilege 5076 powershell.exe Token: SeTakeOwnershipPrivilege 5076 powershell.exe Token: SeLoadDriverPrivilege 5076 powershell.exe Token: SeSystemProfilePrivilege 5076 powershell.exe Token: SeSystemtimePrivilege 5076 powershell.exe Token: SeProfSingleProcessPrivilege 5076 powershell.exe Token: SeIncBasePriorityPrivilege 5076 powershell.exe Token: SeCreatePagefilePrivilege 5076 powershell.exe Token: SeBackupPrivilege 5076 powershell.exe Token: SeRestorePrivilege 5076 powershell.exe Token: SeShutdownPrivilege 5076 powershell.exe Token: SeDebugPrivilege 5076 powershell.exe Token: SeSystemEnvironmentPrivilege 5076 powershell.exe Token: SeRemoteShutdownPrivilege 5076 powershell.exe Token: SeUndockPrivilege 5076 powershell.exe Token: SeManageVolumePrivilege 5076 powershell.exe Token: 33 5076 powershell.exe Token: 34 5076 powershell.exe Token: 35 5076 powershell.exe Token: 36 5076 powershell.exe
Processes
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\app\ApexTweaks.ps11⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1820
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_but1nltg.n1n.ps1
- Size 60B
- SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
- MD5 d17fe0a3f47be24a6453e9ef58c94641
- SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
- SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
- TLSH T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
- MD5 SHA1 SHA512 TLSH