File name:

DEVICE-TWEAKER.zip

Full analysis: https://app.any.run/tasks/abef1197-f6c4-48f3-a6ec-975899ee0901
Verdict: Malicious activity
Analysis date: May 18, 2025, 16:23:36
OS: Windows 10 Professional (build: 19044, 64 bit)
Tags:
arch-exec
themida
Indicators:
MIME: application/zip
File info: Zip archive data, at least v2.0 to extract, compression method=store
MD5:

E614313872F99EDD049F0D8F297BBD80

SHA1:

CC583DC1E8B5557DDB2537395CC76505F2572D93

SHA256:

0C571E491F21E5CABD5A8F18369275DB5159DEC2E34B9289C78A9ACC5BFD87F2

SSDEEP:

98304:zCDr9I6mZMz9hPJYkrcSPiiphGfjJ4Mo2qF5km+UnhWGrU7RuY9bljBWT6ogU0JT:G6GXnisQ9dOWlK/i

ANY.RUN is an interactive service which provides full access to the guest system. Information in this report could be distorted by user actions and is provided for user acknowledgement as it is. ANY.RUN does not guarantee maliciousness or safety of the content.

  • MALICIOUS

    • Generic archive extractor

      • WinRAR.exe (PID: 7664)

  • SUSPICIOUS

    • Reads the BIOS version

      • DEVICE-TWEAKER.exe (PID: 7876)

    • Writes data into a file (POWERSHELL)

      • DEVICE-TWEAKER.exe (PID: 7876)

    • Starts CMD.EXE for commands execution

      • WinRAR.exe (PID: 7664)

    • Gets information about processes (POWERSHELL)

      • DEVICE-TWEAKER.exe (PID: 7876)

    • Reads security settings of Internet Explorer

      • WinRAR.exe (PID: 7664)
      • DEVICE-TWEAKER.exe (PID: 7876)

    • Executing commands from a ".bat" file

      • WinRAR.exe (PID: 7664)

    • Converts a specified value to an integer (POWERSHELL)

      • DEVICE-TWEAKER.exe (PID: 7876)

    • Uses base64 encoding (POWERSHELL)

      • DEVICE-TWEAKER.exe (PID: 7876)

  • INFO

    • Manual execution by a user

      • DEVICE-TWEAKER.exe (PID: 7816)
      • OpenWith.exe (PID: 7932)
      • OpenWith.exe (PID: 7924)
      • DEVICE-TWEAKER.exe (PID: 7876)

    • Process checks whether UAC notifications are on

      • DEVICE-TWEAKER.exe (PID: 7876)

    • Reads the machine GUID from the registry

      • DEVICE-TWEAKER.exe (PID: 7876)

    • Reads Microsoft Office registry keys

      • OpenWith.exe (PID: 7932)
      • OpenWith.exe (PID: 7924)

    • Reads the computer name

      • DEVICE-TWEAKER.exe (PID: 7876)
      • MpCmdRun.exe (PID: 6516)
      • MpCmdRun.exe (PID: 7572)

    • Create files in a temporary directory

      • DEVICE-TWEAKER.exe (PID: 7876)
      • MpCmdRun.exe (PID: 6516)

    • Checks supported languages

      • DEVICE-TWEAKER.exe (PID: 7876)
      • MpCmdRun.exe (PID: 6516)
      • MpCmdRun.exe (PID: 7572)

    • Checks if a key exists in the options dictionary (POWERSHELL)

      • DEVICE-TWEAKER.exe (PID: 7876)

    • Checks whether the specified file exists (POWERSHELL)

      • DEVICE-TWEAKER.exe (PID: 7876)

    • Themida protector has been detected

      • DEVICE-TWEAKER.exe (PID: 7876)

    • Executable content was dropped or overwritten

      • WinRAR.exe (PID: 7664)

    • Checks proxy server information

      • slui.exe (PID: 7212)

    • Reads Environment values

      • DEVICE-TWEAKER.exe (PID: 7876)

    • Reads the software policy settings

      • DEVICE-TWEAKER.exe (PID: 7876)
      • slui.exe (PID: 7212)
Find more information about signature artifacts and mapping to MITRE ATT&CK™ MATRIX at the full report
No Malware configuration.

TRiD

.zip | ZIP compressed archive (100)

EXIF

ZIP

ZipRequiredVersion: 20
ZipBitFlag: 0x0808
ZipCompression: None
ZipModifyDate: 2025:05:15 17:08:42
ZipCRC: 0x617d5801
ZipCompressedSize: 66
ZipUncompressedSize: 66
ZipFileName: DEVICE-TWEAKER/system_priorities.cfg
No data.
screenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshotscreenshot
All screenshots are available in the full report
All screenshots are available in the full report
Total processes
139
Monitored processes
12
Malicious processes
1
Suspicious processes
1

Behavior graph

Click at the process to see the details
start winrar.exe device-tweaker.exe no specs device-tweaker.exe openwith.exe no specs openwith.exe no specs cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs slui.exe cmd.exe no specs conhost.exe no specs mpcmdrun.exe no specs

Process information

PID
CMD
Path
Indicators
Parent process
2088\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
4380C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR7664.35052\Rar$Scan113290.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
5528C:\WINDOWS\system32\cmd.exe /c ""C:\Users\admin\AppData\Local\Temp\Rar$VR7664.26735\Rar$Scan30179.bat" "C:\Windows\System32\cmd.exe—WinRAR.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Command Processor
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\cmd.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\cmdext.dll
c:\windows\system32\advapi32.dll
6032\??\C:\WINDOWS\system32\conhost.exe 0xffffffff -ForceV1C:\Windows\System32\conhost.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Console Window Host
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\conhost.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
c:\windows\system32\shcore.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\combase.dll
c:\windows\system32\rpcrt4.dll
6516"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR7664.26735"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
7212C:\WINDOWS\System32\slui.exe -EmbeddingC:\Windows\System32\slui.exe
svchost.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Windows Activation Client
Exit code:
0
Version:
10.0.19041.1 (WinBuild.160101.0800)
Modules
Images
c:\windows\system32\slui.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\user32.dll
7572"C:\Program Files\Windows Defender\MpCmdRun.exe" -Scan -ScanType 3 -File "C:\Users\admin\AppData\Local\Temp\Rar$VR7664.35052"C:\Program Files\Windows Defender\MpCmdRun.exe—cmd.exe
User:
admin
Company:
Microsoft Corporation
Integrity Level:
MEDIUM
Description:
Microsoft Malware Protection Command Line Utility
Exit code:
2
Version:
4.18.1909.6 (WinBuild.160101.0800)
Modules
Images
c:\program files\windows defender\mpcmdrun.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\advapi32.dll
c:\windows\system32\msvcrt.dll
c:\windows\system32\sechost.dll
c:\windows\system32\rpcrt4.dll
c:\windows\system32\bcrypt.dll
c:\windows\system32\ucrtbase.dll
7664"C:\Program Files\WinRAR\WinRAR.exe" C:\Users\admin\Desktop\DEVICE-TWEAKER.zipC:\Program Files\WinRAR\WinRAR.exe
explorer.exe
User:
admin
Company:
Alexander Roshal
Integrity Level:
MEDIUM
Description:
WinRAR archiver
Version:
5.91.0
Modules
Images
c:\program files\winrar\winrar.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
c:\windows\system32\ucrtbase.dll
7816"C:\Users\admin\Desktop\DEVICE-TWEAKER.exe" C:\Users\admin\Desktop\DEVICE-TWEAKER.exe—explorer.exe
User:
admin
Integrity Level:
MEDIUM
Description:
BYND_PERF
Exit code:
3221226540
Version:
1.4.8.8
Modules
Images
c:\users\admin\desktop\device-tweaker.exe
c:\windows\system32\ntdll.dll
7876"C:\Users\admin\Desktop\DEVICE-TWEAKER.exe" C:\Users\admin\Desktop\DEVICE-TWEAKER.exe
explorer.exe
User:
admin
Integrity Level:
HIGH
Description:
BYND_PERF
Version:
1.4.8.8
Modules
Images
c:\users\admin\desktop\device-tweaker.exe
c:\windows\system32\ntdll.dll
c:\windows\system32\kernel32.dll
c:\windows\system32\kernelbase.dll
c:\windows\system32\apphelp.dll
c:\windows\system32\user32.dll
c:\windows\system32\win32u.dll
c:\windows\system32\gdi32.dll
c:\windows\system32\gdi32full.dll
c:\windows\system32\msvcp_win.dll
Total events
16 126
Read events
16 115
Write events
11
Delete events
0

Modification events

(PID) Process:(7664) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:3
Value:
C:\Users\admin\Desktop\preferences.zip
(PID) Process:(7664) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:2
Value:
C:\Users\admin\Desktop\chromium_ext.zip
(PID) Process:(7664) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:1
Value:
C:\Users\admin\Desktop\omni_23_10_2024_.zip
(PID) Process:(7664) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\ArcHistory
Operation:writeName:0
Value:
C:\Users\admin\Desktop\DEVICE-TWEAKER.zip
(PID) Process:(7664) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:name
Value:
120
(PID) Process:(7664) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:size
Value:
80
(PID) Process:(7664) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:type
Value:
120
(PID) Process:(7664) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList\FileColumnWidths
Operation:writeName:mtime
Value:
100
(PID) Process:(7664) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\FileList
Operation:writeName:ArcSort
Value:
32
(PID) Process:(7664) WinRAR.exeKey:HKEY_CURRENT_USER\SOFTWARE\WinRAR\VirusScan
Operation:writeName:DefScanner
Value:
Windows Defender
Executable files
2
Suspicious files
3
Text files
8
Unknown types
0

Dropped files

PID
Process
Filename
Type
6516MpCmdRun.exeC:\Users\admin\AppData\Local\Temp\MpCmdRun.logbinary
MD5:828059FD31FFF8585FF7FF9185E99BF7
SHA256:A0742649C3338922EAEA379AB54577C036E51A53A524F973E5A9B06BC3DC7D83
7876DEVICE-TWEAKER.exeC:\Users\admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCachebinary
MD5:2AF279E73EBE24F3A6E689A595D21DA6
SHA256:744A9C29CC187A660EF373FE35642BAC63B4CF8A94D301D90307F3FB0775D35F
7664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7664.26735\DEVICE-TWEAKER.zip\DEVICE-TWEAKER\system_priorities.cfgtext
MD5:6516274159E3BD60992C5B41C858E99E
SHA256:D6C3191F3C8A5E8E9566EF89FDD7DF7AA455D7F4897F2E40228F5B20D9BD23BA
7664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7664.26735\Rar$Scan30179.battext
MD5:10C740C33CE5288AF00F1A4DDAF75160
SHA256:88A8F3011AC514B3EDE3C9819E67463EEFA9F21D7B34354CEFC5AC4684539A9D
7664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7664.26735\DEVICE-TWEAKER.zip\DEVICE-TWEAKER\DEVICE-TWEAKER.exeexecutable
MD5:5E915A7BAE95BEDB3A5C7C5AA1865C0B
SHA256:E652B9B466D84ADBDA644A87AEB36E087D2A1569B35D58DDDAE46C332A3FFF91
7664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7664.26735\DEVICE-TWEAKER.zip\DEVICE-TWEAKER\games_priorities.cfgtext
MD5:6516274159E3BD60992C5B41C858E99E
SHA256:D6C3191F3C8A5E8E9566EF89FDD7DF7AA455D7F4897F2E40228F5B20D9BD23BA
7876DEVICE-TWEAKER.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_1qdq2ydl.ghh.ps1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7664WinRAR.exeC:\Users\admin\AppData\Local\Temp\Rar$VR7664.35052\DEVICE-TWEAKER.zip\DEVICE-TWEAKER\DEVICE-TWEAKER.exeexecutable
MD5:5E915A7BAE95BEDB3A5C7C5AA1865C0B
SHA256:E652B9B466D84ADBDA644A87AEB36E087D2A1569B35D58DDDAE46C332A3FFF91
7876DEVICE-TWEAKER.exeC:\Users\admin\AppData\Local\Temp\__PSScriptPolicyTest_t1tunv4j.yti.psm1text
MD5:D17FE0A3F47BE24A6453E9EF58C94641
SHA256:96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
7876DEVICE-TWEAKER.exeC:\Users\admin\AppData\Local\Temp\CPMono_v07_Plain.ttfbinary
MD5:CEC2670064F93D247C30D60FFD375E30
SHA256:43EDBE0C38AEB163BD8A581AD21EA071B0C0EB52B0999D760ED373CF0A6A210D
Download PCAP, analyze network streams, HTTP content and a lot more at the full report
HTTP(S) requests
11
TCP/UDP connections
50
DNS requests
18
Threats
0

HTTP requests

PID
Process
Method
HTTP Code
IP
URL
CN
Type
Size
Reputation
2104
svchost.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
5216
RUXIMICS.exe
GET
200
23.48.23.156:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl
unknown
—
—
whitelisted
2104
svchost.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
5216
RUXIMICS.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl
unknown
—
—
whitelisted
6184
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
6184
SIHClient.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl
unknown
—
—
whitelisted
6184
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Product%20Root%20Certificate%20Authority%202018.crl
unknown
—
—
whitelisted
6184
SIHClient.exe
GET
200
23.48.23.143:80
http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl
unknown
—
—
whitelisted
6184
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20ECC%20Update%20Signing%20CA%202.1.crl
unknown
—
—
whitelisted
6184
SIHClient.exe
GET
200
23.35.229.160:80
http://www.microsoft.com/pkiops/crl/Microsoft%20Update%20Signing%20CA%202.2.crl
unknown
—
—
whitelisted
Download PCAP, analyze network streams, HTTP content and a lot more at the full report

Connections

PID
Process
IP
Domain
ASN
CN
Reputation
2104
svchost.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:137
—
—
—
whitelisted
5216
RUXIMICS.exe
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
4.231.128.59:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
—
—
51.104.136.2:443
settings-win.data.microsoft.com
MICROSOFT-CORP-MSN-AS-BLOCK
IE
whitelisted
4
System
192.168.100.255:138
—
—
—
whitelisted
3216
svchost.exe
172.211.123.249:443
client.wns.windows.com
MICROSOFT-CORP-MSN-AS-BLOCK
FR
whitelisted
2104
svchost.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
5216
RUXIMICS.exe
23.48.23.156:80
crl.microsoft.com
Akamai International B.V.
DE
whitelisted
2104
svchost.exe
23.35.229.160:80
www.microsoft.com
AKAMAI-AS
DE
whitelisted

DNS requests

Domain
IP
Reputation
settings-win.data.microsoft.com
  • 4.231.128.59
  • 51.104.136.2
  • 40.127.240.158
  • 20.73.194.208
whitelisted
google.com
  • 216.58.206.46
whitelisted
client.wns.windows.com
  • 172.211.123.249
whitelisted
crl.microsoft.com
  • 23.48.23.156
  • 23.48.23.143
whitelisted
www.microsoft.com
  • 23.35.229.160
whitelisted
login.live.com
  • 40.126.32.72
  • 20.190.160.20
  • 20.190.160.128
  • 20.190.160.22
  • 20.190.160.4
  • 20.190.160.2
  • 20.190.160.65
  • 20.190.160.66
whitelisted
slscr.update.microsoft.com
  • 172.202.163.200
whitelisted
fe3cr.delivery.mp.microsoft.com
  • 20.242.39.171
whitelisted
activation-v2.sls.microsoft.com
  • 40.91.76.224
whitelisted
nexusrules.officeapps.live.com
  • 52.111.229.19
whitelisted

Threats

No threats detected
No debug info
Interactive malware hunting service ANY.RUN
© 2017-2025 ANY.RUN ALL RIGHTS RESERVED
ANY.RUN
Reports
DEVICE-TWEAKER.zip