Overview

overview

6

Static

static

1

IQ Optimiz....0.exe

windows10-2004-x64

6

IQ Optimiz....0.exe

windows11-ltsc_2024-x64

6

Analysis

  • user interaction
    yes
  • max time kernel
    150s
  • max time network
    130s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 15:01

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    IQ Optimizer-v6.7.4.0.exe
  • Size 63.7MB
  • Sample260728-sdzy8azvcw
  • SHA256 f62b156c0d04a48c1898fb942e02d340fc9389085bc98aab1c8f263fd9ef5464
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Loads dropped DLL 10 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Control Panel 1 IoCs
    defense_evasion
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\IQ Optimizer-v6.7.4.0.exe
    "C:\Users\Admin\AppData\Local\Temp\IQ Optimizer-v6.7.4.0.exe"
    1⤵
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies Control Panel
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    PID:5180
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4592
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 1697BB8756756E53BF23AF641F18A646 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4536
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:4940
    • C:\Windows\system32\AUDIODG.EXE
      C:\Windows\system32\AUDIODG.EXE 0x00000000000004F4 0x00000000000004E4
      1⤵
        PID:1332
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
        1⤵
          PID:6064
        • C:\Windows\System32\ShellHost.exe
          "C:\Windows\System32\ShellHost.exe"
          1⤵
          • Suspicious use of SetWindowsHookEx
          PID:3476

        Network

              MITRE ATT&CK Enterprise v16

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              background
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\background
              • Size 134B
              • SHA256 f044f542bc46464054084c63596877f06c6e2c215c0e954c4ace9787ced82787
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              checkbox
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\checkbox
              • Size 1KB
              • SHA256 bce5b6de3a1c7af7ec14b6643da25f7c9e15bd5f1c4a38abfcddc70a5e93bdd3
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              frame_bottom_left.bmp
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\frame_bottom_left.bmp
              • Size 66B
              • SHA256 384ebd5800becadf3bd9014686e6cc09344f75ce426e966d788eb5473b28aa21
              • MD5 SHA1 SHA512
              Submit Download

              frame_bottom_left_inactive.bmp
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\frame_bottom_left_inactive.bmp
              • Size 66B
              • SHA256 d5e9f3533cb7d727611aafaa5af22fa07efeaec0391a011ecf9803bed867de7a
              • MD5 SHA1 SHA512
              Submit Download

              frame_bottom_mid.bmp
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\frame_bottom_mid.bmp
              • Size 66B
              • SHA256 205209facdebf400319dbcb1020f0545d7564b9415c47497528593e344795afd
              • MD5 SHA1 SHA512
              Submit Download

              frame_caption.bmp
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\frame_caption.bmp
              • Size 206B
              • SHA256 0403ed31d75dcc182dd98f2b603da4c36b6325e9d159cac4371e1448244bb707
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              frame_left.bmp
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\frame_left.bmp
              • Size 66B
              • SHA256 f545ec56bc9b690a6b952471669a8316e18274d64e2ebc9e365fcf44363a125a
              • MD5 SHA1 SHA512
              Submit Download

              frame_left_inactive.bmp
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\frame_left_inactive.bmp
              • Size 66B
              • SHA256 c93be5a7c979c534274fc1a965d26c126efa5d58c14066b14937e5aba3b9eb55
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              frame_top_left.bmp
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\frame_top_left.bmp
              • Size 154B
              • SHA256 17b5cd496d98db14e7c9757e38892883c7b378407e1f136889a9921abe040741
              • MD5 SHA1 SHA512
              Submit Download

              frame_top_mid.bmp
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\frame_top_mid.bmp
              • Size 66B
              • SHA256 1d59fe11b3f1951c104f279c1338fc307940268971d016ebe929a9998a5038ee
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              metrobuttonimage.xaml
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\metrobuttonimage.xaml
              • Size 1KB
              • SHA256 fb1c5df8785650b20612b61a66ecbda5e1ed323d6c8ac45b2ebccbe9193779f8
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sys_close_down.png
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\sys_close_down.png
              • Size 273B
              • SHA256 4801d63bd9bdc6279765ba785b0da9e10730764a9c3645934a46c691547c0612
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sys_close_hot.png
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\sys_close_hot.png
              • Size 276B
              • SHA256 15405855866fa2b7c60afbc8ba720aae8f2ba7fb60bfa641dc9d10361e56f033
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sys_close_normal.png
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\sys_close_normal.png
              • Size 225B
              • SHA256 bbcac1632131b21d40c80ff9e14156d36366d2e7bb05eed584e9d448497152d5
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sys_min_down.png
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\sys_min_down.png
              • Size 205B
              • SHA256 c1d0663131fe901d890cdd9f18af8f9a553bee4848cbd978f5122e8383b5534b
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sys_min_hot.png
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\sys_min_hot.png
              • Size 180B
              • SHA256 bcbb601daa5a139419f3cd0f6084615574c41b837426ebff561b7846dfec038e
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sys_min_inactive.png
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\sys_min_inactive.png
              • Size 175B
              • SHA256 a3b59dbc5a39d551455ff838e71b5820560ca3484c6411b9d69df33d8113619c
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              sys_min_normal.png
              • Path C:\Users\Admin\AppData\Local\Temp\AI_EXTUI_BIN_5180\sys_min_normal.png
              • Size 238B
              • SHA256 56e64eaf6349ece08005e6f7299de413ed00112d53518215d90690be2b2a4f1a
              • MD5 SHA1 SHA512 TLSH
              Submit Download

              MSI211C.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI211C.tmp
              • Size 904KB
              • SHA256 d6b89fd5a95071e7b144d8bedcb09b694e9cd14bfbfafb782b17cf8413eac6da
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI243D.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI243D.tmp
              • Size 1.1MB
              • SHA256 403869ed494bcbc3e535b492f2ebfad95748049e203ff7c31ac1afb38d8909ed
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              MSI24F9.tmp
              • Path C:\Users\Admin\AppData\Local\Temp\MSI24F9.tmp
              • Size 877KB
              • SHA256 107fd7ee1eaf17c27b4ed25990acace2cb51f8d39f4dfc8ef5a3df03d02e1d34
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download

              IQ Optimizer-v6.7.4.0.msi
              • Path C:\Users\Admin\AppData\Roaming\IQ Optimizer\IQ Optimizer 6.7.4.0\install\IQ Optimizer-v6.7.4.0.msi
              • Size 5.9MB
              • SHA256 ea668e9ba785e0b51a79c1020c5c33a2c3d72e6e4b2b936797560ae980f17b27
              • MD5 SHA1 SHA512 SSDEEP TLSH
              Submit Download