Analysis
- max time kernel
149s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
10/08/2026, 10:34
General
- Target ohijfalqvzldlhaqw.exe
- Size 10.9MB
- Sample260810-ml9kqsfn31
- SHA256 6e7adf36aed077da8fc2e79de1b6cfc38223af3dcc1b8c6aeff52820674fbc70
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Using powershell.exe command.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 18 IoCs
- Unexpected DNS network traffic destination 4 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 11 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ohijfalqvzldlhaqw.exe"C:\Users\Admin\AppData\Local\Temp\ohijfalqvzldlhaqw.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AY1RMIBRO5.tmp\ohijfalqvzldlhaqw.tmp"C:\Users\Admin\AppData\Local\Temp\is-AY1RMIBRO5.tmp\ohijfalqvzldlhaqw.tmp" /SL5="$B00D4,10202352,893952,C:\Users\Admin\AppData\Local\Temp\ohijfalqvzldlhaqw.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.PythonApp_6udm0yrs1de22\pythonw.exe"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.PythonApp_6udm0yrs1de22\pythonw.exe" "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.PythonApp_6udm0yrs1de22\run.pyw"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exeC:\Windows\System32\schtasks.exe /Create /F /TN AMDSoftwareUpdater /XML C:\Users\Admin\AppData\Local\Temp\t.xml4⤵
- Scheduled Task/Job: Scheduled Task
-
-
C:\Windows\System32\Wbem\wmic.exewmic process where name='pythonw.exe' get processid,commandline4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c "ver"4⤵
- Executes a command shell one-liner
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -Command "(Get-CimInstance Win32_OperatingSystem).Caption"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -NoProfile -NonInteractive -Command "(Get-CimInstance -Namespace root/SecurityCenter2 -ClassName AntiVirusProduct).displayName"4⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.PythonApp_6udm0yrs1de22\pythonw.exeC:\Users\Admin\AppData\Local\Microsoft\WindowsApps\Microsoft.PythonApp_6udm0yrs1de22\pythonw.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
VCRUNTIME140.dll
_bz2.pyd
_ctypes.pyd
_hashlib.pyd
_lzma.pyd
_queue.pyd
_socket.pyd
_ssl.pyd
libcrypto-3.dll
libffi-8.dll
libssl-3.dll
python3.DLL
python311._pth
python311.dll
python311.zip
pythonw.exe
run.pyw
select.pyd
unicodedata.pyd
StartupProfileData-NonInteractive
__PSScriptPolicyTest_z1gbzzil.ipk.ps1
ohijfalqvzldlhaqw.tmp
t.xml
memory/244-86-0x00000000007E0000-0x0000000000C2C000-memory.dmp
memory/244-6-0x0000000001160000-0x0000000001161000-memory.dmp
memory/244-8-0x0000000003CD0000-0x0000000003E10000-memory.dmp
memory/244-9-0x0000000003CD0000-0x0000000003E10000-memory.dmp
memory/2896-125-0x000002280BEE0000-0x000002280BF02000-memory.dmp
memory/2896-128-0x0000022824560000-0x000002282457E000-memory.dmp
memory/2896-129-0x0000022824860000-0x0000022824912000-memory.dmp
memory/2896-130-0x0000022824580000-0x000002282458A000-memory.dmp
memory/2896-131-0x00000228245F0000-0x000002282461A000-memory.dmp
memory/2896-132-0x00000228245F0000-0x0000022824614000-memory.dmp
memory/3468-1-0x0000000000500000-0x00000000005E9000-memory.dmp
memory/3468-87-0x0000000000500000-0x00000000005E9000-memory.dmp