d869738e3908aa88348bf51d97d1a60237f97c0b8850ee6304ff6572451a7f9c

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 21:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1cNuZBY0rGX-WyLN.exe
Size 3.6MB
Sample261104-zzxjjsdv4x
SHA256 d869738e3908aa88348bf51d97d1a60237f97c0b8850ee6304ff6572451a7f9c
MD5 ea67ea03946095691692c7e973668fca
SHA1 974f81910f95ac3456f255352fadaf2bf6df94e4
SHA512 897af572f667525aa7ad1b0964fb22a6be2dfc7f349b75f175d55ff62fb4336e953626472f2aa7ab056c4c3d8be806d684ad9461e3de9d9fe17ccede24ecf39a
SSDEEP 24576:3pCho/ZzZIc/UweljgtzZfSfCkUJN7EzDNXZhDUEKurh3lo6ODRpbVpyGO7uN3pi:5CheD/jsUVSOjAzDNXTKNldIwMbD+Q
TLSH
T17D066D8682910871EEBBB03605433A124BB7513957A6F150DAE8D13A7CC36DEF6B6F70
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2872	powershell.exe
2872	powershell.exe

Downloads MZ/PE file 1 IoCs

flow	pid	Process
9	4108	1cNuZBY0rGX-WyLN.exe

Executes dropped EXE 2 IoCs

pid	Process
4644	Tmijic.exe
1412	.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1412 set thread context of 4836	1412	.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Tmijic.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1cNuZBY0rGX-WyLN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1cNuZBY0rGX-WyLN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Tmijic.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSBuild.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Tmijic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2428	schtasks.exe
2636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1944	powershell.exe
1944	powershell.exe
1944	powershell.exe
2872	powershell.exe
2872	powershell.exe
2872	powershell.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
820	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeLoadDriverPrivilege	4108	1cNuZBY0rGX-WyLN.exe
Token: SeDebugPrivilege	4644	Tmijic.exe
Token: SeDebugPrivilege	1944	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeIncreaseQuotaPrivilege	2872	powershell.exe
Token: SeSecurityPrivilege	2872	powershell.exe
Token: SeTakeOwnershipPrivilege	2872	powershell.exe
Token: SeLoadDriverPrivilege	2872	powershell.exe
Token: SeSystemProfilePrivilege	2872	powershell.exe
Token: SeSystemtimePrivilege	2872	powershell.exe
Token: SeProfSingleProcessPrivilege	2872	powershell.exe
Token: SeIncBasePriorityPrivilege	2872	powershell.exe
Token: SeCreatePagefilePrivilege	2872	powershell.exe
Token: SeBackupPrivilege	2872	powershell.exe
Token: SeRestorePrivilege	2872	powershell.exe
Token: SeShutdownPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeSystemEnvironmentPrivilege	2872	powershell.exe
Token: SeRemoteShutdownPrivilege	2872	powershell.exe
Token: SeUndockPrivilege	2872	powershell.exe
Token: SeManageVolumePrivilege	2872	powershell.exe
Token: 33	2872	powershell.exe
Token: 34	2872	powershell.exe
Token: 35	2872	powershell.exe
Token: 36	2872	powershell.exe
Token: SeIncreaseQuotaPrivilege	2872	powershell.exe
Token: SeSecurityPrivilege	2872	powershell.exe
Token: SeTakeOwnershipPrivilege	2872	powershell.exe
Token: SeLoadDriverPrivilege	2872	powershell.exe
Token: SeSystemProfilePrivilege	2872	powershell.exe
Token: SeSystemtimePrivilege	2872	powershell.exe
Token: SeProfSingleProcessPrivilege	2872	powershell.exe
Token: SeIncBasePriorityPrivilege	2872	powershell.exe
Token: SeCreatePagefilePrivilege	2872	powershell.exe
Token: SeBackupPrivilege	2872	powershell.exe
Token: SeRestorePrivilege	2872	powershell.exe
Token: SeShutdownPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeSystemEnvironmentPrivilege	2872	powershell.exe
Token: SeRemoteShutdownPrivilege	2872	powershell.exe
Token: SeUndockPrivilege	2872	powershell.exe
Token: SeManageVolumePrivilege	2872	powershell.exe
Token: 33	2872	powershell.exe
Token: 34	2872	powershell.exe
Token: 35	2872	powershell.exe
Token: 36	2872	powershell.exe
Token: SeIncreaseQuotaPrivilege	2872	powershell.exe
Token: SeSecurityPrivilege	2872	powershell.exe
Token: SeTakeOwnershipPrivilege	2872	powershell.exe
Token: SeLoadDriverPrivilege	2872	powershell.exe
Token: SeSystemProfilePrivilege	2872	powershell.exe
Token: SeSystemtimePrivilege	2872	powershell.exe
Token: SeProfSingleProcessPrivilege	2872	powershell.exe
Token: SeIncBasePriorityPrivilege	2872	powershell.exe
Token: SeCreatePagefilePrivilege	2872	powershell.exe
Token: SeBackupPrivilege	2872	powershell.exe
Token: SeRestorePrivilege	2872	powershell.exe
Token: SeShutdownPrivilege	2872	powershell.exe
Token: SeDebugPrivilege	2872	powershell.exe
Token: SeSystemEnvironmentPrivilege	2872	powershell.exe
Token: SeRemoteShutdownPrivilege	2872	powershell.exe
Token: SeUndockPrivilege	2872	powershell.exe
Token: SeManageVolumePrivilege	2872	powershell.exe
Token: 33	2872	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 4644	4108	1cNuZBY0rGX-WyLN.exe	91
PID 4644 wrote to memory of 2428	4644	Tmijic.exe	94
PID 4644 wrote to memory of 2636	4644	Tmijic.exe	100
PID 1412 wrote to memory of 4836	1412	.exe	103
PID 1412 wrote to memory of 4836	1412	.exe	103
PID 1412 wrote to memory of 4836	1412	.exe	103
PID 1412 wrote to memory of 4836	1412	.exe	103
PID 1412 wrote to memory of 4836	1412	.exe	103

C:\Users\Admin\AppData\Local\Temp\1cNuZBY0rGX-WyLN.exe
"C:\Users\Admin\AppData\Local\Temp\1cNuZBY0rGX-WyLN.exe"
1⤵
- Downloads MZ/PE file
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Users\Admin\AppData\Roaming\Tmijic.exe
  "C:\Users\Admin\AppData\Roaming\Tmijic.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4644
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "pklcpvobk" /XML "C:\Users\Admin\AppData\Local\Temp\e4087b82c69d420ea40c820fe56b88a1.xml" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2428
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /TN "" /XML "C:\Users\Admin\AppData\Local\Temp\b88b2479eb4145e5865bddeba35c782b.xml" /F
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2636

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"powershell.exe" -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local,C:\Users\Admin\AppData\Local\Temp\;Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\uummvinnz\.exe;Add-MpPreference -ExclusionProcess C:\Users\Admin\AppData\Local\uummvinnz\.exe;
1⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2872

C:\Users\Admin\AppData\Local\uummvinnz\.exe
"C:\Users\Admin\AppData\Local\uummvinnz\.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1412
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

__PSScriptPolicyTest_yaop43ck.vno.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yaop43ck.vno.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

b88b2479eb4145e5865bddeba35c782b.xml

Path C:\Users\Admin\AppData\Local\Temp\b88b2479eb4145e5865bddeba35c782b.xml
Size 1KB
SHA256 bfa2ca3f5699b7608df7868c5ebca560531700ecce872a0f3f848ee9521cede2
MD5 45d926dcf54a647ee873b6e54af770ae
SHA1 f9742fa0eeb696827d5d6f5f0375187543bb602b
SHA512 8aa13742731afe7f74189e253505c8b7a04c1a261b9412dd77c3136a1fb8ea52727bfbd285fb7c0e7869f306fcb8b1afc7292c0545e36e09511cc863169228ff
TLSH
T1F731CD6499C0B60B6533453AD7914682FF3287A3069B0034F5CC473F2FBA589614357B
MD5 SHA1 SHA512 TLSH

Submit Download

e4087b82c69d420ea40c820fe56b88a1.xml

Path C:\Users\Admin\AppData\Local\Temp\e4087b82c69d420ea40c820fe56b88a1.xml
Size 1KB
SHA256 ecd7b60c6c6f112bc58cb04fd497bfa57bd1f17bfe967e4d8efb2e7f1b117253
MD5 077409d588a98dcdbef4b7186acab2af
SHA1 21542854567d240c7b7766c564dc7b4bf753b1a8
SHA512 815134e752aa04bb10de63259b96ed818d552e03533695a76991445cb7846bd4098a8dec69f8aaf261ec41b3bb2f4f6694c492f48ba6d709e53c0c1d1e9295ac
TLSH
T19D31F21058C0A64B9537453BD3A15387EE374B63179A0434B6CC863F3F7548BE15396B
MD5 SHA1 SHA512 TLSH

Submit Download

ntkrnlmp_953A8DE880B0818C32DA2DEC1D79C2D91.pdb

Path C:\Users\Admin\AppData\Local\Temp\ntkrnlmp_953A8DE880B0818C32DA2DEC1D79C2D91.pdb
Size 10.5MB
SHA256 e987244cfdc33cb195c34231d8905d9e87019b36f199d17ab0638187ce0aaf7f
MD5 566f8135567a80ba945eee5ce9be4f69
SHA1 26008b593f2deacd27d6c55220cbcacfeaeb1a37
SHA512 86bfd6689da02d75e8323b6420c35fc86c487906d82827ec595d6d308e9f32fb23aca9b2c72f071fab77ed78b3997b8fae5034bc105e1109f2e3df32c5603829
SSDEEP 49152:R85MWAL/kNIUlMy+1sA3w9QnZcaDkFAjcLU3I67bX3V/lxKPmng+Y99+1lM8faZJ:R85rADkNl63pnR7fDgf
TLSH
T150B60615BA937EF6DC5A457FA0160329F6F596CA03A947E33D46B3A90DC2212CF2E341
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Tmijic.exe

Path C:\Users\Admin\AppData\Roaming\Tmijic.exe
Size 837KB
SHA256 af93e728ed15410ec042383990cb88f254842b3040ad7e1e0305eb0187059fb1
MD5 aa7f1d33dedc63f697605550f271f3d0
SHA1 bb853b9b3cc92c6d10e033f66bcdc35ef4d4e686
SHA512 34d44f15a167e12f64f576a82189b6a25ef908fe211367e7391469c29132916fc6058e853e5a4d71bb2d9026f67bc631e00d20e44bf28aa1816b6b233cafd964
SSDEEP 12288:NXB8QwaXK9EZ8MzmpPYP6AvD6VByLjO7Yg5c2w2x9qb:FtXqE7mZYzreyO7YIc2
TLSH
T1D505BF9776224E14D148063BC1CB494087E69782B6A7F70FB284339A1D077FEDE1B6A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1944-26-0x00007FFD8092F000-0x00007FFD80930000-memory.dmp

Download

memory/1944-30-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-53-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-54-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-55-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-38-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-29-0x0000028C5C480000-0x0000028C5C4A2000-memory.dmp

Download

memory/1944-46-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-31-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-32-0x0000028C5C500000-0x0000028C5C548000-memory.dmp

Download

memory/1944-33-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-34-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-35-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-36-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/1944-37-0x00007FFD807A0000-0x00007FFD81144000-memory.dmp

Download

memory/2872-45-0x000001E56B6A0000-0x000001E56B6AA000-memory.dmp

Download

memory/2872-44-0x000001E56B720000-0x000001E56B7D2000-memory.dmp

Download

memory/2872-43-0x000001E56B700000-0x000001E56B71E000-memory.dmp

Download

memory/4644-23-0x0000000005320000-0x0000000005386000-memory.dmp

Download

memory/4644-22-0x00000000051E0000-0x00000000051E6000-memory.dmp

Download

memory/4644-21-0x0000000004F30000-0x0000000005054000-memory.dmp

Download

memory/4644-48-0x0000000074B32000-0x0000000074B33000-memory.dmp

Download

memory/4644-20-0x0000000004EB0000-0x0000000004F34000-memory.dmp

Download

memory/4644-51-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download

memory/4644-19-0x0000000074B20000-0x00000000752DC000-memory.dmp

Download

memory/4644-18-0x00000000001C0000-0x0000000000298000-memory.dmp

Download

memory/4644-17-0x0000000074B32000-0x0000000074B33000-memory.dmp

Download