Overview

overview

8

Static

static

1

ProtokolZa...cx.lnk

windows10-2004-x64

8

ProtokolZa...cx.lnk

windows11-ltsc_2024-x64

8

ScanPasspo...df.lnk

windows10-2004-x64

8

ScanPasspo...df.lnk

windows11-ltsc_2024-x64

8

ScanPasspo...df.lnk

windows10-2004-x64

8

ScanPasspo...df.lnk

windows11-ltsc_2024-x64

8

ScanPasspo...df.lnk

windows10-2004-x64

8

ScanPasspo...df.lnk

windows11-ltsc_2024-x64

8

ScanPasspo...df.lnk

windows10-2004-x64

8

ScanPasspo...df.lnk

windows11-ltsc_2024-x64

8

SpisokZatr...sx.lnk

windows10-2004-x64

8

SpisokZatr...sx.lnk

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    24072026_0344_ProtokolZatrimannya.docx.lnk.zip
  • Size 103KB
  • Sample260724-eak41afq7x
  • SHA256 e388e7ce2449ba4100483186d9242e96f0cf74196d2519d37b581df682c57de6
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasionexecution

Malware Config

Targets

    • Target
      ProtokolZatrimannya.docx.lnk
    • Size 19KB
    • SHA256 eb84fc07f54cf6acaa90b5e549bc32fa8f5247ce51c860d6c69178068af4227c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral1behavioral2
    • Target
      ScanPassportiv1.pdf.lnk
    • Size 16KB
    • SHA256 4f1fee2f1c7c247bdd7d0bb1e56a9a02372c0a8dbbd964e09b67156e347edd58
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral3behavioral4
    • Target
      ScanPassportiv2.pdf.lnk
    • Size 15KB
    • SHA256 9b04fff504668a55ced0d3fbecbfa0c40b695f749b47ffc5c2f4bb0555f6824b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral5behavioral6
    • Target
      ScanPassportiv3.pdf.lnk
    • Size 16KB
    • SHA256 d315edb6c327ba0fa47d13468d14d187efcb6584e4eed24e3d96918f4280db46
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral7behavioral8
    • Target
      ScanPassportiv4.pdf.lnk
    • Size 16KB
    • SHA256 2a89b03611fbaced8d59422f21e36c9fea63523b5e0a342b4e982cddf3f46a91
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral10behavioral9
    • Target
      SpisokZatrimanih.xlsx.lnk
    • Size 19KB
    • SHA256 067af2f12be3cb3e992d009c567a77e17a9f5956ed389f5483c54e85b08ac54c
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    defense_evasionexecution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deobfuscate/Decode Files or Information

      Payload decoded via CertUtil.

      defense_evasion
    behavioral11behavioral12

MITRE ATT&CK Enterprise v16

Tasks