Overview

overview

8

Static

static

1

ProtokolZa...cx.lnk

windows10-2004-x64

8

ProtokolZa...cx.lnk

windows11-ltsc_2024-x64

8

ScanPasspo...df.lnk

windows10-2004-x64

8

ScanPasspo...df.lnk

windows11-ltsc_2024-x64

8

ScanPasspo...df.lnk

windows10-2004-x64

8

ScanPasspo...df.lnk

windows11-ltsc_2024-x64

8

ScanPasspo...df.lnk

windows10-2004-x64

8

ScanPasspo...df.lnk

windows11-ltsc_2024-x64

8

ScanPasspo...df.lnk

windows10-2004-x64

8

ScanPasspo...df.lnk

windows11-ltsc_2024-x64

8

SpisokZatr...sx.lnk

windows10-2004-x64

8

SpisokZatr...sx.lnk

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    01082026_0259_31072026_ProtokolZatrimannya.docx.lnk.zip
  • Size 104KB
  • Sample260801-dg65dawene
  • SHA256 5195e822ab2abca8d4f1ba0b174932f914417a07c84c216f5f73d86ce7d41020
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Targets

    • Target
      ProtokolZatrimannya.docx.lnk
    • Size 19KB
    • SHA256 00ba6056f562a3d875cdcefbb300eeec4fdb17a075183df834b8f3fc2e8c0b82
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral1behavioral2
    • Target
      ScanPassportiv1.pdf.lnk
    • Size 16KB
    • SHA256 3ff5bb6026dfd890033f3029556940b4d3a22e0529a75e004675decf7979b0c0
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral3behavioral4
    • Target
      ScanPassportiv2.pdf.lnk
    • Size 16KB
    • SHA256 c5cfb05e9411aee011f6cb008c88cd466c98439feca07dddec70fda77fa663a6
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral5behavioral6
    • Target
      ScanPassportiv3.pdf.lnk
    • Size 16KB
    • SHA256 67aa357651b758089ab3b0c60249365fdd310fdb0f1588f0883e4ef01fb9a271
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral7behavioral8
    • Target
      ScanPassportiv4.pdf.lnk
    • Size 16KB
    • SHA256 f8d24ffd59dcc42b916a1ed7473d0944a3abba4e2026cf6e40f05fe5046df434
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral10behavioral9
    • Target
      SpisokZatrimanih.xlsx.lnk
    • Size 19KB
    • SHA256 14e0b24bcbcd62a5d49fa2bb1668a80c517f15d9beb2ce85c063a99019b66e3e
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    8/10
    execution

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

      execution
    behavioral11behavioral12

MITRE ATT&CK Enterprise v16

Tasks