Cobalt Strikes again: UAC-0056 continues to target Ukraine in its latest campaign

The document will download an executable file named write.bin.
Other attacks following the same scheme used different names for this file, including Office.exe, baseupd.exe and DataSource.exe.
The file is slightly obfuscated, and performs the following actions:
After some antidebug tricks, the registry key HKCUSoftwareMicrosoftWindowsCurrentVersionRunCheck License is used to establish persistence.
HKCUSoftwareMicrosoftWindowsCurrentVersionRunUpdate Checker, is checked first because that was the key used by previous versions of the malware.
Next step is dropping a file in C:ProgramDataTRYxaEbX.
This is a powershell script that will perform the following actions:
Disable script logging
Disable Module Logging
Disable Transcription
Disable AMSI protection
Finally a Cobalt Strike payload will be deployed.