A customized email spam has a link to download a protected zip with password in mail
Which leads to .LNK shortcut file
Which executes MSHTA to
Run a VBScript to download an obfuscated PowerShell script
Which compiles binary on the fly leading to
#Bitrat
Good try. IOC in comment