Analysis
- max time kernel
126s - max time network
174s - platform
windows10_x64 - resource
win10 - submitted
20/08/2020, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
RFQ_01NDN8020901.PDF.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
RFQ_01NDN8020901.PDF.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target RFQ_01NDN8020901.PDF.exe
- Size 523KB
- Sample200820-4vcvb8wbta
- SHA256 34ea4b1bf96a120fd6f9969babeae255483e42a496cdba637c6ef1f44c2b4287
- MD5 8bf635a8eeec3359aaaf4f46505268aa
- SHA1 fabd8b10691122a621f49ddfb66df62d3982b24d
- SHA512 b2a6f47687da7a577dc11e2cb6afa9673a05a36a8a11d70cc6b47f334ff4627d99427ff1655a75bb8a0d422a05ad68103a739ef9824832b73b430bd622c16ab0
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3844 set thread context of 2280 3844 RFQ_01NDN8020901.PDF.exe 70 - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings RFQ_01NDN8020901.PDF.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings WScript.exe - Suspicious behavior: EnumeratesProcesses 26 IoCs
pid Process 3844 RFQ_01NDN8020901.PDF.exe 3844 RFQ_01NDN8020901.PDF.exe 2280 vbc.exe 2280 vbc.exe 500 Powershell.exe 500 Powershell.exe 500 Powershell.exe 2956 powershell.exe 2956 powershell.exe 2956 powershell.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3844 RFQ_01NDN8020901.PDF.exe Token: SeDebugPrivilege 2280 vbc.exe Token: SeDebugPrivilege 500 Powershell.exe Token: SeDebugPrivilege 2956 powershell.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 416 AcroRd32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe 416 AcroRd32.exe - Suspicious use of WriteProcessMemory 276 IoCs
description pid Process procid_target PID 3844 wrote to memory of 2840 3844 RFQ_01NDN8020901.PDF.exe 68 PID 3844 wrote to memory of 2840 3844 RFQ_01NDN8020901.PDF.exe 68 PID 3844 wrote to memory of 2840 3844 RFQ_01NDN8020901.PDF.exe 68 PID 2840 wrote to memory of 416 2840 WScript.exe 69 PID 2840 wrote to memory of 416 2840 WScript.exe 69 PID 2840 wrote to memory of 416 2840 WScript.exe 69 PID 3844 wrote to memory of 2280 3844 RFQ_01NDN8020901.PDF.exe 70 PID 3844 wrote to memory of 2280 3844 RFQ_01NDN8020901.PDF.exe 70 PID 3844 wrote to memory of 2280 3844 RFQ_01NDN8020901.PDF.exe 70 PID 3844 wrote to memory of 2280 3844 RFQ_01NDN8020901.PDF.exe 70 PID 3844 wrote to memory of 2280 3844 RFQ_01NDN8020901.PDF.exe 70 PID 3844 wrote to memory of 2280 3844 RFQ_01NDN8020901.PDF.exe 70 PID 3844 wrote to memory of 2280 3844 RFQ_01NDN8020901.PDF.exe 70 PID 3844 wrote to memory of 2280 3844 RFQ_01NDN8020901.PDF.exe 70 PID 3844 wrote to memory of 500 3844 RFQ_01NDN8020901.PDF.exe 71 PID 3844 wrote to memory of 500 3844 RFQ_01NDN8020901.PDF.exe 71 PID 3844 wrote to memory of 500 3844 RFQ_01NDN8020901.PDF.exe 71 PID 416 wrote to memory of 1364 416 AcroRd32.exe 73 PID 416 wrote to memory of 1364 416 AcroRd32.exe 73 PID 416 wrote to memory of 1364 416 AcroRd32.exe 73 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 3908 1364 RdrCEF.exe 74 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 1588 1364 RdrCEF.exe 75 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3252 1364 RdrCEF.exe 76 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3136 1364 RdrCEF.exe 77 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 3156 1364 RdrCEF.exe 78 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 1364 wrote to memory of 2004 1364 RdrCEF.exe 79 PID 2280 wrote to memory of 1092 2280 vbc.exe 80 PID 2280 wrote to memory of 1092 2280 vbc.exe 80 PID 2280 wrote to memory of 1092 2280 vbc.exe 80 PID 1092 wrote to memory of 2956 1092 cmd.exe 82 PID 1092 wrote to memory of 2956 1092 cmd.exe 82 PID 1092 wrote to memory of 2956 1092 cmd.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ_01NDN8020901.PDF.exe"C:\Users\Admin\AppData\Local\Temp\RFQ_01NDN8020901.PDF.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\Bduxajrh.vbs"2⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\1003634_revX01.pdf"3⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:416 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140434⤵
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A5ABF3B512C04692A25DDB94DB2047E0 --mojo-platform-channel-handle=1612 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:3908
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=49C1BC416A73EBFE8FCC30A13B2A8DF9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=49C1BC416A73EBFE8FCC30A13B2A8DF9 --renderer-client-id=2 --mojo-platform-channel-handle=1620 --allow-no-sandbox-job /prefetch:15⤵PID:1588
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=691B079B139A18A83225238337170145 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=691B079B139A18A83225238337170145 --renderer-client-id=4 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:15⤵PID:3252
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=099EE36CAF21A135B24EB4CA18235273 --mojo-platform-channel-handle=2452 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:3136
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=40A761CE06C10BA3A7B53200E1143F24 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:3156
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C187D546F26BAD29D3F651AC7DFDF5C0 --mojo-platform-channel-handle=2680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:2004
-
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2280 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c start /b powershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe' & exit3⤵PID:1092
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Start-Sleep -Seconds 2; Remove-Item -path 'C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe'4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2956
-
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Powershell.exe"Powershell" Add-MpPreference -ExclusionPath '"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\VideoLAN\vlc.exe"'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:500
-