Analysis
- max time kernel
146s - max time network
149s - platform
windows10_x64 - resource
win10 - submitted
12/10/2020, 19:22
Static task
static1
Behavioral task
behavioral1
Sample
Upgrade Form.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
General
- Target Upgrade Form.exe
- Size 1.1MB
- Sample201012-8vvez64kds
- SHA256 e301fd976c111fd0f209f4cb6e8bd267bd5eb242707ad286b217a5d98032aad6
- MD5 963bcd9157f0caa81a6a20d295c70a74
- SHA1 40b24b3757777c0e078f09429bc5a2b9f5cad832
- SHA512 ff5f6c5ea83a4243fc8ed4bcdc4f509f201fd45c6ba816e8c33d583ea7de0eb737eca05e3ca535473fd67422ededab6f29c25d68460c822db1170b83833e2b3b
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
nanocore
Version
-
1.2.2.0
C2
-
79.134.225.82:54251
-
192.168.5.247:54251
Mutex
-
b8a1b586-5215-4dee-8939-134bfb98e413
Attributes
-
activate_away_mode
false
-
backup_connection_host
192.168.5.247
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-07-12T18:08:56.239627836Z
-
bypass_user_account_control
true
- bypass_user_account_control_data
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
54251
-
default_group
Newz Letter
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
b8a1b586-5215-4dee-8939-134bfb98e413
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
79.134.225.82
-
primary_dns_server
8.8.8.8
-
request_elevation
true
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
true
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Signatures
- Executes dropped EXE 2 IoCs
pid Process 2204 Order.exe 60 Order.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Subsystem = "C:\\Program Files (x86)\\DDP Subsystem\\ddpss.exe" Order.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Order.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2204 set thread context of 60 2204 Order.exe 88 - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\DDP Subsystem\ddpss.exe Order.exe File opened for modification C:\Program Files (x86)\DDP Subsystem\ddpss.exe Order.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 340 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\Local Settings Upgrade Form.exe - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2204 Order.exe 60 Order.exe 60 Order.exe 60 Order.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 60 Order.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2204 Order.exe Token: SeDebugPrivilege 60 Order.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2100 AcroRd32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe 2100 AcroRd32.exe - Suspicious use of WriteProcessMemory 270 IoCs
description pid Process procid_target PID 720 wrote to memory of 2100 720 Upgrade Form.exe 73 PID 720 wrote to memory of 2100 720 Upgrade Form.exe 73 PID 720 wrote to memory of 2100 720 Upgrade Form.exe 73 PID 720 wrote to memory of 2204 720 Upgrade Form.exe 75 PID 720 wrote to memory of 2204 720 Upgrade Form.exe 75 PID 720 wrote to memory of 2204 720 Upgrade Form.exe 75 PID 2100 wrote to memory of 1920 2100 AcroRd32.exe 78 PID 2100 wrote to memory of 1920 2100 AcroRd32.exe 78 PID 2100 wrote to memory of 1920 2100 AcroRd32.exe 78 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 3616 1920 RdrCEF.exe 79 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 4032 1920 RdrCEF.exe 80 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 2396 1920 RdrCEF.exe 81 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 832 1920 RdrCEF.exe 82 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 1232 1920 RdrCEF.exe 83 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 1920 wrote to memory of 2648 1920 RdrCEF.exe 84 PID 2204 wrote to memory of 340 2204 Order.exe 86 PID 2204 wrote to memory of 340 2204 Order.exe 86 PID 2204 wrote to memory of 340 2204 Order.exe 86 PID 2204 wrote to memory of 60 2204 Order.exe 88 PID 2204 wrote to memory of 60 2204 Order.exe 88 PID 2204 wrote to memory of 60 2204 Order.exe 88 PID 2204 wrote to memory of 60 2204 Order.exe 88 PID 2204 wrote to memory of 60 2204 Order.exe 88 PID 2204 wrote to memory of 60 2204 Order.exe 88 PID 2204 wrote to memory of 60 2204 Order.exe 88 PID 2204 wrote to memory of 60 2204 Order.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\Upgrade Form.exe"C:\Users\Admin\AppData\Local\Temp\Upgrade Form.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Invoice.pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=518BEEB55FE19A445146F12A975E8F47 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:3616
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=77B98C3594E21688D82329B282A9A260 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=77B98C3594E21688D82329B282A9A260 --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:14⤵PID:4032
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=74733C34B6E59C9C60DEBB51439CA66A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=74733C34B6E59C9C60DEBB51439CA66A --renderer-client-id=4 --mojo-platform-channel-handle=2088 --allow-no-sandbox-job /prefetch:14⤵PID:2396
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=38CDE091A2E1DB64808FF04C5F7C5E7D --mojo-platform-channel-handle=2480 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:832
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F77F9F519E792FABA6AE21F2AE221FB3 --mojo-platform-channel-handle=2600 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:1232
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0A156812D45FC87717FC6A5AC6EECDB3 --mojo-platform-channel-handle=2688 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵PID:2648
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2204 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sBaNbagc" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF0DE.tmp"3⤵
- Creates scheduled task(s)
PID:340
-
-
C:\Users\Admin\AppData\Local\Temp\Order.exe"C:\Users\Admin\AppData\Local\Temp\Order.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:60
-
-