Analysis
- max time kernel
82s - max time network
144s - platform
windows10_x64 - resource
win10v200722 - submitted
14/10/2020, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
Information Civilized System Oy.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Information Civilized System Oy.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target Information Civilized System Oy.exe
- Size 3.2MB
- Sample201014-rw9p7mrtjj
- SHA256 bf8e469a058f90d9ccbe081b0da470d3314aa4cd34f916865f0c0b4fa28eacd8
- MD5 9f4649ff692011615d5cf3c5d410b95e
- SHA1 5f7c6637088b8e1a64c5f0e1ff0695c3e050616d
- SHA512 c019f99c789d2a77f620ac06fb16e6cf5f9383119f467dbaf7b1fe6feeec816d8a8847a7cbaef5a023e2460535b1bc4381b88040833a81bff364ac0b1aa70669
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\exefile\shell\open reg.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\exefile\shell reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\exefile\shell\open\NoSmartScreen = "1" reg.exe - Executes dropped EXE 1 IoCs
pid Process 3872 Nevaeh.exe - JavaScript code in executable 1 IoCs
resource yara_rule behavioral2/files/0x000100000001ad3b-5.dat js - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe - Creates scheduled task(s) 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2216 schtasks.exe 2208 schtasks.exe 2144 schtasks.exe 2080 schtasks.exe 3744 schtasks.exe 3756 schtasks.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\exefile\shell\open reg.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\exefile reg.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\exefile\shell reg.exe Set value (int) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\exefile\shell\open\NoSmartScreen = "1" reg.exe Key created \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000_Classes\Local Settings cmd.exe - Modifies registry key 1 TTPs 1 IoCs
pid Process 2176 reg.exe - Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3872 Nevaeh.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 752 AcroRd32.exe - Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe 752 AcroRd32.exe - Suspicious use of WriteProcessMemory 307 IoCs
description pid Process procid_target PID 2736 wrote to memory of 3872 2736 Information Civilized System Oy.exe 73 PID 2736 wrote to memory of 3872 2736 Information Civilized System Oy.exe 73 PID 2736 wrote to memory of 3872 2736 Information Civilized System Oy.exe 73 PID 3872 wrote to memory of 3456 3872 Nevaeh.exe 75 PID 3872 wrote to memory of 3456 3872 Nevaeh.exe 75 PID 3872 wrote to memory of 3456 3872 Nevaeh.exe 75 PID 3456 wrote to memory of 3772 3456 cscript.exe 77 PID 3456 wrote to memory of 3772 3456 cscript.exe 77 PID 3456 wrote to memory of 3772 3456 cscript.exe 77 PID 3456 wrote to memory of 1764 3456 cscript.exe 79 PID 3456 wrote to memory of 1764 3456 cscript.exe 79 PID 3456 wrote to memory of 1764 3456 cscript.exe 79 PID 3456 wrote to memory of 1012 3456 cscript.exe 81 PID 3456 wrote to memory of 1012 3456 cscript.exe 81 PID 3456 wrote to memory of 1012 3456 cscript.exe 81 PID 3456 wrote to memory of 1516 3456 cscript.exe 83 PID 3456 wrote to memory of 1516 3456 cscript.exe 83 PID 3456 wrote to memory of 1516 3456 cscript.exe 83 PID 3456 wrote to memory of 1468 3456 cscript.exe 85 PID 3456 wrote to memory of 1468 3456 cscript.exe 85 PID 3456 wrote to memory of 1468 3456 cscript.exe 85 PID 3456 wrote to memory of 2848 3456 cscript.exe 87 PID 3456 wrote to memory of 2848 3456 cscript.exe 87 PID 3456 wrote to memory of 2848 3456 cscript.exe 87 PID 3456 wrote to memory of 3960 3456 cscript.exe 89 PID 3456 wrote to memory of 3960 3456 cscript.exe 89 PID 3456 wrote to memory of 3960 3456 cscript.exe 89 PID 3456 wrote to memory of 3504 3456 cscript.exe 91 PID 3456 wrote to memory of 3504 3456 cscript.exe 91 PID 3456 wrote to memory of 3504 3456 cscript.exe 91 PID 1764 wrote to memory of 2216 1764 cmd.exe 93 PID 1764 wrote to memory of 2216 1764 cmd.exe 93 PID 1764 wrote to memory of 2216 1764 cmd.exe 93 PID 1012 wrote to memory of 2208 1012 cmd.exe 94 PID 1012 wrote to memory of 2208 1012 cmd.exe 94 PID 1012 wrote to memory of 2208 1012 cmd.exe 94 PID 1468 wrote to memory of 2144 1468 cmd.exe 95 PID 1468 wrote to memory of 2144 1468 cmd.exe 95 PID 1468 wrote to memory of 2144 1468 cmd.exe 95 PID 1516 wrote to memory of 2080 1516 cmd.exe 96 PID 1516 wrote to memory of 2080 1516 cmd.exe 96 PID 1516 wrote to memory of 2080 1516 cmd.exe 96 PID 2848 wrote to memory of 3744 2848 cmd.exe 97 PID 2848 wrote to memory of 3744 2848 cmd.exe 97 PID 2848 wrote to memory of 3744 2848 cmd.exe 97 PID 3960 wrote to memory of 3756 3960 cmd.exe 98 PID 3960 wrote to memory of 3756 3960 cmd.exe 98 PID 3960 wrote to memory of 3756 3960 cmd.exe 98 PID 3504 wrote to memory of 2176 3504 cmd.exe 99 PID 3504 wrote to memory of 2176 3504 cmd.exe 99 PID 3504 wrote to memory of 2176 3504 cmd.exe 99 PID 3772 wrote to memory of 752 3772 cmd.exe 100 PID 3772 wrote to memory of 752 3772 cmd.exe 100 PID 3772 wrote to memory of 752 3772 cmd.exe 100 PID 752 wrote to memory of 3752 752 AcroRd32.exe 104 PID 752 wrote to memory of 3752 752 AcroRd32.exe 104 PID 752 wrote to memory of 3752 752 AcroRd32.exe 104 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 1248 3752 RdrCEF.exe 105 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 2024 3752 RdrCEF.exe 106 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 3648 3752 RdrCEF.exe 107 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 1572 3752 RdrCEF.exe 108 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 3812 3752 RdrCEF.exe 109 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110 PID 3752 wrote to memory of 1152 3752 RdrCEF.exe 110
Processes
-
C:\Users\Admin\AppData\Local\Temp\Information Civilized System Oy.exe"C:\Users\Admin\AppData\Local\Temp\Information Civilized System Oy.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Users\Admin\AppData\Local\Temp\Nevaeh.exe"C:\Users\Admin\AppData\Local\Temp\Nevaeh.exe" /run2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3872 -
C:\Windows\SysWOW64\cscript.exe"C:\Windows\system32\cscript.exe" //B Meredith.vbs3⤵
- Suspicious use of WriteProcessMemory
PID:3456 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\DiplomaticBag.pdf4⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3772 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\DiplomaticBag.pdf"5⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140436⤵
- Suspicious use of WriteProcessMemory
PID:3752 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=790CF48BD51F7219871719BAF1B906E6 --mojo-platform-channel-handle=1628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:27⤵PID:1248
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=538A2D54A8C5A986983D8E6C78669DE9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=538A2D54A8C5A986983D8E6C78669DE9 --renderer-client-id=2 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job /prefetch:17⤵PID:2024
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CFBC890BE21DD02BC74221125CE855D8 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CFBC890BE21DD02BC74221125CE855D8 --renderer-client-id=4 --mojo-platform-channel-handle=2076 --allow-no-sandbox-job /prefetch:17⤵PID:3648
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D1B30CBA8671C39B7B6591191E62933E --mojo-platform-channel-handle=2484 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:27⤵PID:1572
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F9CC6195CE56392F250E089091887B5E --mojo-platform-channel-handle=1860 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:27⤵PID:3812
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=67D554CD9A161D193E93D20A284D238D --mojo-platform-channel-handle=2488 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:27⤵PID:1152
-
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC MINUTE /MO 10 /TN Pollard /TR C:\Users\Admin\AppData\Local\Temp\Pollard.exe /F4⤵
- Suspicious use of WriteProcessMemory
PID:1764 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC MINUTE /MO 10 /TN Pollard /TR C:\Users\Admin\AppData\Local\Temp\Pollard.exe /F5⤵
- Creates scheduled task(s)
PID:2216
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC MINUTE /MO 70 /TN Sexton /TR C:\Users\Admin\AppData\Local\Temp\Sexton.exe /F4⤵
- Suspicious use of WriteProcessMemory
PID:1012 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC MINUTE /MO 70 /TN Sexton /TR C:\Users\Admin\AppData\Local\Temp\Sexton.exe /F5⤵
- Creates scheduled task(s)
PID:2208
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 2 /TN Beltran /TR C:\Users\Admin\AppData\Local\Temp\Beltran.exe /F4⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 2 /TN Beltran /TR C:\Users\Admin\AppData\Local\Temp\Beltran.exe /F5⤵
- Creates scheduled task(s)
PID:2080
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 8 /TN Wilcox /TR C:\Users\Admin\AppData\Local\Temp\Wilcox.exe /F4⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 8 /TN Wilcox /TR C:\Users\Admin\AppData\Local\Temp\Wilcox.exe /F5⤵
- Creates scheduled task(s)
PID:2144
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 8 /TN Lotermity /TR C:\Users\Admin\AppData\Roaming\HP\Lotermity.exe /F4⤵
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 8 /TN Lotermity /TR C:\Users\Admin\AppData\Roaming\HP\Lotermity.exe /F5⤵
- Creates scheduled task(s)
PID:3744
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c SCHTASKS /Create /SC HOURLY /MO 10 /TN Quichi /TR C:\Users\Admin\AppData\Roaming\LG\Quichish.exe /F4⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /Create /SC HOURLY /MO 10 /TN Quichi /TR C:\Users\Admin\AppData\Roaming\LG\Quichish.exe /F5⤵
- Creates scheduled task(s)
PID:3756
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c reg.exe add HKCU\Software\Classes\exefile\shell\open /v NoSmartScreen /t REG_DWORD /d 1 /f4⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\reg.exereg.exe add HKCU\Software\Classes\exefile\shell\open /v NoSmartScreen /t REG_DWORD /d 1 /f5⤵
- Modifies system executable filetype association
- Modifies registry class
- Modifies registry key
PID:2176
-
-
-
-