Analysis
-
max time kernel
150s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
21-11-2020 23:28
Static task
static1
Behavioral task
behavioral1
Sample
HurricaneElectricNetworkMap.pdf
Resource
win7v20201028
Behavioral task
behavioral2
Sample
HurricaneElectricNetworkMap.pdf
Resource
win10v20201028
General
-
Target
HurricaneElectricNetworkMap.pdf
-
Size
1.5MB
-
MD5
14a6e1b098a715ee0240b8f0900a2f29
-
SHA1
6a968e770ce677a37ff1a752bf2ed6aaa94c2c1d
-
SHA256
a92bfc3cf541fc4fe9362c6361faeb2f7fed0855eb8171d176e3a61989da99ee
-
SHA512
168c2fce8a90327993d78b090aa1d5092b558782ddf30e7c05a10bb6575120058532a5e10b5adb9f9975cba1c8dbea301e9e72954ad65f38b036aa8c2c84a3d8
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 4 IoCs
Processes:
printfilterpipelinesvc.exedescription ioc process File created C:\Windows\system32\spool\PRINTERS\PP8s2a42c98uex7ib24bdmf92zb.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPqg10p1wkidb74zapjzfwxyfxc.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPp00roxzejg5m1wsf1vi2uda9b.TMP printfilterpipelinesvc.exe File created C:\Windows\system32\spool\PRINTERS\PPml2m_ftim0pfe_ckc2bwdgscd.TMP printfilterpipelinesvc.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
firefox.exeAcroRd32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature firefox.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision firefox.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 firefox.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 33 IoCs
Processes:
AcroRd32.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000007800000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000 AcroRd32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}" AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1" AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\NodeSlot = "2" AcroRd32.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents" AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = 00000000ffffffff AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202 AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\IconSize = "16" AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1" AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000 AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 14001f50e04fd020ea3a6910a2d808002b30309d0000 AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656} AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupView = "0" AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:PID = "0" AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0\MRUListEx = ffffffff AcroRd32.exe Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\0 = 14002e80922b16d365937a46956b92703aca08af0000 AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4" AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\LogicalViewMode = "1" AcroRd32.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616257" AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell AcroRd32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg AcroRd32.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2 AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
AcroRd32.exepid process 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 3940 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 11 IoCs
Processes:
AcroRd32.exepid process 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe 3940 AcroRd32.exe -
Suspicious use of WriteProcessMemory 307 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 3940 wrote to memory of 200 3940 AcroRd32.exe RdrCEF.exe PID 3940 wrote to memory of 200 3940 AcroRd32.exe RdrCEF.exe PID 3940 wrote to memory of 200 3940 AcroRd32.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 1456 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe PID 200 wrote to memory of 2104 200 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\HurricaneElectricNetworkMap.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D16D460A47AC5CDF1B13FA2B57EC40AA --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=4C604B5BF96F63EF587903D1B53F9137 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=4C604B5BF96F63EF587903D1B53F9137 --renderer-client-id=2 --mojo-platform-channel-handle=1640 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=23CADF96DA7F5E45F6FA5149EC024AB0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=23CADF96DA7F5E45F6FA5149EC024AB0 --renderer-client-id=4 --mojo-platform-channel-handle=2208 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4FBFA5163F9061A5D54F30A26A03565C --mojo-platform-channel-handle=2460 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2BC114F7AA73607618D7638D5E66D486 --mojo-platform-channel-handle=1832 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=616902306F2DC4AC97EC260848169AE7 --mojo-platform-channel-handle=2020 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1B5FAF94127C6ADE4AAE5E5ACF394641 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1B5FAF94127C6ADE4AAE5E5ACF394641 --renderer-client-id=10 --mojo-platform-channel-handle=2520 --allow-no-sandbox-job /prefetch:13⤵
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵
-
C:\Windows\system32\printfilterpipelinesvc.exeC:\Windows\system32\printfilterpipelinesvc.exe -Embedding1⤵
- Drops file in System32 directory
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {c82192ee-6cb5-4bc0-9ef0-fb818773790a} -Embedding1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/64-238-0x0000000000000000-mapping.dmp
-
memory/184-14-0x00000000779D2000-0x00000000779D200C-memory.dmpFilesize
12B
-
memory/184-15-0x0000000000000000-mapping.dmp
-
memory/200-0-0x0000000000000000-mapping.dmp
-
memory/1456-2-0x0000000000000000-mapping.dmp
-
memory/1456-1-0x00000000779D2000-0x00000000779D200C-memory.dmpFilesize
12B
-
memory/1512-24-0x0000000000000000-mapping.dmp
-
memory/1512-23-0x00000000779D2000-0x00000000779D200C-memory.dmpFilesize
12B
-
memory/2104-4-0x00000000779D2000-0x00000000779D200C-memory.dmpFilesize
12B
-
memory/2104-5-0x0000000000000000-mapping.dmp
-
memory/2176-9-0x00000000779D2000-0x00000000779D200C-memory.dmpFilesize
12B
-
memory/2176-10-0x0000000000000000-mapping.dmp
-
memory/2340-21-0x0000000000000000-mapping.dmp
-
memory/2340-20-0x00000000779D2000-0x00000000779D200C-memory.dmpFilesize
12B
-
memory/2740-18-0x0000000000000000-mapping.dmp
-
memory/2740-17-0x00000000779D2000-0x00000000779D200C-memory.dmpFilesize
12B
-
memory/4056-54-0x0000000003A60000-0x0000000003A61000-memory.dmpFilesize
4KB
-
memory/4056-43-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/4056-44-0x0000000002D90000-0x0000000002D91000-memory.dmpFilesize
4KB
-
memory/4056-42-0x00000000025B0000-0x00000000025B1000-memory.dmpFilesize
4KB
-
memory/4056-56-0x0000000003BE0000-0x0000000003BE1000-memory.dmpFilesize
4KB
-
memory/4056-58-0x0000000003A60000-0x0000000003A61000-memory.dmpFilesize
4KB
-
memory/4056-71-0x00000000022B0000-0x00000000022BD000-memory.dmpFilesize
52KB
-
memory/4056-72-0x0000000003940000-0x0000000003A40000-memory.dmpFilesize
1024KB
-
memory/4056-88-0x0000000003940000-0x0000000003942000-memory.dmpFilesize
8KB
-
memory/4056-41-0x0000000000000000-mapping.dmp