ModuloConfermaIndirizzo_2016_56.zip

General
Target

ModuloConfermaIndirizzo_2016_56.pdf

Filesize

89KB

Completed

16-11-2021 12:06

Score
4/10
MD5

3e4e9232f4a973055eef13a2692ffc54

SHA1

94cc703064b56a0416d884be1bf6a2edb66521c1

SHA256

445f1576ff067209bd366064032e5826ef4b3b0e6b299184443053be75e49289

Malware Config
Signatures 11

Filter: none

Defense Evasion
Discovery
  • Drops file in Windows directory
    MicrosoftEdge.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\rescache\_merged\3720402701\2274612954.priMicrosoftEdge.exe
    File opened for modificationC:\Windows\Debug\ESE.TXTMicrosoftEdge.exe
    File createdC:\Windows\rescache\_merged\3720402701\2274612954.priMicrosoftEdgeCP.exe
  • Checks processor information in registry
    AcroRd32.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0AcroRd32.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzAcroRd32.exe
  • Modifies Internet Explorer settings
    AcroRd32.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATIONAcroRd32.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\MainMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\Mainbrowser_broker.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Internet Explorer\MainMicrosoftEdgeCP.exe
  • Modifies registry class
    MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptioniocprocess
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\SyncIEFirstTimeFullScan = "1"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionLow = "0"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus\SignaturePolicy = 06000000MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigrationMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\CacheMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\IETld\LowMicMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-Revision = "0"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatusMicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 9bfc200846ddd701MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Explorer\MainMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\SettingsVersion = "2"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000005ed7d351a810fad5f050a01c6bcc123286a57bcd3c3630600d30b5509b3eeebee71edbc7135a7c398814d16972a1bb89e5c7ee1451f0cb7927a2fda6a607d6821a63a0217bacf85f56bd77f3dfff6a5ecbb2988e6ad1c77bafedMicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 010000000946c816a93083c0d3ac81296284e8fb9919bd5ced059471fe3cc10ec2a313df704bbe8572c048dd631dbafc1ee457e4c10e94d011365f7e6e471aa2MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\ZonesMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPUMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible CacheMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CacheLimit = "256000"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\ExtensionsMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\DXFeatureLevel = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Cookies\CacheLimit = "1"MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingRecovery\Active = "0"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ZoomMicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = 0100000030b2d81432488167ae5369f945d03b04f0819447e5e8c9210f405bf7d7964217837e1a2eed017a3c01c51fb56897344c0fcd817d4b276fd5a1259d5f2c06d7c7f7d02a08e52ca2f17be5e4b853577f12a92d9e0906260ca32fc87f732b3ef397cac7a1f06e6830c603d235cefdafe963ccc21d7f5f86faa2a647017ad1df17055083bf72d354bd104aac12fbe541d7c914addc0d87e795e347c4dd645e8ab1de1924742b3592a8c32993b633fbac99de6f0c31c0eae91fb7855dfcede5dd8fecd7c98bed0ec118fe6da7642cd3908975e500f807912ca00a1334a789387a2e1599946a378980bdaf20081fead88dcc50ada9e197ff5033d4c667052871ff051f70a447f57371d0496ad6f66ef1430868442843931df6f089611829c2ae0d1c0016197c98723349821531bb7c0e52b0bf119b9b093cbcacaeb765c9be2245ebbc3f13b478fe6598270939a820345a03cda723b8c22343e76c2c709d1eda4535d2eeb18f8c24a90802cf0e650a46fb0c7069e17a5bfa2bc93d94570d8163afc23ae3159f6a669eb2c5e9d07fb358d5d87756f3a8b0c914caa83d7ee9971c53f5823c3988ba8887MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionHigh = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionHigh = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-DXFeatureLevel = "0"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet SettingsMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\CookiesMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\DatastoreSchemaVersion = "8"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-SubSysId = "0"MicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\AdapterInfo = "vendorId=\"0x1414\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\CookiesMicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery\PendingDeleteMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ToolbarMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\ExtensionIMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\PrivacyAdvanced = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Roaming\ChangeUnitGenerationNeeded = "1"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Toolbar\WebBrowserMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify = "1"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Explorer\MainMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\CacheMicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\IsSignedIn = "0"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\PrivacyMicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\ImageStoreRandomFolder = "mv5del7"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\SubSysId = "0"MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VendorId = "0"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = 243fec0646ddd701MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatusMicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\DynamicCodePolicy = 05000000MicrosoftEdgeCP.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\AllComplete = "1"MicrosoftEdge.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\ACGStatus\DynamicCodePolicy = 00000000MicrosoftEdgeCP.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\ContentMicrosoftEdgeCP.exe
    Set value (data)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = 25b0743d06c1d701MicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersio = "1"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrderMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1"MicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistryMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\LowRegistry\DOMStorageMicrosoftEdge.exe
    Key created\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventoryMicrosoftEdge.exe
    Set value (int)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\LastClosedWidth = "800"MicrosoftEdge.exe
    Set value (str)\REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs\url5 = "https://twitter.com/"MicrosoftEdge.exe
  • Suspicious behavior: EnumeratesProcesses
    AcroRd32.exe

    Reported IOCs

    pidprocess
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
  • Suspicious behavior: MapViewOfSection
    MicrosoftEdgeCP.exe

    Reported IOCs

    pidprocess
    4000MicrosoftEdgeCP.exe
  • Suspicious use of AdjustPrivilegeToken
    MicrosoftEdge.exeMicrosoftEdgeCP.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2940MicrosoftEdge.exe
    Token: SeDebugPrivilege2940MicrosoftEdge.exe
    Token: SeDebugPrivilege2940MicrosoftEdge.exe
    Token: SeDebugPrivilege2940MicrosoftEdge.exe
    Token: SeDebugPrivilege3196MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege3196MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege3196MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege3196MicrosoftEdgeCP.exe
    Token: SeDebugPrivilege2940MicrosoftEdge.exe
  • Suspicious use of FindShellTrayWindow
    AcroRd32.exe

    Reported IOCs

    pidprocess
    2636AcroRd32.exe
  • Suspicious use of SendNotifyMessage
    AcroRd32.exe

    Reported IOCs

    pidprocess
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
  • Suspicious use of SetWindowsHookEx
    AcroRd32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exe

    Reported IOCs

    pidprocess
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2940MicrosoftEdge.exe
    4000MicrosoftEdgeCP.exe
    4000MicrosoftEdgeCP.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
    2636AcroRd32.exe
  • Suspicious use of WriteProcessMemory
    AcroRd32.exeRdrCEF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2636 wrote to memory of 39442636AcroRd32.exeRdrCEF.exe
    PID 2636 wrote to memory of 39442636AcroRd32.exeRdrCEF.exe
    PID 2636 wrote to memory of 39442636AcroRd32.exeRdrCEF.exe
    PID 2636 wrote to memory of 37442636AcroRd32.exeLaunchWinApp.exe
    PID 2636 wrote to memory of 37442636AcroRd32.exeLaunchWinApp.exe
    PID 2636 wrote to memory of 37442636AcroRd32.exeLaunchWinApp.exe
    PID 2636 wrote to memory of 28842636AcroRd32.exeRdrCEF.exe
    PID 2636 wrote to memory of 28842636AcroRd32.exeRdrCEF.exe
    PID 2636 wrote to memory of 28842636AcroRd32.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 24403944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
    PID 3944 wrote to memory of 37243944RdrCEF.exeRdrCEF.exe
Processes 15
  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\ModuloConfermaIndirizzo_2016_56.pdf"
    Checks processor information in registry
    Modifies Internet Explorer settings
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2636
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      Suspicious use of WriteProcessMemory
      PID:3944
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=713AE345BBB855AD9F8B8A81BF40D6A6 --mojo-platform-channel-handle=1624 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:2440
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CE740C5632524624A67C1240BCB9AE6F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CE740C5632524624A67C1240BCB9AE6F --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:1
        PID:3724
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7824E9C5A2330FE58B9EC62AD2423FA1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7824E9C5A2330FE58B9EC62AD2423FA1 --renderer-client-id=4 --mojo-platform-channel-handle=2060 --allow-no-sandbox-job /prefetch:1
        PID:2328
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8A48FD0F5AB1884F03D44CB2AA67AE29 --mojo-platform-channel-handle=1656 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:1540
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=CE47F7E438714C53C2F41AD19EC533F8 --mojo-platform-channel-handle=2544 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:1300
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2789AF1145F3726427BDDF32B249A7BD --mojo-platform-channel-handle=1820 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:984
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B0E8BC917D3B527282B0985E04779DD1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B0E8BC917D3B527282B0985E04779DD1 --renderer-client-id=10 --mojo-platform-channel-handle=1852 --allow-no-sandbox-job /prefetch:1
        PID:3832
    • C:\Windows\SysWOW64\LaunchWinApp.exe
      "C:\Windows\system32\LaunchWinApp.exe" "http://www.b-soft.it/FOTO/DHL/ModuloConfermaIndirizzo_2016.exe"
      PID:3744
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      PID:2884
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
    Drops file in Windows directory
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of SetWindowsHookEx
    PID:2940
  • C:\Windows\system32\browser_broker.exe
    C:\Windows\system32\browser_broker.exe -Embedding
    Modifies Internet Explorer settings
    PID:1368
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Modifies registry class
    Suspicious behavior: MapViewOfSection
    Suspicious use of SetWindowsHookEx
    PID:4000
  • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
    "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
    Drops file in Windows directory
    Modifies Internet Explorer settings
    Modifies registry class
    Suspicious use of AdjustPrivilegeToken
    PID:3196
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/984-144-0x0000000000000000-mapping.dmp

                      • memory/984-142-0x0000000077242000-0x0000000077243000-memory.dmp

                      • memory/984-143-0x0000000000E49000-0x0000000000E4A000-memory.dmp

                      • memory/1300-138-0x0000000077242000-0x0000000077243000-memory.dmp

                      • memory/1300-140-0x0000000000000000-mapping.dmp

                      • memory/1300-139-0x000000000057D000-0x000000000057E000-memory.dmp

                      • memory/1540-135-0x0000000000F82000-0x0000000000F83000-memory.dmp

                      • memory/1540-134-0x0000000077242000-0x0000000077243000-memory.dmp

                      • memory/1540-136-0x0000000000000000-mapping.dmp

                      • memory/2328-129-0x0000000000FC2000-0x0000000000FC3000-memory.dmp

                      • memory/2328-130-0x0000000000000000-mapping.dmp

                      • memory/2328-128-0x0000000077242000-0x0000000077243000-memory.dmp

                      • memory/2440-120-0x0000000000000000-mapping.dmp

                      • memory/2440-119-0x0000000000414000-0x0000000000415000-memory.dmp

                      • memory/2440-118-0x0000000077242000-0x0000000077243000-memory.dmp

                      • memory/2440-121-0x0000000000420000-0x0000000000421000-memory.dmp

                      • memory/2884-117-0x0000000000000000-mapping.dmp

                      • memory/3724-126-0x0000000000460000-0x0000000000461000-memory.dmp

                      • memory/3724-124-0x0000000000000000-mapping.dmp

                      • memory/3724-123-0x0000000000CBA000-0x0000000000CBB000-memory.dmp

                      • memory/3724-122-0x0000000077242000-0x0000000077243000-memory.dmp

                      • memory/3724-127-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

                      • memory/3744-116-0x0000000000000000-mapping.dmp

                      • memory/3832-148-0x0000000000000000-mapping.dmp

                      • memory/3832-146-0x0000000077242000-0x0000000077243000-memory.dmp

                      • memory/3832-147-0x000000000124D000-0x000000000124E000-memory.dmp

                      • memory/3944-115-0x0000000000000000-mapping.dmp