Office 365 User Guide.pdf

General
Target

Office 365 User Guide.pdf

Filesize

38MB

Completed

22-11-2021 22:47

Score
4/10
MD5

efb8b204af03a5365b9dc73b490dd4ae

SHA1

a508db1960f349244e94ca31921220a0568e343d

SHA256

89bad0c3167260263aff087c0d241ea1c167372585f57b4c555fea259b74e521

Malware Config
Signatures 10

Filter: none

Defense Evasion
Discovery
  • Drops file in Windows directory
    taskmgr.exe

    Reported IOCs

    descriptioniocprocess
    File createdC:\Windows\rescache\_merged\4183903823\1195458082.pritaskmgr.exe
    File createdC:\Windows\rescache\_merged\1601268389\3068621934.pritaskmgr.exe
  • Checks SCSI registry key(s)
    taskmgr.exe

    Description

    SCSI information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistryPeripheral Device DiscoverySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000taskmgr.exe
    Key opened\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000Ataskmgr.exe
    Key value queried\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyNametaskmgr.exe
  • Checks processor information in registry
    taskmgr.exeAcroRd32.exe

    Description

    Processor information is often read in order to detect sandboxing environments.

    TTPs

    Query RegistrySystem Information Discovery

    Reported IOCs

    descriptioniocprocess
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameStringtaskmgr.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0AcroRd32.exe
    Key value queried\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHzAcroRd32.exe
    Key opened\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0taskmgr.exe
  • Modifies Internet Explorer settings
    AcroRd32.exe

    TTPs

    Modify Registry

    Reported IOCs

    descriptioniocprocess
    Key created\REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATIONAcroRd32.exe
  • Suspicious behavior: EnumeratesProcesses
    AcroRd32.exetaskmgr.exe

    Reported IOCs

    pidprocess
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
  • Suspicious use of AdjustPrivilegeToken
    taskmgr.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege1240taskmgr.exe
    Token: SeSystemProfilePrivilege1240taskmgr.exe
    Token: SeCreateGlobalPrivilege1240taskmgr.exe
  • Suspicious use of FindShellTrayWindow
    AcroRd32.exetaskmgr.exe

    Reported IOCs

    pidprocess
    2368AcroRd32.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
  • Suspicious use of SendNotifyMessage
    taskmgr.exe

    Reported IOCs

    pidprocess
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
    1240taskmgr.exe
  • Suspicious use of SetWindowsHookEx
    AcroRd32.exe

    Reported IOCs

    pidprocess
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
    2368AcroRd32.exe
  • Suspicious use of WriteProcessMemory
    AcroRd32.exeRdrCEF.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 2368 wrote to memory of 40282368AcroRd32.exeRdrCEF.exe
    PID 2368 wrote to memory of 40282368AcroRd32.exeRdrCEF.exe
    PID 2368 wrote to memory of 40282368AcroRd32.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 7604028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
    PID 4028 wrote to memory of 21004028RdrCEF.exeRdrCEF.exe
Processes 9
  • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Office 365 User Guide.pdf"
    Checks processor information in registry
    Modifies Internet Explorer settings
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of FindShellTrayWindow
    Suspicious use of SetWindowsHookEx
    Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      Suspicious use of WriteProcessMemory
      PID:4028
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=68CE021AF125AB244F3F097E017453F5 --mojo-platform-channel-handle=1636 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:760
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BD3EBDA6C49E7ED7EA00AF6D03033D77 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BD3EBDA6C49E7ED7EA00AF6D03033D77 --renderer-client-id=2 --mojo-platform-channel-handle=1648 --allow-no-sandbox-job /prefetch:1
        PID:2100
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=15B89A67DAE9237B331F198FD4588D84 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=15B89A67DAE9237B331F198FD4588D84 --renderer-client-id=4 --mojo-platform-channel-handle=2080 --allow-no-sandbox-job /prefetch:1
        PID:3056
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9078922BB852EF05F34C0C654FCFD126 --mojo-platform-channel-handle=2580 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:3260
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=10333E1A385BF5E4BF88AC7BD0958327 --mojo-platform-channel-handle=1904 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:308
      • C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2C79327B1AE103D0077AC9668775097D --mojo-platform-channel-handle=1792 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        PID:2840
  • C:\Windows\system32\taskmgr.exe
    "C:\Windows\system32\taskmgr.exe" /7
    Drops file in Windows directory
    Checks SCSI registry key(s)
    Checks processor information in registry
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of FindShellTrayWindow
    Suspicious use of SendNotifyMessage
    PID:1240
Network
MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Replay Monitor
                      00:00 00:00
                      Downloads
                      • memory/308-141-0x0000000000000000-mapping.dmp

                      • memory/308-139-0x0000000077592000-0x0000000077593000-memory.dmp

                      • memory/308-140-0x0000000000BCA000-0x0000000000BCB000-memory.dmp

                      • memory/760-121-0x0000000000000000-mapping.dmp

                      • memory/760-120-0x000000000087A000-0x000000000087B000-memory.dmp

                      • memory/760-119-0x0000000077592000-0x0000000077593000-memory.dmp

                      • memory/760-123-0x0000000000180000-0x0000000000181000-memory.dmp

                      • memory/2100-125-0x0000000000000000-mapping.dmp

                      • memory/2100-127-0x0000000000A80000-0x0000000000A81000-memory.dmp

                      • memory/2100-128-0x0000000000E50000-0x0000000000E51000-memory.dmp

                      • memory/2100-124-0x0000000000E3C000-0x0000000000E3D000-memory.dmp

                      • memory/2100-122-0x0000000077592000-0x0000000077593000-memory.dmp

                      • memory/2840-145-0x0000000000000000-mapping.dmp

                      • memory/2840-144-0x0000000001327000-0x0000000001328000-memory.dmp

                      • memory/2840-143-0x0000000077592000-0x0000000077593000-memory.dmp

                      • memory/3056-130-0x00000000005CD000-0x00000000005CE000-memory.dmp

                      • memory/3056-131-0x0000000000000000-mapping.dmp

                      • memory/3056-129-0x0000000077592000-0x0000000077593000-memory.dmp

                      • memory/3260-137-0x0000000000000000-mapping.dmp

                      • memory/3260-136-0x000000000104C000-0x000000000104D000-memory.dmp

                      • memory/3260-135-0x0000000077592000-0x0000000077593000-memory.dmp

                      • memory/4028-118-0x0000000000000000-mapping.dmp