434d39bfbcee378ed62a02aa40acc6507aa00b2a3cb0bf356c0b23cc9eebcd77

General

Target

NewCovid-21/GEO-CFUND-2009_CCM Agreement_Facesheet - signed.pdf

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

AdobeCollabSync.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache AdobeCollabSync.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

AcroRd32.exeAdobeARM.exe

pid	process
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
4344	AdobeARM.exe
4344	AdobeARM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2564 AcroRd32.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

AcroRd32.exeAdobeARM.exe

pid	process
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
2564	AcroRd32.exe
4344	AdobeARM.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeAdobeCollabSync.exeAdobeCollabSync.exeRdrCEF.exe

description	pid	process	target process
PID 2564 wrote to memory of 3764	2564	AcroRd32.exe	AdobeCollabSync.exe
PID 2564 wrote to memory of 3764	2564	AcroRd32.exe	AdobeCollabSync.exe
PID 2564 wrote to memory of 3764	2564	AcroRd32.exe	AdobeCollabSync.exe
PID 3764 wrote to memory of 4696	3764	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 3764 wrote to memory of 4696	3764	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 3764 wrote to memory of 4696	3764	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 4696 wrote to memory of 1560	4696	AdobeCollabSync.exe	FullTrustNotifier.exe
PID 4696 wrote to memory of 1560	4696	AdobeCollabSync.exe	FullTrustNotifier.exe
PID 4696 wrote to memory of 1560	4696	AdobeCollabSync.exe	FullTrustNotifier.exe
PID 2564 wrote to memory of 4572	2564	AcroRd32.exe	RdrCEF.exe
PID 2564 wrote to memory of 4572	2564	AcroRd32.exe	RdrCEF.exe
PID 2564 wrote to memory of 4572	2564	AcroRd32.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 4716	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe
PID 4572 wrote to memory of 5064	4572	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\NewCovid-21\GEO-CFUND-2009_CCM Agreement_Facesheet - signed.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3764
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=3764
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:4696
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:1560
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E7FC506B54832952A531EF3023588DAB --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4716
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B2AE70CE95EB67FA4F8E2935FE6A756E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B2AE70CE95EB67FA4F8E2935FE6A756E --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:5064
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=13E17D06597AF33A7B3AD42E0C699FA2 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2404
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=FEE2B389CB40883182C10127B3981A70 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=FEE2B389CB40883182C10127B3981A70 --renderer-client-id=5 --mojo-platform-channel-handle=2436 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1780
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D085E3E5A36CF18B538A14813A9F0C5B --mojo-platform-channel-handle=2488 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2388
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D34F45478D8FFB8A57132E00A54C1A7F --mojo-platform-channel-handle=2684 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:216
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=400A08C43339E757057F4B8D95508A79 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=400A08C43339E757057F4B8D95508A79 --renderer-client-id=10 --mojo-platform-channel-handle=2544 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4424
- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
  "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4344
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
    3⤵
    PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\DesktopNotification\NotificationsDB\notificationsDB

MD5
4fe2b64a2631d0d6eb30b8f42b49bcf5

SHA1
10c931554e79c2f4280a65ef2ad57ff61a2429ec

SHA256
4901703febb24c665059d25ae6d0769c55051bcdc1b7a72b600252d4c3b0eca0

SHA512
8ad48178aa8d835e0c2028688e41f575e50e21b6b4b59161d08984c300911fda1a4614738bfa5557c3f2d254373a61497b491cbc7fb163afea2dbe08fcb67004

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

MD5
245950c48f668cf2fcb3c64778e64089

SHA1
3a5a14c820f58e35a3fc6f5de29669f0840587d8

SHA256
a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307

SHA512
4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

MD5
aebe0d2eb7a2077a55e57a955e62406a

SHA1
3f811b8148f12220f4b45699135e6d21c9847d8a

SHA256
87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a

SHA512
efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

MD5
dc308c29edd7b9094243a4a5cb551866

SHA1
78440b31106293d7fb09ed88f7368c5cdfd65aed

SHA256
79234180a427fa3ca7d048a629f22b06ee3f1951bb57c03f8795428479bae455

SHA512
9278f2842bcb97734854353bb8af5b50a04fbce289035d6423a06e2be28995cd2f1a432674505e865db7617dbbf8ffca1331fa18fcf8cf014da33fab72e03db3

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer

MD5
f8e09c3eba3c2d35715a9f48efda3f71

SHA1
b863850a3fa8686b7cf62d7405964c8441eacb43

SHA256
529ed796bf786e2e8050052ed240da95c94456178679de5671a023b029174491

SHA512
a4cb6270a0b10e7a1893b53fadb47e5876ac0d3e751886087ca31c353cc53a567ac9a2edeaa70210bcffead48bab687f6e87e2ef428e319aee0af6c848b1a1c6

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18

MD5
80f4f1ec13e3ba864f9710c64f17b321

SHA1
78439506d2ecf9b5274c2c8a71267dcc58dd4298

SHA256
bdb32cc10a1f4b5fdedd154549a4d73fa942fad070d67b6ecbcf1e26772e35d5

SHA512
f4703566b9e5b9f1d06553aed48a463cb684f8a047e2e2575faaeb86b9a2d298820fbe76a00230f1b321f2db57ef419fb734d58da4d4a22f090115c0ee4b8e1d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6

MD5
f559a48914f4387d0ce694900aba093a

SHA1
afae9b1e7171098762f603d4b5523b53e7505ba4

SHA256
b7dd1af74b1ef739821d80c6cc051bec0262df706986216df424cc50e68daa6e

SHA512
e46ffae3d245f92d48495080a88bbcea977349acc24fd2d12c3e632a7c8a2135e90ff1a550395d55e706e234e5ec36149e23a1848b7b9ab633b90b9b3b3c1848

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_D975BBA8033175C8D112023D8A7A8AD6

MD5
5e3f50123277271d6bb310a132b26919

SHA1
ec1533b7c4a7eb8fc70b004a032d10c2ca2fa47d

SHA256
584989134d3c447c2bc90b3cc9486c7da9b0dfa5486ab57c7f08c58004e2f4d2

SHA512
8ddbf56edeb1f792e51561f7a40317503d9abb408ff33088cfff638c44a099d41782bf14aa80164bcba12786b10679d074ab98e8bbd64e35d4ee3ca21b2e91f0

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads