Analysis
-
max time kernel
608s -
max time network
564s -
platform
windows10-2004_x64 -
resource
win10v2004-es-20220112 -
submitted
10-03-2022 20:59
Behavioral task
behavioral1
Sample
FAC-DOC-2022-5KO6KTGI49FK4JFI5GTK59KII59FI4LO.pdf
Resource
win7-20220223-es
Behavioral task
behavioral2
Sample
FAC-DOC-2022-5KO6KTGI49FK4JFI5GTK59KII59FI4LO.pdf
Resource
win10v2004-es-20220112
General
-
Target
FAC-DOC-2022-5KO6KTGI49FK4JFI5GTK59KII59FI4LO.pdf
-
Size
120KB
-
MD5
78f5bdeef40b898c9311e8eb3f6ffa99
-
SHA1
a0fbfeea543b682b5786b8856ac62151f46bb12f
-
SHA256
8c4838099234cfad14a8b74c268477d16e0d31d1eeee5c9a00d688ae1fbf7082
-
SHA512
e19b7c423d5b82e7eaecc168d71867712222d781fc94ad691ebf3d14a9618a8806b55074884cc68c4bc67e436978f083ea0d178eac99eb37e9f7bc22c96587dc
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
Processes:
compattelrunner.exedescription ioc process File created C:\Windows\rescache\_merged\1910676589\3747560831.pri compattelrunner.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exeSDXHelper.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString SDXHelper.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
Processes:
SDXHelper.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily SDXHelper.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SDXHelper.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies data under HKEY_USERS 30 IoCs
Processes:
compattelrunner.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.BioEnrollment_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Win32WebViewHost_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkCaptivePortal_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CParentalControls_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.XGpuEjectDialog_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.FileExplorer_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.creddialoghost_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CloudExperienceHost_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CShellExperienceHost_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5Cmicrosoft.windows.narratorquickstart_8wekyb3d8bbwe%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AccountsControl_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.LockApp_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.CallingShellApp_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.PeopleExperienceHost_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.XboxGameCallableUI_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.ContentDeliveryManager_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppResolverUX_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AddSuggestedFoldersToLibraryDialog_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.MicrosoftEdgeDevToolsClient_8wekyb3d8bbwe%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AppRep.ChxApp_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.OOBENetworkConnectionFlow_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.SecureAssessmentBrowser_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AAD.BrokerPlugin_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.AssignedAccessLockApp_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.Search_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoftWindows.Client.CBS_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.Windows.FilePicker_cw5n1h2txyewy%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.AsyncTextService_8wekyb3d8bbwe%5Cresources.pri compattelrunner.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MrtCache\C:%5CWindows%5CSystemApps%5CMicrosoft.ECApp_8wekyb3d8bbwe%5Cresources.pri compattelrunner.exe -
Suspicious behavior: EnumeratesProcesses 36 IoCs
Processes:
AcroRd32.exeAdobeARM.exepid process 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 676 AdobeARM.exe 676 AdobeARM.exe 676 AdobeARM.exe 676 AdobeARM.exe 676 AdobeARM.exe 676 AdobeARM.exe 676 AdobeARM.exe 676 AdobeARM.exe 676 AdobeARM.exe 676 AdobeARM.exe 676 AdobeARM.exe 676 AdobeARM.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 744 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
AcroRd32.exeAdobeARM.exeSDXHelper.exepid process 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 744 AcroRd32.exe 676 AdobeARM.exe 1036 SDXHelper.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeAdobeARM.exeRdrCEF.exedescription pid process target process PID 744 wrote to memory of 2292 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 2292 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 2292 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 4040 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 4040 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 4040 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 3092 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 3092 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 3092 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 3668 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 3668 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 3668 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 4024 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 4024 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 4024 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 904 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 904 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 904 744 AcroRd32.exe RdrCEF.exe PID 744 wrote to memory of 676 744 AcroRd32.exe AdobeARM.exe PID 744 wrote to memory of 676 744 AcroRd32.exe AdobeARM.exe PID 744 wrote to memory of 676 744 AcroRd32.exe AdobeARM.exe PID 676 wrote to memory of 2824 676 AdobeARM.exe Reader_sl.exe PID 676 wrote to memory of 2824 676 AdobeARM.exe Reader_sl.exe PID 676 wrote to memory of 2824 676 AdobeARM.exe Reader_sl.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe PID 4024 wrote to memory of 3164 4024 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\FAC-DOC-2022-5KO6KTGI49FK4JFI5GTK59KII59FI4LO.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:2292
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4040
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:3092
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:3668
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=214B2B2593F1968759EEC7DBBA9BC7A1 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3164
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BD510B009C755787C72A80490A034F8A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BD510B009C755787C72A80490A034F8A --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:13⤵PID:2552
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=48B6A10B1A4003E1D3A4F7476FF1C7B8 --mojo-platform-channel-handle=1896 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3944
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=51CEC80B5AF08B81B4C62D022D960456 --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1040
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A338A3A7510DD93051BBC884345FFDCF --mojo-platform-channel-handle=2324 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2804
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:904
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:32⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵PID:2824
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:856
-
C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe"C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
PID:1036
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wsappx -p1⤵PID:944
-
C:\Windows\system32\compattelrunner.exeC:\Windows\system32\compattelrunner.exe -m:aeinv.dll -f:UpdateSoftwareInventoryW1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:4076
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1036-142-0x00007FFF4D570000-0x00007FFF4D580000-memory.dmpFilesize
64KB
-
memory/1036-143-0x00007FFF4D570000-0x00007FFF4D580000-memory.dmpFilesize
64KB
-
memory/1036-144-0x00007FFF4D570000-0x00007FFF4D580000-memory.dmpFilesize
64KB
-
memory/1036-145-0x00007FFF4D570000-0x00007FFF4D580000-memory.dmpFilesize
64KB
-
memory/1036-146-0x00007FFF4D570000-0x00007FFF4D580000-memory.dmpFilesize
64KB
-
memory/1036-149-0x00007FFF8D4F0000-0x00007FFF8D6E5000-memory.dmpFilesize
2.0MB
-
memory/1036-150-0x00007FFF8D4F0000-0x00007FFF8D6E5000-memory.dmpFilesize
2.0MB
-
memory/1036-152-0x00007FFF4D570000-0x00007FFF4D580000-memory.dmpFilesize
64KB
-
memory/1036-153-0x00007FFF4D570000-0x00007FFF4D580000-memory.dmpFilesize
64KB
-
memory/1036-155-0x00007FFF4D570000-0x00007FFF4D580000-memory.dmpFilesize
64KB
-
memory/1036-154-0x00007FFF4D570000-0x00007FFF4D580000-memory.dmpFilesize
64KB
-
memory/1036-156-0x00007FFF8D4F0000-0x00007FFF8D6E5000-memory.dmpFilesize
2.0MB