13ecb35ec660161bb8b41e544eb5e4c58a51e60451fc809d04d49934135df044

General

Target

LifeShare Transplant Donor Services of Oklahoma, Inc. CM58575719.pdf
Size

71KB
MD5

e747f346756c4bec0b2ee92b4c3d099a
SHA1

8ebf4f7b38084f8f287676a12a487b46eecfa2e8
SHA256

117d2913e9435d6dd6f94ff391e741aed9ae716b66950c41ebd292c2f61a6ea7
SHA512

3362f7cceffbd18cbe9d9cb2e2713aac5ca0b602818f379f6bad17c2a3f61ce41dada37f01f8df0b5475cbd25e3add69b2cb49069063dcb7356b97cb4a7d30c0

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

Processes:

AcroRd32.exe

pid	process
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

AcroRd32.exe

description pid process

Token: SeSecurityPrivilege 2680 AcroRd32.exe
Token: SeTakeOwnershipPrivilege 2680 AcroRd32.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2680 AcroRd32.exe

description	pid	process
Token: SeSecurityPrivilege	2680	AcroRd32.exe
Token: SeTakeOwnershipPrivilege	2680	AcroRd32.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

AcroRd32.exeAdobeARM.exe

pid	process
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
2680	AcroRd32.exe
4948	AdobeARM.exe
2680	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2680 wrote to memory of 2520	2680	AcroRd32.exe	RdrCEF.exe
PID 2680 wrote to memory of 2520	2680	AcroRd32.exe	RdrCEF.exe
PID 2680 wrote to memory of 2520	2680	AcroRd32.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 4772	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe
PID 2520 wrote to memory of 3420	2520	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\LifeShare Transplant Donor Services of Oklahoma, Inc. CM58575719.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:2520

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=79EA74683DD5D2AC182F8882CC3ECE9C --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4772

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E6DB5F1CA70298FD8CC2C403287C25A9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E6DB5F1CA70298FD8CC2C403287C25A9 --renderer-client-id=2 --mojo-platform-channel-handle=1772 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3420

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D2615DB08362E23C2044CF271CA986AA --mojo-platform-channel-handle=2320 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3200

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=422F5AB5CF44D315D40F5D65A0E5B445 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=422F5AB5CF44D315D40F5D65A0E5B445 --renderer-client-id=5 --mojo-platform-channel-handle=2436 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4224

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=298CBFC2A67E2EBB89AD36893B004BCD --mojo-platform-channel-handle=2396 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4328

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=816264F502485651D565F9CB2D069F41 --mojo-platform-channel-handle=2692 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1832

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=21D6387B1BC94398FF3BCF892C167612 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=21D6387B1BC94398FF3BCF892C167612 --renderer-client-id=10 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4104

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:3
2⤵
- Suspicious use of SetWindowsHookEx
PID:4948

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
3⤵
PID:4504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads