Analysis
-
max time kernel
158s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220310-en -
submitted
18-03-2022 21:36
Behavioral task
behavioral1
Sample
Deuda_Pendiente.pdf
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
Deuda_Pendiente.pdf
Resource
win10v2004-20220310-en
General
-
Target
Deuda_Pendiente.pdf
-
Size
38KB
-
MD5
f24013302c99b27bf4bb4929de808f46
-
SHA1
5816c6e9d39aa7d4871d8b50a19457c3089899bc
-
SHA256
bd6a7d7eb475c40c163eb9ade7adcf74a7c444c051a14614b18acad07966a951
-
SHA512
12c71d36b4d3b89edcb77f7b0361bee910779949bb2e0bf7f30498d6196b9f5e2b6df9d4f24fc312cd7fe42da7437acea4a1520506cfd96421e8053d9b1e6c73
Malware Config
Signatures
-
Drops file in Windows directory 6 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\LZOCjtiHKk8= svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT6DDB.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\a3f602ea4d534d006919a2613d91f9506b383314 svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT728F.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\BIT734C.tmp svchost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\17087e6e4710e63df4fcd8834f70bc99\pj5OoD7hJ+dBGy+3XOjLT8WsuYwervv\BIT6791.tmp svchost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2403053463-4052593947-3703345493-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies data under HKEY_USERS 6 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Property svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Property\001800080B25BAF4 = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e00000000020000000000106600000001000020000000c6480b7f31231748e08c0a1e5f13c2c4bda9d13c422b11724c60fc1e4c9b7d62000000000e800000000200002000000093443209b95e9e726690e2beaef59e48c004eac3cc744b4abb649eda16128aad8000000092edd69b4407c48e21d8ee45018775d8ef23ae6e1a586010e1526b60987a96b1166aaaaba4962c0e84292371cd5c9392596c83ad9eb2b91b52e8de77314245cb78dfd23adc90afbccff6b9e130344171c7385ae6642260ec50ebe5605a2d44d07b3c7e19108c340c67c06a7c1c1c013b656c5a00d36e919dd2be2c003abf981a40000000abb81ac11896e89f04e010539775fc6dd6f2b7f18dcd386ff79fcd14ce7964f6556705e22733d86ea58acdf0d6e0cc84d8f86b00b68542742cc641c4ade88161 svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5} svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceTicket = 0100000001000000d08c9ddf0115d1118c7a00c04fc297eb01000000d79ef4adb8e2df4e96c16fb9ef12577e0000000002000000000010660000000100002000000088c858b5d827819fb531e589dc8edab94d218d0d32adb70abda9c2368c1714c3000000000e8000000002000020000000aa5c9b1eac9d823d02395bed9154e23d994c8a807be0be7f38c724edea09152a200d000011a9e69ca591bfcf7c357ae477a75845e57e4c65ce4b08d6496ea3a20a10ff0992f68fe5faef85b1d6e7075c3403dfa9660d9dab9179aff0f857cbbc6930120a4aa9766c81a1c56a6964866d0c45dfc46cd3790ea5607829cc3cbf8f88bbc8ca90b32bf2545429ad1fdc9ef3ff0152ea12ffdd930d9f4336350a3917edcb71fd57e0ee73700ffe90b8ac9c62f99a6024713adcb033fcd5858a168bada0a879ed5254adc8e2d8f76503b95b9f612ec4fffc4697e6eb3bff2e1513d7d193b27334beaa8e8f4870666fa8901fc6ae7bbf12eaab0d4fab54c0bc7e98d3574f3b9be0c17975e6acda952d91db03c7f18e0e30ce3c8a36357bf1e1da966d1efd21c4f93f9b9c05b7c958a14c23abbe143ae50e9c9e0854b92d331a5b91966f327e1e4e2f98afa22eb900aa4d67c06f31d267eb2078a61400925ad430b763af0eeb0dce4e221fb31726dc9d40dc5ee97a5745b21238a21dff2e5c52413b9939193783e806aaf64f734aaccad11c81af0e19ff2e187d434834644ad266861b19cfec95ddb06f7f16888862e42f4768bcb1d17f9b673056396d6055a533aa4976518d615e0fe49fb962869487021c80f0eafe735e430b79fe3f40691fe3de17ab7ca73147cc47cc198cd2c4f72c56b5a65005594386e7fcecb27f74d9e4acad34731aca8d0fe04965980c74e049fb6ecbbd849cfa29e8d31a8d4cfb932b69e13679ab0ece0589c7d7725f89f7045260668a988e9771549fb71a33b2dce405ef306566f10b9ad3257369bcd3c44f66e155301ef5b8c02650a8e21ea818f73a36e6c9d9b30ea6925de08edfa043cf35e95ced8ac6c67239040e689a5b13fecfbd68adaf5e2d3a75fdaa657d28fb11e605ab77c1723732b3b28493ccc1e757f3147086968d1d13a79b974a07c53006c938bc91c6b0f80e58b19aa18d21530cc915eae95536ce969c36a1cae8b81aebcfca3065600793a0970282f4947abe18f2785d64bd577d9b74811dbc34ea883da5f5aadb684fa6dcd62889cefa3854169143278fdfe4aff519b6f0b4f93d80841cdfa00d9c944a99a9d72690552c79803ab3d0806a1f3c4930f69f5a009893f20e52d3f04f015d27bd48b9228336885c1450212ef55c3c69444ebe36eba25d5ac0dc37dd12ac220faa65218b3274565d956b0aa39e7b94cf6d371ebf03d968f531eae2b737047b004af9e98a8fecad7a287fd0642a9fef86ed3361f6aa9a659b12a08b4bed432c35600b80cd736a5b48c7ebd4c6d03a684c694050f2c1afdb0167fad1688d650f75194aeac98fb638ed3a969b9aeae436f10315dbac178e3965863f5776a00966cdab756f212cf3ac38df5f37013378dfdd88df73ac1f0343aed08de4d04031d9b98440836085e58c4676d97e2e658f09676165776852aba7148f84701e0a973ad90e1c51f9a7fd014fb833255f8eeb3c036df01f5d2d15acfe6f221eead2a3a1a5c6df87f2b140611530fac4ee7ceea3373cc01c19c51623a9007426a82a9b225fbbf52451905907878f9ee3cfb235159847455c84aa0717184c9ad139f7008bbf927df15ea38c1ac221f86d0f8abbeb1845eeac27697af9ce28547ba08ed2040e4853526c943c92336d98f6166d594f1e592d9483c862c2e00a20f3a74a576c8f26cc1655c35c24df379c78ec2d9d71042783000dbceebe87a10750743c132c9b495c84a362951ab5e0025b324ebf018f9771a2cac2981c7d77a1604ab70cc8405a1e3a580de759ef53a06edc11af366e9201c6864e228726103db3d15536a53eb199a6868367293dad355a2e60cf4cf844cde5dc0e3f3e8a815ed15cfa070ee93a5a7cb13c2d88a978d60d7e9c73cdc975e655ded9dad4bbb676dbe0ccf7d6ee88389d0954dea05807f176ccac7b665a0e75042ecc5f0ff026a88eb8f8b4ef3b637125bacf74aa107ab0d877a88b734631d436cd38264b760bf96e4d6024da039a0ee4d1bbcdcf6226e2b29e98b412cfae9855bff9177983749b8893235389f5a306dee95b2b81907d3511b034ce3df52716eb0d6b0b958b6e7a70dcd9a19c7eb604ff7241d0dde2c4af8c375dd60a3670f80928766582fb5928b0c9c576ab68a753d630980461403519d51ec5a668df1437475cf79046abf1b6af60b569962f9340e7df5f264732caf32660f4286f893065474ef036e0f351d7a5a0b0db725e0ed6a52c26e98206b26a61416bfe1d7bb937af4cc77b4f4b7ebc52630d86f6a118506d2a4cc40d131504a546b91240284b110a82fd5c4151749f3e4f00e04266febd9392d42a4a8497ff7e4f1207d229af93c07c045e65588ff3aa0aced32ded570f917400c9f359715067c5c797578abb241495b3ad8fd1f4e5c47ff89125deabd75bf753199fc278b99f576bae43c48e43e904ce1679c4ac0d69ecabe3ff0c9efa77e78db3710aca3f20e43c39f2a538d5ded39d8734e550e7eb0390d8e7425376b80827f84ada9b74016cf86a8ddee8402b2329083ef32fceff55a3ac9072482e2ae8fe4d6ed711900f0984061e2eea7b5275523b21740cd09f37778259846555bd59fd1be1572db438bf00e9725210c6d2ecf7e6fbb2554c02c573a5a0d456d7968ddaf210975d599a3a621f0ccc4c1315a9883718ea8175144944a059adc24b7645509dd87daf1bde42ea63c9ba31195d5e7edad38601413ce4b30b2bc37490396a3ce55b3b56645032c0808d87d728b6c24b4c0704ba6a902992b83c7be579164c307c19e7fa7ee720a77af8167d898cb8560718247f055fad7ea1d01de652a9e710418cf753311b55293528b2bfc0c84fd8b71ab38e274bbd86102116404ee30cca630721984989e72784d957c88d5ef7fdfcd4e767a32207fe527c17d4c62406f1f5321c5e2f43d0f70b73f6a4dddb357931ac8ec57a3841f30d1b3ca473b86282d3e642269e46161441ead857c169340a3cdf8615f18d97019d76fa0b0cb20a3f1709960471af8f3bbb3284e97c55dcdbfafd15e491af4e4417826bc5867170ad89fe9a44cc153c08cf3ff5d943cec06af15bcb1b57d937d1559cf91a31238f3483e1a70d71961619babc1d1d5606b6456e929d58a9ef95a80edd86dc0b1c91a567d89d0b75444babdde65c77ae0e53267ad5117fc48ed2d3ccf5d2705e0f75e6eefe88661a9734319b92d49b7781e37386d9189aa4bfcf0d3cd6804f6fe6c8ed8273f05f76bbf1fe184eaa30814956df84afbed2de99abea04d64d63a192f85e788af31136f2c88d022e60ce3bdd7a7cf82dcc3300086d5a1819330713c76b843e6c678b7eb75ebd1df2fe8313ed66057b5afdc84e3e98cb46b27037b2b986f22a689f6b5f39183a05adcd15e00a0af9bcbbfb3f6fff895bcb30eb07453a6c4ab7cb444757ddeba95d0862ae8de7159af7d2d698112dac7621eeabe11b6e70c8ae76c5d5c60c05cabfecdb15f1f1cb93605e4651027d97b23323f9eb5fc7217221bfed534142696460701b2ba8acfb46d402e27f239c235bd1dcd8c0787ff05e31344c003c276f9644c497c7d9d785139c6cfe19b740d90b20ad37e9eb81e537ed725f16ed808ce56ca00a2e62e09d7fa1a4f959dab4b33588743d9b993b12e22f6173e5c3486d79d2ba47f1e4dd2ef709c109acd85b6c0737497c4d144267083642d25e3e427f7d1f9e44404e133b5abc46d0d1f8ecacf8920bca6cce5c8ce4a04d587308d8d6bcc4d9103dcc77cef7d9dcf16ea256ccafafbeb1a0a9ec0aeb891e234641502fbfd66900b9ce9dd1877e96047bac3d142f5a308570c84b361953292e7b54866baec1876d79e06a9d006a17a2aed1d43ee320628947ac2198af5014cd3c8306f08cc5167b56796116fb262d44580b92315a81cf2a295eb95ce79c38d60f15de11f2e82ef03fd2bca3f20700d01c90e6464a4d70e16bf7ff2b5d5f5ff021a71c48b78a62a5f7c6c034ab3d3aba5431353e144f3210f8840dd3053178e4275113bbaeac7a80e6b88d980abb14d2eeb1c8b591b2708da2321359fdd322932518ecb592ec0ff827d8a289d9c58c3c95b43a13a99443b958e7265b0f8589c72bba97e6976c84e3b25a4294bded04dc0b7a5238aa770766692afc2dcaffe000d6903ad3b13f473c2946e04a39038e1df2ae57585932155e4a1ccd0b44d51a6c9dd93762f7ea99c810771752362a0f72d4e80be30996f011cbdad240c960f664807ee0a7ea6a5bad8f966fb8e8db76eecdc9c3b9d6fe84522d0376557e36f76ee5b59857b4ba66ebbf0f166a43e521e3b27ff0775103f11782de2497b451ff0d06cda0fe1f7d9d5358e3c5f8150f5add7b905e140c57e06d849c78ca22d64a0c2497b99b84ccbea0ca621e91f11706c4a3958863a53a90e90561ec3f87580e87bd35067101ac803579e62e17b64def12dca376f221db5644510bb5603a355ce7793f7838f0c67dcdde487f21aa9152ab2103c798f96074e8b91010787426c6b7347f3fbb58e2406c0f7d366c97d84826761c1debcfd4fd1ad9e8402f78200ede9e01582541dd096ac4fab0dd012abe06ef45ecc63505593c9684c170c811dc6ed7d5c571fc4d888ac3cdf84e46da72fe5d0d30f4775936d8d2af3aa824cbbdcd24bb448d68c491761cb75bf691a49999ad1e04ec009a54b64a97915d19c174e58f467ae91ab2c863e3d8531404c093df4c025494f59aa134691cfa2d0bc9e7fd014c1f2ab82ee02b654ad3f9e0bf4f4284564732c86af629cca6f9e7fe90bbac8375ed6170f69640000000ff84ebbaf6cf3bfbeaa00e47302cad0acb9d20f80323fdd8d9c925ad6eff04109c9a81f2150cd073a2d0b98c79b99a65b92dc640f4d85da5e4d1e6a64c751023 svchost.exe Set value (str) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\DeviceId = "001800080B25BAF4" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\IdentityCRL\Immersive\production\Token\{D6D5A677-0872-4AB0-9442-BB792FCE85C5}\ApplicationFlags = "1" svchost.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
AcroRd32.exepid process 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 1496 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
AcroRd32.exeAdobeARM.exepid process 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 1496 AcroRd32.exe 4064 AdobeARM.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
AcroRd32.exeRdrCEF.exedescription pid process target process PID 1496 wrote to memory of 1672 1496 AcroRd32.exe RdrCEF.exe PID 1496 wrote to memory of 1672 1496 AcroRd32.exe RdrCEF.exe PID 1496 wrote to memory of 1672 1496 AcroRd32.exe RdrCEF.exe PID 1496 wrote to memory of 4356 1496 AcroRd32.exe RdrCEF.exe PID 1496 wrote to memory of 4356 1496 AcroRd32.exe RdrCEF.exe PID 1496 wrote to memory of 4356 1496 AcroRd32.exe RdrCEF.exe PID 1496 wrote to memory of 2092 1496 AcroRd32.exe RdrCEF.exe PID 1496 wrote to memory of 2092 1496 AcroRd32.exe RdrCEF.exe PID 1496 wrote to memory of 2092 1496 AcroRd32.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2348 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe PID 2092 wrote to memory of 2064 2092 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Deuda_Pendiente.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:1672
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵PID:4356
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=86DD7E4940D496AEE8BD08490B0EBFF6 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2348
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=025469813403AF442795E01AB5A16097 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=025469813403AF442795E01AB5A16097 --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:13⤵PID:2064
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EB5EE6FAEEB9EB10773C79F91572AE6B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EB5EE6FAEEB9EB10773C79F91572AE6B --renderer-client-id=4 --mojo-platform-channel-handle=2168 --allow-no-sandbox-job /prefetch:13⤵PID:1096
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=56EFBF9AD45DAF6F76BC54E7AFDD078B --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4696
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C59F2F7ABAFACD6E4CDDB698F9761C02 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1540
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4533718BC0A2E75BA9D44C12AAA6E659 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4040
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DAC57EA56C26397BE5426FCD0017F0B5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DAC57EA56C26397BE5426FCD0017F0B5 --renderer-client-id=10 --mojo-platform-channel-handle=2684 --allow-no-sandbox-job /prefetch:13⤵PID:2732
-
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:32⤵
- Suspicious use of SetWindowsHookEx
PID:4064 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"3⤵PID:4644
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalService -p -s LicenseManager1⤵
- Modifies data under HKEY_USERS
PID:4292
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:440
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BITS1⤵
- Drops file in Windows directory
PID:4268
-
C:\Windows\system32\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\PcaSvc.dll,PcaPatchSdbTask1⤵PID:1828
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:2184
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Adobe\ARM\Reader_19.010.20069\AcroRdrDCUpd1901020098.mspMD5
896a0f722441a753a8a76216a2d7099e
SHA15ee80ba01f3459d5c55aa470cc95e0b8240ee69c
SHA256f31d7e1efd0211c2bd0b9ccb63ee908f495a0043b90c2ded6f9b639ab17f5df4
SHA512976eb0109dad3bc41eacae3149fc45e71f667a02809c39194e236114ac68a49942eb7baf26251bdf5a6dd0094db0fe345360a261d17d4477a12d93c1bb2f3368
-
C:\ProgramData\Adobe\ARM\Reader_19.010.20069\ReaderDCManifest2.msiMD5
6f014505b038aa70695dc6557662df8b
SHA125607777270af2b0a38da97d8d98ab9bc7926980
SHA25652040d7492e91856c658e4779bdc2de38a81f47e5136d9a772f4559178fbe7fc
SHA51225c53e4b7c273b3699be727e5a6688dbfad7b6633d78d29e753bc3446b8e2b5e8c752a8842870264fe10a2b3a0246c335bea7457daa289faec67f7ca7c2aaac0
-
C:\ProgramData\Adobe\ARM\S\ArmManifest2.msiMD5
9143aa55d6501307e953cb70ef371d95
SHA1caf0709471745e9fe777e72f14b76dec9323feb7
SHA2567b28c43870421a07e46dbcc29b6f5d3fa4d0656328c318eeabd3780464502827
SHA5121edd5df07c7894fed273d959ac62f64a9c82135d6ab5a151d5fccf72cec0b3e282a1ee4e5baa4037925ab30451b700c565777da2cf3d29dfa5d7ea8c2a3ac9df
-
memory/4268-154-0x0000014504D60000-0x0000014504D70000-memory.dmpFilesize
64KB
-
memory/4268-155-0x0000014504DC0000-0x0000014504DD0000-memory.dmpFilesize
64KB
-
memory/4268-156-0x0000014507330000-0x0000014507334000-memory.dmpFilesize
16KB
-
memory/4268-157-0x00000145076C0000-0x00000145076C4000-memory.dmpFilesize
16KB
-
memory/4268-158-0x00000145076C0000-0x00000145076C4000-memory.dmpFilesize
16KB
-
memory/4268-159-0x0000014507740000-0x0000014507744000-memory.dmpFilesize
16KB
-
memory/4268-160-0x0000014507730000-0x0000014507731000-memory.dmpFilesize
4KB
-
memory/4268-161-0x0000014507770000-0x0000014507774000-memory.dmpFilesize
16KB
-
memory/4268-162-0x0000014507770000-0x0000014507774000-memory.dmpFilesize
16KB