0f5f0e12fcee2667f9b4aaf211aa7a44af3330b157619a915aaf365f94879726

General

Target

https192.168.1.254index.htmpg=ad_B_Internet.htm.pdf
Size

44KB
MD5

aacfbb797fbe45d387b0473d1d60cada
SHA1

852bbe7d80ccf7cccbc0ed994709f345e2938fae
SHA256

0f5f0e12fcee2667f9b4aaf211aa7a44af3330b157619a915aaf365f94879726
SHA512

9e0875e8810f4dc44863b948c9f6ebc40cf02489dac8589762e0fba10dbb80d2e19d9e790a4bd54e56888f643ce784b6a551eb23807efd250d23ca50b93e07d0

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

AcroRd32.exeAdobeARM.exe

pid	process
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
2924	AcroRd32.exe
1880	AdobeARM.exe
1880	AdobeARM.exe
1880	AdobeARM.exe
1880	AdobeARM.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2924 AcroRd32.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

AcroRd32.exeAdobeARM.exe

pid process

2924 AcroRd32.exe
2924 AcroRd32.exe
2924 AcroRd32.exe
2924 AcroRd32.exe
2924 AcroRd32.exe
2924 AcroRd32.exe
2924 AcroRd32.exe
1880 AdobeARM.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2924 wrote to memory of 2040	2924	AcroRd32.exe	RdrCEF.exe
PID 2924 wrote to memory of 2040	2924	AcroRd32.exe	RdrCEF.exe
PID 2924 wrote to memory of 2040	2924	AcroRd32.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 1344	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe
PID 2040 wrote to memory of 3484	2040	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\https192.168.1.254index.htmpg=ad_B_Internet.htm.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2924

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:2040

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0907E513CD4870EB86B8106BF3EB90D1 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1344

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5F470879EA189587A004A3F36EC55FEF --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5F470879EA189587A004A3F36EC55FEF --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3484

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6FE9E217CD5CC1D325208AA97BC31D71 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6FE9E217CD5CC1D325208AA97BC31D71 --renderer-client-id=4 --mojo-platform-channel-handle=2172 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1764

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D7C062643C00E22F9793EF319229581B --mojo-platform-channel-handle=1848 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4884

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=074AC5F24A9D579E40A0CD4ADCE93024 --mojo-platform-channel-handle=2592 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2372

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=413377C08F654E0D2151DF9EBE6DB3CB --mojo-platform-channel-handle=2696 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3212

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=845415CFF92E5E681EF70091DF1E7B9A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=845415CFF92E5E681EF70091DF1E7B9A --renderer-client-id=10 --mojo-platform-channel-handle=1860 --allow-no-sandbox-job /prefetch:1
3⤵
PID:4416

C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
"C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /PRODUCT:Reader /VERSION:19.0 /MODE:3
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1880

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Reader_sl.exe"
3⤵
PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4788

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1344-132-0x0000000000000000-mapping.dmp

Download
memory/1764-140-0x0000000000000000-mapping.dmp

Download
memory/1880-158-0x0000000000000000-mapping.dmp

Download
memory/2040-130-0x0000000000000000-mapping.dmp

Download
memory/2372-148-0x0000000000000000-mapping.dmp

Download
memory/3088-159-0x0000000000000000-mapping.dmp

Download
memory/3212-151-0x0000000000000000-mapping.dmp

Download
memory/3484-135-0x0000000000000000-mapping.dmp

Download
memory/4416-154-0x0000000000000000-mapping.dmp

Download
memory/4884-145-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads