91573e2aad89c56aafd30ee2dd1155ef1e2b38a2d2856a3201e1f600e6685217

Analysis

max time kernel
146s
max time network
151s
platform
windows10_x64
resource
win10-20220414-en
submitted
21-05-2022 23:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91573e2aad89c56aafd30ee2dd1155ef1e2b38a2d2856a3201e1f600e6685217.pdf
Size

38KB
MD5

e9f991cbda73482d20734d9cc7572c78
SHA1

a0137943995f841b37ead9d62e2d3c15e1027615
SHA256

91573e2aad89c56aafd30ee2dd1155ef1e2b38a2d2856a3201e1f600e6685217
SHA512

0448d38a7e817cf342eaa63f50962683e30e5c7b1aa0be8c836cee29d174a35c806a9d14f259e4388f9d25be08534250a419af42a5ed6a2e937c8a6f27cd35ff

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Windows directory 3 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdge.exe
File opened for modification	C:\Windows\Debug\ESE.TXT	MicrosoftEdge.exe
File created	C:\Windows\rescache\_merged\3720402701\2219095117.pri	MicrosoftEdgeCP.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exefirefox.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe

Modifies Internet Explorer settings 1 TTPs 5 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exeMicrosoftEdge.exebrowser_broker.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main	browser_broker.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Internet Explorer\Main	MicrosoftEdgeCP.exe

Modifies registry class 64 IoCs

Processes:

MicrosoftEdgeCP.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\www.bing.com\ = "604"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\CA\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Main\DisallowDefaultBrowserPrompt = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\ACGStatus\ACGPolicyState = "8"	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\History	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\DetectPhoneNumberComplete = "1"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI\OneBoxLoadAttempts = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Software\Microsoft\SystemCertificates\Root\CRLs	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\CVListXMLVersionHigh = "0"	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\ACGStatus\DynamicCodePolicy = 05000000	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\006\CIStatus	MicrosoftEdgeCP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\History\CachePrefix = "Visited:"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TabbedBrowsing\NewTabPage\ProcessingFlag = 80d79cf5696dd801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ExtensionsStore\datastore\usage\dscc_inventory\Extension	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\New Windows	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\InternetRegistry	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modif = 010000000c3e821d9e143ffa629dc01011e043ce9482123d11574dbb8ba5985e6b56f3602f70ad82f19d139b5da147b23cf270816beb36f8ff3c6944a59468f120a90309ab17bca889c7b80bb7c27dfea7adaef50d597af6521341fcabb0205eb774a1fea653782652330f473f2134c149b2a88de8eb58c50b7b7022a219a12edd59fbce2c45bcc93f7fd17406ddc628b19f5cceb0c38296b313d5dbc3efdbc9a2f7abc5750b4244294cc7e0f51561332f16a4304b00ced21e7d3476815276abe9ee16388bc61b27a23aaf0721ebbdd4e7b5077e01c26ffe455826bb97622a6da4de0b7635977330f5e946b0dc7dd161ac1d87c04929caefab43fb52c23f27a07d67f33b4c9c40e6dff9451726edbeb425ef65c0a054065169e09234e5090b721229ddb8baf637856e0b0e29c9592728dac98910f5651d7888cd362bb3e0a02a2ec4b325e3c5ef3b12bd17cb45e3c8b7404d6bb3037bd286f7acb966a8e4396f46d802ed022af2b518b0f538f3a936f2f21926404db6ebe22e1c2a1f9035e65e6f05a9601f434ffb0a84806a25cd98b78cce85aaf23560f8fdbc2947b382d8027f81db91fa648abf94bd	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\CIStatus\CIPolicyState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "5133"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta\generator$WordPress	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\CTLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\TypedURLs	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\HistoryJournalCertificate\Certificates\4EEF7FAF0062D34AB	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "604"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FavOrder\Favorites	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\EnablementState = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Recovery	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\OnlineHistory	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState\EdpCleanupState = "0"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\NumberOfSubdomains = "0"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\www.bing.com	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "652"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\CIStatus\CIStatusTimestamp = a5a059e2696dd801	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ReadingMode\FontSize = "3"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\BrowserEmulation\IECompatVersionLow = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Content	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "604"	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\FlipAhead\Meta	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\IEMigration\SmartScreenCompletedVersi = "1"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy\Extensions	MicrosoftEdge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\Internet Settings\Zones\3\{AEBA21FA-782A-4A90-978D-B7216 = 1a3761592352350c7a5f20172f1e1a190e2b017313371312141a152a	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\001\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DomStorageState	MicrosoftEdgeCP.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\EdpDomStorage\Total	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\bing.com\Total = "5133"	MicrosoftEdgeCP.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\002\Internet Explorer\DOMStorage\Total\ = "875"	MicrosoftEdgeCP.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\UserStateMigration\ChromeMigration\MigrationTime = e17eaf304350d801	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\ServiceUI	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\VersionLow = "0"	MicrosoftEdge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\GPU\Wow64-VersionHigh = "0"	MicrosoftEdge.exe
Key created	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\Children\121\Internet Settings\Cache\Extensible Cache	MicrosoftEdgeCP.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe

Suspicious behavior: MapViewOfSection 3 IoCs

Processes:

MicrosoftEdgeCP.exe

pid process

4368 MicrosoftEdgeCP.exe
4368 MicrosoftEdgeCP.exe
4368 MicrosoftEdgeCP.exe

pid	process
4368	MicrosoftEdgeCP.exe
4368	MicrosoftEdgeCP.exe
4368	MicrosoftEdgeCP.exe

Suspicious use of AdjustPrivilegeToken 17 IoCs

Processes:

MicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	2776	MicrosoftEdge.exe
Token: SeDebugPrivilege	2776	MicrosoftEdge.exe
Token: SeDebugPrivilege	2776	MicrosoftEdge.exe
Token: SeDebugPrivilege	2776	MicrosoftEdge.exe
Token: SeDebugPrivilege	4572	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4572	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4572	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4572	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4876	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4876	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4160	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4160	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4160	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	4160	MicrosoftEdgeCP.exe
Token: SeDebugPrivilege	2776	MicrosoftEdge.exe
Token: SeDebugPrivilege	2948	firefox.exe
Token: SeDebugPrivilege	2948	firefox.exe

Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

AcroRd32.exefirefox.exe

pid process

3584 AcroRd32.exe
2948 firefox.exe
2948 firefox.exe
2948 firefox.exe
2948 firefox.exe
Suspicious use of SendNotifyMessage 7 IoCs

Processes:

AcroRd32.exefirefox.exe

pid process

3584 AcroRd32.exe
3584 AcroRd32.exe
3584 AcroRd32.exe
3584 AcroRd32.exe
2948 firefox.exe
2948 firefox.exe
2948 firefox.exe

Suspicious use of SetWindowsHookEx 11 IoCs

Processes:

AcroRd32.exeMicrosoftEdge.exeMicrosoftEdgeCP.exeMicrosoftEdgeCP.exefirefox.exe

pid	process
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
3584	AcroRd32.exe
2776	MicrosoftEdge.exe
4368	MicrosoftEdgeCP.exe
4368	MicrosoftEdgeCP.exe
4160	MicrosoftEdgeCP.exe
2948	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3584 wrote to memory of 452	3584	AcroRd32.exe	RdrCEF.exe
PID 3584 wrote to memory of 452	3584	AcroRd32.exe	RdrCEF.exe
PID 3584 wrote to memory of 452	3584	AcroRd32.exe	RdrCEF.exe
PID 3584 wrote to memory of 1600	3584	AcroRd32.exe	RdrCEF.exe
PID 3584 wrote to memory of 1600	3584	AcroRd32.exe	RdrCEF.exe
PID 3584 wrote to memory of 1600	3584	AcroRd32.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2200	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe
PID 452 wrote to memory of 2444	452	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\91573e2aad89c56aafd30ee2dd1155ef1e2b38a2d2856a3201e1f600e6685217.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3584

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:452

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=89165E6A6AE0222ECFC1258A43E0FB18 --mojo-platform-channel-handle=1628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2200

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6DA6DEF1B691A0E47210E74C169580AB --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6DA6DEF1B691A0E47210E74C169580AB --renderer-client-id=2 --mojo-platform-channel-handle=1640 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2444

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=92FF3E641D684B6C24C8B5E156E756E9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=92FF3E641D684B6C24C8B5E156E756E9 --renderer-client-id=4 --mojo-platform-channel-handle=1976 --allow-no-sandbox-job /prefetch:1
3⤵
PID:320

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5150FB6586F61FB70F1671C693C1642B --mojo-platform-channel-handle=2488 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1692

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3EF3A60F07AE6516DF26551001F5131A --mojo-platform-channel-handle=2756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:436

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B3490BB9B2AF4145BB52AAD45147BC2A --mojo-platform-channel-handle=2576 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:536

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
PID:1600

C:\Windows\SysWOW64\LaunchWinApp.exe
"C:\Windows\system32\LaunchWinApp.exe" "https://bit.ly/3cBxHoA"
2⤵
PID:3132

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2776

C:\Windows\system32\browser_broker.exe
C:\Windows\system32\browser_broker.exe -Embedding
1⤵
- Modifies Internet Explorer settings
PID:2644

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
PID:4368

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4572

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4876

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:4996

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies registry class
PID:5088

C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
"C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4160

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2948

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2948.0.1662373240\1898880461" -parentBuildID 20200403170909 -prefsHandle 1552 -prefMapHandle 1524 -prefsLen 1 -prefMapSize 219987 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 1632 gpu
3⤵
PID:4472

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2948.3.2077196950\651505396" -childID 1 -isForBrowser -prefsHandle 2272 -prefMapHandle 2268 -prefsLen 156 -prefMapSize 219987 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 2280 tab
3⤵
PID:4944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2948.13.916546388\130875275" -childID 2 -isForBrowser -prefsHandle 3472 -prefMapHandle 3468 -prefsLen 6938 -prefMapSize 219987 -parentBuildID 20200403170909 -appdir "C:\Program Files\Mozilla Firefox\browser" - 2948 "\\.\pipe\gecko-crash-server-pipe.2948" 3484 tab
3⤵
PID:5104

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/320-388-0x0000000000000000-mapping.dmp

Download
memory/436-826-0x0000000000000000-mapping.dmp

Download
memory/452-205-0x0000000000000000-mapping.dmp

Download
memory/536-943-0x0000000000000000-mapping.dmp

Download
memory/1600-314-0x0000000000000000-mapping.dmp

Download
memory/1692-663-0x0000000000000000-mapping.dmp

Download
memory/2200-333-0x0000000000000000-mapping.dmp

Download
memory/2444-362-0x0000000000000000-mapping.dmp

Download
memory/3132-753-0x0000000000000000-mapping.dmp

Download
memory/3584-149-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-153-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-124-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-125-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-126-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-127-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-128-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-130-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-129-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-131-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-132-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-133-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-134-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-135-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-136-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-137-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-138-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-139-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-140-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-141-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-142-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-143-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-144-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-145-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-146-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-147-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-148-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-122-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-150-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-151-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-152-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-123-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-154-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-155-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-156-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-157-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-158-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-159-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-160-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-161-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-162-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-163-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-164-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-165-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-166-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-167-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-168-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-169-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-170-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-171-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-172-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-173-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-174-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-175-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-176-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-121-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-120-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-119-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-118-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-177-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-178-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-179-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-180-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download
memory/3584-181-0x0000000077230000-0x00000000773BE000-memory.dmp

Filesize
1.6MB

Download