0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901

General

Target

0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe
Size

3.2MB
MD5

51eb93aaca0e50e7623ab67c61d1b1fb
SHA1

c862db8b0d8a15b02e3cb3296aa618c46edc822b
SHA256

0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901
SHA512

e31728d6b1fd9781a0d29840d054b6e3f1869db40b185d74b8f2e4fbea526b712e3ee614784fba9ccf78d532ea3640885ee5b0e1a2793aa27da9dbea6d99af0a

Score

10^/10

link pdf persistence suricata

Malware Config

Signatures

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata
Executes dropped EXE 1 IoCs

Processes:

mls.exe

pid process

4348 mls.exe

pid	process
4348	mls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exemls.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation	mls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exemls.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\mls = "\"C:\\Users\\Admin\\AppData\\Roaming\\RAC\\mls.exe\" -s"	0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svcsc.exe = "C:\\Users\\Admin\\AppData\\Roaming\\RAC\\svcsc.exe"	mls.exe

HTTP links in PDF interactive object 1 IoCs

Detects HTTP links in interactive objects within PDF files.

pdf link

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.pdf	pdf_with_link_action

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000_Classes\Local Settings	0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe
4336	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4336 AcroRd32.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

4336 AcroRd32.exe
4336 AcroRd32.exe
4336 AcroRd32.exe
4336 AcroRd32.exe
4336 AcroRd32.exe
4336 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 4384 wrote to memory of 4336	4384	0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe	AcroRd32.exe
PID 4384 wrote to memory of 4336	4384	0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe	AcroRd32.exe
PID 4384 wrote to memory of 4336	4384	0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe	AcroRd32.exe
PID 4384 wrote to memory of 4348	4384	0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe	mls.exe
PID 4384 wrote to memory of 4348	4384	0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe	mls.exe
PID 4384 wrote to memory of 4348	4384	0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe	mls.exe
PID 4336 wrote to memory of 1408	4336	AcroRd32.exe	RdrCEF.exe
PID 4336 wrote to memory of 1408	4336	AcroRd32.exe	RdrCEF.exe
PID 4336 wrote to memory of 1408	4336	AcroRd32.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 224	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe
PID 1408 wrote to memory of 4456	1408	RdrCEF.exe	RdrCEF.exe

C:\Users\Admin\AppData\Local\Temp\0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe
"C:\Users\Admin\AppData\Local\Temp\0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4384

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.pdf"
2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4336

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
- Suspicious use of WriteProcessMemory
PID:1408

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=2433D9A7465BA90BED79AEC6AEB470F5 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=2433D9A7465BA90BED79AEC6AEB470F5 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
4⤵
PID:224

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=502625D47BBB5A9E815644A10C82CAE4 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:4456

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=02F1059B745460185CDF311266EDA859 --mojo-platform-channel-handle=2316 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3928

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EFBB0E483680F5D57741095F0CE3271E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EFBB0E483680F5D57741095F0CE3271E --renderer-client-id=5 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job /prefetch:1
4⤵
PID:4444

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=211D69096E435DF14206F5F7BACC77AD --mojo-platform-channel-handle=2472 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:556

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=219E217B66C9DF892CC4F46E7DB7390E --mojo-platform-channel-handle=2332 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:1524

C:\Users\Admin\AppData\Roaming\RAC\mls.exe
"C:\Users\Admin\AppData\Roaming\RAC\mls.exe" -s
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
PID:4348

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0041d6ff578994fd2d6d9aa0b44c0d5f5474eb5281c49a34f4c81651a4525901.pdf
Filesize
1.7MB

MD5
8b6df81f3786a6d953986f95ed6eb3ac

SHA1
32ef98d46e69b15b62f1af0e8b8b5e9f6362d51c

SHA256
ae0ce574fa65c41406cdd8e438d65d5dd20db03ba49628f1eb51da4d6392f1c6

SHA512
e87322ac540067e47f4f08794fb0d3d153f8147398354eb1b2f6385a8eda04133d6d1b119c12814895df99a2a4ab3cc28d4b7d302e6195a5863408a14e0e2876

Download Submit
C:\Users\Admin\AppData\Roaming\RAC\mls.exe
Filesize
1.6MB

MD5
1ebb1216c11c725ecced04a394ba0f07

SHA1
1298e27b6cccc9ffc671fad4fbbe5f74675017d3

SHA256
92cfb01452d35687f10b203475475f7513dddf21e07dcb8b9af512f2caef183e

SHA512
81fd1a4b0386ffb51786222967986cc0b0e863606fd29813031cece4ab9534270fe224b1614823372907625c0ae000cc0ad083ab8619315ae9586845f2b563bd

Download Submit
C:\Users\Admin\AppData\Roaming\RAC\mls.exe
Filesize
1.6MB

MD5
1ebb1216c11c725ecced04a394ba0f07

SHA1
1298e27b6cccc9ffc671fad4fbbe5f74675017d3

SHA256
92cfb01452d35687f10b203475475f7513dddf21e07dcb8b9af512f2caef183e

SHA512
81fd1a4b0386ffb51786222967986cc0b0e863606fd29813031cece4ab9534270fe224b1614823372907625c0ae000cc0ad083ab8619315ae9586845f2b563bd

Download Submit
memory/224-137-0x0000000000000000-mapping.dmp

Download
memory/556-152-0x0000000000000000-mapping.dmp

Download
memory/1408-135-0x0000000000000000-mapping.dmp

Download
memory/1524-156-0x0000000000000000-mapping.dmp

Download
memory/3928-145-0x0000000000000000-mapping.dmp

Download
memory/4336-130-0x0000000000000000-mapping.dmp

Download
memory/4348-131-0x0000000000000000-mapping.dmp

Download
memory/4444-148-0x0000000000000000-mapping.dmp

Download
memory/4456-140-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads