e5e4f5ba15a4bb5fa50d37161409f8eebdcc120506e60853e1ca0dbd90ba0bcf

Resubmissions

20-10-2022 16:05

221020-tjrepscedn 3

20-10-2022 15:26

221020-st7zrsbfd8 6

Analysis

max time kernel
484s
max time network
508s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
20-10-2022 16:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Brochure.pdf
Size

1.2MB
MD5

832ee795b9cf632ec05a37a58cae400e
SHA1

1f356ca53d91526260205ccd2d4c0a1a9727ab6b
SHA256

e5e4f5ba15a4bb5fa50d37161409f8eebdcc120506e60853e1ca0dbd90ba0bcf
SHA512

c7e796b6a5588c7d193050b59a5735b2898916cc4615ae927e57eb74aa905f74464ce40dd04e01f8c3b3f232d7bf1a77203d18b0245d191fcf68a0b04b5cce18
SSDEEP

24576:+40jYyTZ59a3BFxAY8FbWrNlCGZ9AN5RQ0WbjX:+40jYMZ5AXCbmN4gAN5mdz

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exeAcroRd32.exeAcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

msedge.exe

description ioc process

Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

AcroRd32.exemsedge.exemsedge.exemsedge.exe

pid	process
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
4824	AcroRd32.exe
2424	msedge.exe
2424	msedge.exe
3456	msedge.exe
3456	msedge.exe
1092	msedge.exe
1092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

1092 msedge.exe
1092 msedge.exe
1092 msedge.exe
1092 msedge.exe
Suspicious use of FindShellTrayWindow 5 IoCs

Processes:

AdobeCollabSync.exeAdobeCollabSync.exeAcroRd32.exemsedge.exe

pid process

3552 AdobeCollabSync.exe
864 AdobeCollabSync.exe
4824 AcroRd32.exe
1092 msedge.exe
1092 msedge.exe
Suspicious use of SendNotifyMessage 2 IoCs

Processes:

AdobeCollabSync.exeAdobeCollabSync.exe

pid process

3552 AdobeCollabSync.exe
864 AdobeCollabSync.exe
Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

AcroRd32.exeAcroRd32.exeAcroRd32.exe

pid process

4824 AcroRd32.exe
4824 AcroRd32.exe
4824 AcroRd32.exe
528 AcroRd32.exe
4824 AcroRd32.exe
4824 AcroRd32.exe
1608 AcroRd32.exe
4824 AcroRd32.exe

pid	process
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe
1092	msedge.exe

pid	process
3552	AdobeCollabSync.exe
864	AdobeCollabSync.exe
4824	AcroRd32.exe
1092	msedge.exe
1092	msedge.exe

pid	process
3552	AdobeCollabSync.exe
864	AdobeCollabSync.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeAdobeCollabSync.exeAdobeCollabSync.exeAdobeCollabSync.exeRdrCEF.exe

description	pid	process	target process
PID 4824 wrote to memory of 3552	4824	AcroRd32.exe	AdobeCollabSync.exe
PID 4824 wrote to memory of 3552	4824	AcroRd32.exe	AdobeCollabSync.exe
PID 4824 wrote to memory of 3552	4824	AcroRd32.exe	AdobeCollabSync.exe
PID 4824 wrote to memory of 5032	4824	AcroRd32.exe	AdobeCollabSync.exe
PID 4824 wrote to memory of 5032	4824	AcroRd32.exe	AdobeCollabSync.exe
PID 4824 wrote to memory of 5032	4824	AcroRd32.exe	AdobeCollabSync.exe
PID 4824 wrote to memory of 864	4824	AcroRd32.exe	AdobeCollabSync.exe
PID 4824 wrote to memory of 864	4824	AcroRd32.exe	AdobeCollabSync.exe
PID 4824 wrote to memory of 864	4824	AcroRd32.exe	AdobeCollabSync.exe
PID 5032 wrote to memory of 4952	5032	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 5032 wrote to memory of 4952	5032	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 5032 wrote to memory of 4952	5032	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 3552 wrote to memory of 4248	3552	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 3552 wrote to memory of 4248	3552	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 3552 wrote to memory of 4248	3552	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 864 wrote to memory of 2580	864	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 864 wrote to memory of 2580	864	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 864 wrote to memory of 2580	864	AdobeCollabSync.exe	AdobeCollabSync.exe
PID 4824 wrote to memory of 1752	4824	AcroRd32.exe	RdrCEF.exe
PID 4824 wrote to memory of 1752	4824	AcroRd32.exe	RdrCEF.exe
PID 4824 wrote to memory of 1752	4824	AcroRd32.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 3808	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 1116	1752	RdrCEF.exe	RdrCEF.exe
PID 1752 wrote to memory of 1116	1752	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Brochure.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4824

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3552

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=3552
3⤵
PID:4248

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
2⤵
- Suspicious use of WriteProcessMemory
PID:5032

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=5032
3⤵
PID:4952

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
2⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=864
3⤵
PID:2580

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1752

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3BE25FCCE557B610AB9A3FA6B422D846 --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3808

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A0D1C5E07BF0071E8AE5590C62F4E532 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A0D1C5E07BF0071E8AE5590C62F4E532 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1116

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9B18B70F6A5BD310687AF4C1C8CBCE81 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4632

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=AFD2342BA3583DC21339CC9E270280D2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=AFD2342BA3583DC21339CC9E270280D2 --renderer-client-id=5 --mojo-platform-channel-handle=2420 --allow-no-sandbox-job /prefetch:1
3⤵
PID:3024

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B09E4BF15794D7107977AE5EACBB0E2D --mojo-platform-channel-handle=2428 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4788

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=64B515B19FA3076FD273119FABCE8B78 --mojo-platform-channel-handle=2788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:1052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.luxatiainternational.com/cart/customize/world-data-transfers-and-compliance-summit
2⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
PID:1092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe54b046f8,0x7ffe54b04708,0x7ffe54b04718
3⤵
PID:3460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,16119072812575752996,7638982047110238766,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
3⤵
PID:3076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,16119072812575752996,7638982047110238766,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,16119072812575752996,7638982047110238766,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3112 /prefetch:8
3⤵
PID:4228

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16119072812575752996,7638982047110238766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
3⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16119072812575752996,7638982047110238766,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3912 /prefetch:1
3⤵
PID:220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16119072812575752996,7638982047110238766,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
3⤵
PID:4212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,16119072812575752996,7638982047110238766,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
3⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2168,16119072812575752996,7638982047110238766,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5236 /prefetch:8
3⤵
PID:4408

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:528

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
PID:2336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe54b046f8,0x7ffe54b04708,0x7ffe54b04718
2⤵
PID:4508

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,12130716143843638153,3170476314026888015,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
2⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,12130716143843638153,3170476314026888015,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2424

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,12130716143843638153,3170476314026888015,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3352 /prefetch:8
2⤵
PID:4916

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\eac4cf9da8b4acca06ece00ca75105a1.db
Filesize
4KB

MD5
db094082d4f0575ec4b04cb4c4ed7b2f

SHA1
acbf2301b40ac443be9f5af638c7164d3d326a31

SHA256
647d621210c2a281180a1e678b7be08962610a0e1754bd310c5c6c558a8c5c98

SHA512
48e2889a52fbcae6e7c3004e4feb3f4b1ce32c4e441ba05e24f79c869561bbbcb95ecc0ba1e9743595ecd1f9a6480ae5b2f78af20790f037e39e58902b0db2b4

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\eac4cf9da8b4acca06ece00ca75105a1.db-wal
Filesize
32B

MD5
566a705adf3b391598ba20baf8a27164

SHA1
bc0431d4079cd338b1422562ed228ce4cefd73cc

SHA256
60f851794877b8e341d4cca4c44dd18d6346060ed6e4f5aa063c60034b4296b6

SHA512
7d9a0990043487ef0f9a75ddacb3d4dcd0a9039dbaafb213f8556aefa1544e4b8bcb5fdd8f97f7d529aaff227416f68d87cdc271f2ca63afa629c082e7257e9b

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\CreativeCloud\CoreSync\EntitySync-2022-10-20.log
Filesize
296B

MD5
24524360d3c8a95e76e3ece78431f9ca

SHA1
1cf3189c564773fe37353904eaf56725825b1b22

SHA256
4cdfd0b9198104bb3848901fee9fc3608b4480077cf052013948ecc9dac55a4b

SHA512
83348f2725f39665b0a60aa57eaddb2fb8a0de3718b500c671632c9d4efa86ed06f8be20529569a54af8d067553cfaaaf3edf2270125ef6db3605c30b5124ca8

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\CreativeCloud\CoreSync\EntitySync-2022-10-20.log
Filesize
3KB

MD5
baf7a32cfed0888f0de1f46772669102

SHA1
aada0a012639303979bfdbbf4dc82fa35b66bdbb

SHA256
979b3e495e2e04469b25e54b493213707f3307b1bc677937ca2889f4acaff35d

SHA512
8fcd68ed59413f8f06ad074455f7e9ffbc5ecd1439622303c39e04907dd96d08ce4e2b2b7ff7a3a8c674c8e2a3a2ca866512295847e190f089be9d047d157a71

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize
471B

MD5
77c7b7f7f6f47dc6e8427638a27c5b70

SHA1
437d7278444d904604d0a35e3a697f2d101da8fb

SHA256
3dffec50f26bcca278bd6ed6c2d196706a60fc34d46ec9b973ea073d8ab50202

SHA512
f09ff1130b38a6947ec1a8727b71c09ee7f5af2e92fc5891a85a8dce2c0530b9b35bad61c22351807dc040a45c3b1486adfbc976b5e8654e680606af452de9f9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177
Filesize
442B

MD5
90ed5567ba45cc128298a65d8c75554e

SHA1
b52a551361562fdccfb665e21e6939cbd24fb05c

SHA256
422232dce232c8a1ff02163cdfbd9281b557965195903aebe40e0880e955c27f

SHA512
6903d841263acb5c1d2bcd6f0e2181221fc7e8c9bba36a742d1731175c9753210621cf120fc16642b3d0b2795471fdd6775a962ab579aa61196b6faf32ec0e37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7b4b103831d353776ed8bfcc7676f9df

SHA1
40f33a3f791fda49a35224a469cc67b94ca53a23

SHA256
bf59580e4d4a781622abb3d43674dedc8d618d6c6da09e7d85d920cd9cea4e85

SHA512
5cb3360ac602d18425bdb977be3c9ee8bbe815815278a8848488ba9097e849b7d67f993b4795216e0c168cdc9c9260de504cccb305ff808da63762c2209e532f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version
Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
\??\pipe\LOCAL\crashpad_1092_MZDWQBAUYNRDBGAO
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\??\pipe\LOCAL\crashpad_2336_CMELXHONSHCRPQMG
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/220-187-0x0000000000000000-mapping.dmp

Download
memory/548-185-0x0000000000000000-mapping.dmp

Download
memory/864-134-0x0000000000000000-mapping.dmp

Download
memory/1052-163-0x0000000000000000-mapping.dmp

Download
memory/1092-170-0x0000000000000000-mapping.dmp

Download
memory/1116-147-0x0000000000000000-mapping.dmp

Download
memory/1752-142-0x0000000000000000-mapping.dmp

Download
memory/2424-168-0x0000000000000000-mapping.dmp

Download
memory/2580-135-0x0000000000000000-mapping.dmp

Download
memory/2608-167-0x0000000000000000-mapping.dmp

Download
memory/3024-155-0x0000000000000000-mapping.dmp

Download
memory/3076-176-0x0000000000000000-mapping.dmp

Download
memory/3456-177-0x0000000000000000-mapping.dmp

Download
memory/3460-171-0x0000000000000000-mapping.dmp

Download
memory/3552-132-0x0000000000000000-mapping.dmp

Download
memory/3808-144-0x0000000000000000-mapping.dmp

Download
memory/4212-189-0x0000000000000000-mapping.dmp

Download
memory/4228-183-0x0000000000000000-mapping.dmp

Download
memory/4248-136-0x0000000000000000-mapping.dmp

Download
memory/4396-191-0x0000000000000000-mapping.dmp

Download
memory/4408-193-0x0000000000000000-mapping.dmp

Download
memory/4508-165-0x0000000000000000-mapping.dmp

Download
memory/4632-152-0x0000000000000000-mapping.dmp

Download
memory/4788-160-0x0000000000000000-mapping.dmp

Download
memory/4916-174-0x0000000000000000-mapping.dmp

Download
memory/4952-137-0x0000000000000000-mapping.dmp

Download
memory/5032-133-0x0000000000000000-mapping.dmp

Download