bumblebee | e81f4b65fb98623c6be24865728e0e894403738cd4413d372da32fcfe3c6a1f5

Analysis

max time kernel
91s
max time network
181s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2022 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e81f4b65fb98623c6be24865728e0e894403738cd4413d372da32fcfe3c6a1f5.iso
Size

3.2MB
MD5

2d10e35ba9ba3cba78d59a276708efae
SHA1

17500c2931c8a1398c7a303fb4a11ce92b07b148
SHA256

e81f4b65fb98623c6be24865728e0e894403738cd4413d372da32fcfe3c6a1f5
SHA512

7319045bd51600bf5dbbdd275943358e67ae5ea4925d39eab5a2a8f5eadd903302bf91cf37b7d37e673db00ac057cc07e13799185f862f3ebffc0de7f20c3351
SSDEEP

49152:fWsNTq3iNJhyavhqaUq5AXWm9KhyyLrgbOww:fW

Score

10^/10

bumblebee 2510 evasion trojan

Malware Config

Extracted

Family

bumblebee

Botnet

2510

69.46.15.158:443

135.125.241.35:443

172.86.120.141:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	2510c_cr29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	2510c_cr29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2510c_cr29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	2510c_cr29.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2510c_cr29.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2510c_cr29.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	2510c_cr29.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	2510c_cr29.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2510c_cr29.exe

Executes dropped EXE 1 IoCs

pid	Process
5044	2510c_cr29.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2510c_cr29.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2510c_cr29.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2510c_cr29.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	WScript.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Wine	2510c_cr29.exe

Enumerates connected drives 3 TTPs 3 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	AcroRd32.exe
File opened (read-only)	\??\E:	cmd.exe
File opened (read-only)	\??\E:	WScript.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
5044	2510c_cr29.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe
5044	2510c_cr29.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4540	cmd.exe
Token: SeManageVolumePrivilege	4540	cmd.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
796	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
796	AcroRd32.exe
796	AcroRd32.exe
796	AcroRd32.exe
796	AcroRd32.exe
796	AcroRd32.exe
796	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2504	3052	Mutual_23.pdf.exe	97
PID 3052 wrote to memory of 2504	3052	Mutual_23.pdf.exe	97
PID 2504 wrote to memory of 1836	2504	cmd.exe	99
PID 2504 wrote to memory of 1836	2504	cmd.exe	99
PID 2504 wrote to memory of 796	2504	cmd.exe	100
PID 2504 wrote to memory of 796	2504	cmd.exe	100
PID 2504 wrote to memory of 796	2504	cmd.exe	100
PID 1836 wrote to memory of 2312	1836	WScript.exe	101
PID 1836 wrote to memory of 2312	1836	WScript.exe	101
PID 796 wrote to memory of 3520	796	AcroRd32.exe	103
PID 796 wrote to memory of 3520	796	AcroRd32.exe	103
PID 796 wrote to memory of 3520	796	AcroRd32.exe	103
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4072	3520	RdrCEF.exe	106
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107
PID 3520 wrote to memory of 4888	3520	RdrCEF.exe	107

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\e81f4b65fb98623c6be24865728e0e894403738cd4413d372da32fcfe3c6a1f5.iso
1⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4540

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3024

\??\E:\Mutual_23.pdf.exe
"E:\Mutual_23.pdf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\7B0C.tmp\7B0D.tmp\7B0E.bat E:\Mutual_23.pdf.exe"
  2⤵
  - Checks computer location settings
  - Enumerates connected drives
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "E:\name.js"
    3⤵
    - Checks computer location settings
    - Enumerates connected drives
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Windows\System32\cmdkey.exe
      "C:\Windows\System32\cmdkey.exe" /generic:Microsoft_Windows_Shell_ZipFolder:filename=C:\Users\Admin\AppData\Local\Temp\2510c_cr29.zip /pass:jfKRQExwQ /user:""
      4⤵
      PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Temp1_2510c_cr29.zip\2510c_cr29.exe
      "C:\Users\Admin\AppData\Local\Temp\Temp1_2510c_cr29.zip\2510c_cr29.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Looks for VirtualBox Guest Additions in registry
      Executes dropped EXE
      Checks BIOS information in registry
      Identifies Wine through registry keys
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:5044
  - - C:\Windows\System32\cmdkey.exe
      "C:\Windows\System32\cmdkey.exe" /delete Microsoft_Windows_Shell_ZipFolder:filename=C:\Users\Admin\AppData\Local\Temp\2510c_cr29.zip
      4⤵
      PID:3612
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "E:\Mutual.pdf"
    3⤵
    - Enumerates connected drives
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:796
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3520
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=96F3159BD671C505B15C2CD9170E7B44 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:4072
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=7A7277296602C78188E660C5A7E3359F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=7A7277296602C78188E660C5A7E3359F --renderer-client-id=2 --mojo-platform-channel-handle=1792 --allow-no-sandbox-job /prefetch:1
        5⤵
        
        PID:4888
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8FA1C76136F122EB4F87469BFE75B699 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8FA1C76136F122EB4F87469BFE75B699 --renderer-client-id=4 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job /prefetch:1
        5⤵
        
        PID:3168
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=637AEE1CE63FF5B0023A6EF3FBEB2225 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:2452
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9EF209587DB84ECFC328704793A01EE1 --mojo-platform-channel-handle=2672 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:2440
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6BF394383EE1453910A3983F2CC8636C --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5112

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7B0C.tmp\7B0D.tmp\7B0E.bat

Filesize
1KB

MD5
f20ef95f2054fc7eb9cffae06c6d4cce

SHA1
85d8d08cfae3b2c10b0cdca25fa645b37b3c7ff1

SHA256
f1ab1a299883e6d6e652d98a06ffc32e99bcb04ac1eec4266cf082efc6bd36e5

SHA512
5cde08fc0d8ea1bb4cba2941e509b19b25a42a40cb848730aa405a8a5b85dd25ab2163ec1a2e8fa458e4c4c534ddc05300f1080d234a0634c90081735bd85a66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_2510c_cr29.zip\2510c_cr29.exe

Filesize
2.7MB

MD5
7e869bf508f17734a0d41373f4d84bc2

SHA1
34886f40b8d6dc97c8892ce2fc2afc367d283439

SHA256
e78686c842f5497fa096978d9c4e7b4bff76cb4f34bba2a9d4fb64d06e554a2f

SHA512
36cd829cc13919c23fcc6f0d361ca443d65c003b3d77cbe0771d81415bc6660f1a69b18fe4beb3d79754051528d157b7b0ecc209918382514ec9cfd454d50dae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_2510c_cr29.zip\2510c_cr29.exe

Filesize
2.7MB

MD5
7e869bf508f17734a0d41373f4d84bc2

SHA1
34886f40b8d6dc97c8892ce2fc2afc367d283439

SHA256
e78686c842f5497fa096978d9c4e7b4bff76cb4f34bba2a9d4fb64d06e554a2f

SHA512
36cd829cc13919c23fcc6f0d361ca443d65c003b3d77cbe0771d81415bc6660f1a69b18fe4beb3d79754051528d157b7b0ecc209918382514ec9cfd454d50dae

Download Submit
memory/5044-163-0x00000287D3AD0000-0x00000287D3C23000-memory.dmp

Filesize
1.3MB

Download
memory/5044-164-0x00000287D3980000-0x00000287D3ACE000-memory.dmp

Filesize
1.3MB

Download