bumblebee | 6581212a5a17193ec0a33c6df595b5d3718ffd2cf139f9e6d6200496511d4c99

Resubmissions

31-10-2022 11:02

221031-m5mkbaagb9 10

27-10-2022 17:41

221027-v9ez2adagn 10

Analysis

max time kernel
172s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2022 11:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mutual_67.pdf.exe
Size

316KB
MD5

982bf5b99b3ca20cfc0d93444ca1c40d
SHA1

77a6d8b1b01863ffd68bd0030b3b6122c4f6e1da
SHA256

7b83d9b8592def23e8ca5075c4d13e8c008bdb5f8a04763c57a5d56e14e3c1e1
SHA512

d1a0ffe634f4fff5427e5efd399146d7acb02ba582425e3b69ed5dd796e77caa29c37f50cfa544ad57e0f926f768336ee24a8132c1ea4ab5f3d27dd3c6edd508
SSDEEP

6144:4t5hBPi0BW69hd1MMdxPe9N9uA069TBBGFrnn:4tzww69TTI

Score

10^/10

bumblebee 2510 evasion trojan

Malware Config

Extracted

Family

bumblebee

Botnet

2510

69.46.15.158:443

135.125.241.35:443

172.86.120.141:443

rc4.plain

Signatures

BumbleBee
BumbleBee is a webshell malware written in C++.
trojan bumblebee

Enumerates VirtualBox registry keys 2 TTPs 5 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxGuest	2510c_cr69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxMouse	2510c_cr69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxService	2510c_cr69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxSF	2510c_cr69.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VBoxVideo	2510c_cr69.exe

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 3 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	2510c_cr69.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\FADT\VBOX__	2510c_cr69.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\RSDT\VBOX__	2510c_cr69.exe

Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Oracle\VirtualBox Guest Additions	2510c_cr69.exe

Executes dropped EXE 1 IoCs

pid	Process
4880	2510c_cr69.exe

Checks BIOS information in registry 2 TTPs 3 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2510c_cr69.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	2510c_cr69.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate	2510c_cr69.exe

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	Mutual_67.pdf.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Wine	2510c_cr69.exe

Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs

pid	Process
4880	2510c_cr69.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	cmd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe
4880	2510c_cr69.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4264	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
4264	AcroRd32.exe
4264	AcroRd32.exe
4264	AcroRd32.exe
4264	AcroRd32.exe
4264	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4488 wrote to memory of 2308	4488	Mutual_67.pdf.exe	78
PID 4488 wrote to memory of 2308	4488	Mutual_67.pdf.exe	78
PID 2308 wrote to memory of 4800	2308	cmd.exe	80
PID 2308 wrote to memory of 4800	2308	cmd.exe	80
PID 2308 wrote to memory of 4264	2308	cmd.exe	81
PID 2308 wrote to memory of 4264	2308	cmd.exe	81
PID 2308 wrote to memory of 4264	2308	cmd.exe	81
PID 4800 wrote to memory of 4920	4800	WScript.exe	84
PID 4800 wrote to memory of 4920	4800	WScript.exe	84
PID 4800 wrote to memory of 4880	4800	WScript.exe	85
PID 4800 wrote to memory of 4880	4800	WScript.exe	85
PID 4264 wrote to memory of 752	4264	AcroRd32.exe	86
PID 4264 wrote to memory of 752	4264	AcroRd32.exe	86
PID 4264 wrote to memory of 752	4264	AcroRd32.exe	86
PID 4800 wrote to memory of 4064	4800	WScript.exe	87
PID 4800 wrote to memory of 4064	4800	WScript.exe	87
PID 4264 wrote to memory of 4468	4264	AcroRd32.exe	89
PID 4264 wrote to memory of 4468	4264	AcroRd32.exe	89
PID 4264 wrote to memory of 4468	4264	AcroRd32.exe	89
PID 4264 wrote to memory of 3244	4264	AcroRd32.exe	95
PID 4264 wrote to memory of 3244	4264	AcroRd32.exe	95
PID 4264 wrote to memory of 3244	4264	AcroRd32.exe	95
PID 4264 wrote to memory of 4740	4264	AcroRd32.exe	97
PID 4264 wrote to memory of 4740	4264	AcroRd32.exe	97
PID 4264 wrote to memory of 4740	4264	AcroRd32.exe	97
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98
PID 3244 wrote to memory of 4964	3244	RdrCEF.exe	98

C:\Users\Admin\AppData\Local\Temp\Mutual_67.pdf.exe
"C:\Users\Admin\AppData\Local\Temp\Mutual_67.pdf.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4488
- C:\Windows\system32\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\33C2.tmp\33C3.tmp\33C4.bat C:\Users\Admin\AppData\Local\Temp\Mutual_67.pdf.exe"
  2⤵
  - Checks computer location settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:2308
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\name.js"
    3⤵
    - Checks computer location settings
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\System32\cmdkey.exe
      "C:\Windows\System32\cmdkey.exe" /generic:Microsoft_Windows_Shell_ZipFolder:filename=C:\Users\Admin\AppData\Local\Temp\2510c_cr69.zip /pass:kLjBEyO /user:""
      4⤵
      PID:4920
  - - C:\Users\Admin\AppData\Local\Temp\Temp1_2510c_cr69.zip\2510c_cr69.exe
      "C:\Users\Admin\AppData\Local\Temp\Temp1_2510c_cr69.zip\2510c_cr69.exe"
      4⤵
      Enumerates VirtualBox registry keys
      Identifies VirtualBox via ACPI registry values (likely anti-VM)
      Looks for VirtualBox Guest Additions in registry
      Executes dropped EXE
      Checks BIOS information in registry
      Identifies Wine through registry keys
      Suspicious use of NtCreateThreadExHideFromDebugger
      Suspicious behavior: EnumeratesProcesses
      PID:4880
  - - C:\Windows\System32\cmdkey.exe
      "C:\Windows\System32\cmdkey.exe" /delete Microsoft_Windows_Shell_ZipFolder:filename=C:\Users\Admin\AppData\Local\Temp\2510c_cr69.zip
      4⤵
      PID:4064
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Mutual.pdf"
    3⤵
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4264
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      PID:752
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      PID:4468
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3244
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=25E5D3413325C3255492DE1CC98C29A5 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:4964
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CEC5ADB65354CBB2374DED15F90E1194 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CEC5ADB65354CBB2374DED15F90E1194 --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
        5⤵
        
        PID:4236
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0BB8693465A8937E89031B53581A5115 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0BB8693465A8937E89031B53581A5115 --renderer-client-id=4 --mojo-platform-channel-handle=2152 --allow-no-sandbox-job /prefetch:1
        5⤵
        
        PID:4280
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=52D780DD0CC8D9F71FF6AA748A8F07A7 --mojo-platform-channel-handle=2536 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:3960
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C0B66262F785D1148DECB851B45C1718 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:892
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E1BD9F8B3F5988C984DDD9A7EF92E963 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:4732
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\33C2.tmp\33C3.tmp\33C4.bat

Filesize
1KB

MD5
38c904eb3b649ccd3cbf61d57b76c046

SHA1
1a699545e71e81c4c04ca1894bc3be9cc8f024b1

SHA256
4e58072d8f22782ef8e4e5a97ac7178cc7cd9a69b925ffe71537e79097263924

SHA512
a3613cd67349f05a1c4441202b100beac89ac0462f05586bed65bc28041488b03891dd86f7e80eb24ae2834a1b6929368db6d5f13a0d58904c3157e9a6363c86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_2510c_cr69.zip\2510c_cr69.exe

Filesize
2.7MB

MD5
bf5889c772dd1377789fb54da0c6d08c

SHA1
ffb4b43e63cdc19f6bd7904a8bccd16038780b23

SHA256
aea6933430252325e7bec04d778064ff973a4db0d7dd237622efca5ad1f7db20

SHA512
e34e4019694390c69084b05cea1707f730808a09521284ac7fe082e48eff9a0401fdb884f770dee3053a24247baca4a2c409f4be2d80da06dec9269d68053caa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_2510c_cr69.zip\2510c_cr69.exe

Filesize
2.7MB

MD5
bf5889c772dd1377789fb54da0c6d08c

SHA1
ffb4b43e63cdc19f6bd7904a8bccd16038780b23

SHA256
aea6933430252325e7bec04d778064ff973a4db0d7dd237622efca5ad1f7db20

SHA512
e34e4019694390c69084b05cea1707f730808a09521284ac7fe082e48eff9a0401fdb884f770dee3053a24247baca4a2c409f4be2d80da06dec9269d68053caa

Download Submit
memory/4880-142-0x0000022359B40000-0x0000022359C8F000-memory.dmp

Filesize
1.3MB

Download
memory/4880-140-0x0000022359C90000-0x0000022359DE3000-memory.dmp

Filesize
1.3MB

Download