dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b

General

Target

dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
Size

467KB
MD5

773251535e248889e0f7536294b9e7ec
SHA1

e8aee374c842f0a21d8ffe20dac6d321f2c612df
SHA256

dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b
SHA512

000013a61bde51eb3dc18da46d3cdf7b5f4910d02e07054b43bb5fe160e8aac69583fa53abc2387afb453136078ad9f79db201b674a43eb548ccaffb7c9c7e76
SSDEEP

12288:4bVtorSa42uKNEPnJHmCUVfgHIwNPxfN6atcz+3w6:Ior/uQEPJHjUhgoyfYt+3w6

Score

8^/10

persistence

Malware Config

Signatures

Modifies Installed Components in the registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8324D541-F8XV-DDJW-JU8V-01HO4G21E1GW}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe\""	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8324D541-F8XV-DDJW-JU8V-01HO4G21E1GW}	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe"	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe

description	pid	process	target process
PID 444 set thread context of 1960	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\Local Settings	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

AcroRd32.exe

pid	process
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe
4332	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4332 AcroRd32.exe
Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

4332 AcroRd32.exe
4332 AcroRd32.exe
4332 AcroRd32.exe
4332 AcroRd32.exe
4332 AcroRd32.exe
4332 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 444 wrote to memory of 4332	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	AcroRd32.exe
PID 444 wrote to memory of 4332	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	AcroRd32.exe
PID 444 wrote to memory of 4332	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	AcroRd32.exe
PID 444 wrote to memory of 1960	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
PID 444 wrote to memory of 1960	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
PID 444 wrote to memory of 1960	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
PID 444 wrote to memory of 1960	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
PID 444 wrote to memory of 1960	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
PID 444 wrote to memory of 1960	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
PID 444 wrote to memory of 1960	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
PID 444 wrote to memory of 1960	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
PID 444 wrote to memory of 1960	444	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe	dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
PID 4332 wrote to memory of 4908	4332	AcroRd32.exe	RdrCEF.exe
PID 4332 wrote to memory of 4908	4332	AcroRd32.exe	RdrCEF.exe
PID 4332 wrote to memory of 4908	4332	AcroRd32.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 2092	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3928	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3928	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3928	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3928	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3928	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3928	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3928	4908	RdrCEF.exe	RdrCEF.exe
PID 4908 wrote to memory of 3928	4908	RdrCEF.exe	RdrCEF.exe

C:\Users\Admin\AppData\Local\Temp\dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
"C:\Users\Admin\AppData\Local\Temp\dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:444

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\VFJWV.pdf"
2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4332

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
- Suspicious use of WriteProcessMemory
PID:4908

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=97D2F6ABEC48D3A5B0026DE185258F77 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2092

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=8F47048E7F5255BBC64A886A77E01E07 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=8F47048E7F5255BBC64A886A77E01E07 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
4⤵
PID:3928

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=79C59E1FF5B39E16C08143759EC748D2 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:3620

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DE92C1E1AD370E7FDAD423CC3AB16B79 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DE92C1E1AD370E7FDAD423CC3AB16B79 --renderer-client-id=5 --mojo-platform-channel-handle=1960 --allow-no-sandbox-job /prefetch:1
4⤵
PID:4728

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=14F4570DFB1ED702DCCE5882DF6D5F87 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:2220

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BC4DED4AC8324DD312B0425FA3D51A7B --mojo-platform-channel-handle=2680 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
PID:1480

C:\Users\Admin\AppData\Local\Temp\dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe
"C:\Users\Admin\AppData\Local\Temp\dc81b0d2c532418194744ca5921d011c7c2a69ba8cb537d26ced4a576a869c9b.exe"
2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
PID:1960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

2

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\VFJWV.pdf

Filesize
115KB

MD5
c0444afde80acf8d3172c92d9c8d4e3d

SHA1
ba920fc8a5be4f18942480a1658c84c8a64c80ae

SHA256
6bef10847f8d08ccf0f89aec3414acaa843366b3b2d909131b27a19e53847126

SHA512
53578e7bbfe83ebe7f89090d872e0c53a3c0098eb238db5d34be5fbd45c62c8fdd25bca8f11ac0ccd604d9b3d612f3c64cc140a5d1edfaa2f856959ba063ab13

Download Submit
memory/1480-160-0x0000000000000000-mapping.dmp

Download
memory/1960-135-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1960-136-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1960-137-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1960-134-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/1960-133-0x0000000000000000-mapping.dmp

Download
memory/2092-141-0x0000000000000000-mapping.dmp

Download
memory/2220-157-0x0000000000000000-mapping.dmp

Download
memory/3620-149-0x0000000000000000-mapping.dmp

Download
memory/3928-144-0x0000000000000000-mapping.dmp

Download
memory/4332-132-0x0000000000000000-mapping.dmp

Download
memory/4728-152-0x0000000000000000-mapping.dmp

Download
memory/4908-139-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads