Analysis
-
max time kernel
153s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 08:10
Static task
static1
Behavioral task
behavioral1
Sample
28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe
Resource
win10v2004-20220812-en
General
-
Target
28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe
-
Size
454KB
-
MD5
cb971ae92b1d158627d7419bba78071c
-
SHA1
2d9c21fad119114a5be5208aa57ba1ad9dd9fa80
-
SHA256
28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450
-
SHA512
67a7cc270d88a53af5df8748c37918f75b2e513e45b732f183d786bd11250bd83834ed263870792843b2ab45a99dc87bae1b4e2087dbe8c43e34510d852b1b7c
-
SSDEEP
12288:iAQDua42iKNEPnJHmCUVfgHIwG4RCyR7ILlC:GLiQEPJHjUhgoQCG7ILE
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 2 IoCs
Processes:
28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8324D541-F8XV-DDJW-JU8V-01HO4G21E1GW} 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8324D541-F8XV-DDJW-JU8V-01HO4G21E1GW}\StubPath = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe\"" 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NetWire = "C:\\Users\\Admin\\AppData\\Local\\Temp\\28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe" 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exedescription pid process target process PID 4984 set thread context of 2580 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
AcroRd32.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
Processes:
AcroRd32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
Processes:
28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
AcroRd32.exepid process 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
AcroRd32.exepid process 2012 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
AcroRd32.exepid process 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe 2012 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exeAcroRd32.exeRdrCEF.exedescription pid process target process PID 4984 wrote to memory of 2012 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe AcroRd32.exe PID 4984 wrote to memory of 2012 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe AcroRd32.exe PID 4984 wrote to memory of 2012 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe AcroRd32.exe PID 4984 wrote to memory of 2580 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe PID 4984 wrote to memory of 2580 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe PID 4984 wrote to memory of 2580 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe PID 4984 wrote to memory of 2580 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe PID 4984 wrote to memory of 2580 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe PID 4984 wrote to memory of 2580 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe PID 4984 wrote to memory of 2580 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe PID 4984 wrote to memory of 2580 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe PID 4984 wrote to memory of 2580 4984 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe 28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe PID 2012 wrote to memory of 3652 2012 AcroRd32.exe RdrCEF.exe PID 2012 wrote to memory of 3652 2012 AcroRd32.exe RdrCEF.exe PID 2012 wrote to memory of 3652 2012 AcroRd32.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3760 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3312 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3312 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3312 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3312 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3312 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3312 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3312 3652 RdrCEF.exe RdrCEF.exe PID 3652 wrote to memory of 3312 3652 RdrCEF.exe RdrCEF.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe"C:\Users\Admin\AppData\Local\Temp\28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\GJILI.pdf"2⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140433⤵
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=31D5400A78848C3D079F2CB15A033FF7 --mojo-platform-channel-handle=1732 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=088E0A164AAF474531040809F2A12C30 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=088E0A164AAF474531040809F2A12C30 --renderer-client-id=2 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=334190E7DE42A818038A552F88E7F2E6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=334190E7DE42A818038A552F88E7F2E6 --renderer-client-id=4 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job /prefetch:14⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=120F4E910436B1ED858C94A103FEC788 --mojo-platform-channel-handle=2444 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=08E84379C9C44BC10786AF52C75C4A7D --mojo-platform-channel-handle=1800 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3D41606F19C87FF517B248DD3C7F4C19 --mojo-platform-channel-handle=1724 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:24⤵
-
C:\Users\Admin\AppData\Local\Temp\28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe"C:\Users\Admin\AppData\Local\Temp\28a5d4b6f337819a379d623de0468bc51c6423b830ef6d923f1752ce209b2450.exe"2⤵
- Modifies Installed Components in the registry
- Adds Run key to start application
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\GJILI.pdfFilesize
115KB
MD5c0444afde80acf8d3172c92d9c8d4e3d
SHA1ba920fc8a5be4f18942480a1658c84c8a64c80ae
SHA2566bef10847f8d08ccf0f89aec3414acaa843366b3b2d909131b27a19e53847126
SHA51253578e7bbfe83ebe7f89090d872e0c53a3c0098eb238db5d34be5fbd45c62c8fdd25bca8f11ac0ccd604d9b3d612f3c64cc140a5d1edfaa2f856959ba063ab13
-
memory/1928-157-0x0000000000000000-mapping.dmp
-
memory/2012-132-0x0000000000000000-mapping.dmp
-
memory/2580-135-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2580-136-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2580-137-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2580-134-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/2580-133-0x0000000000000000-mapping.dmp
-
memory/3140-149-0x0000000000000000-mapping.dmp
-
memory/3312-144-0x0000000000000000-mapping.dmp
-
memory/3652-139-0x0000000000000000-mapping.dmp
-
memory/3760-141-0x0000000000000000-mapping.dmp
-
memory/3764-154-0x0000000000000000-mapping.dmp
-
memory/4344-160-0x0000000000000000-mapping.dmp