6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d

Analysis

max time kernel
101s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
01/12/2022, 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe
Size

218KB
MD5

35f7d8fab7f9122b6990b2972c63a6c7
SHA1

4fc7713c4c370ff0bdaa79614138b754859bca5a
SHA256

6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d
SHA512

7ccb7976cda96394ca3102e596319b93c9a881e1447d52aa0c2ae61dd048a1be30ee5da0a1548bbc61a6c5a20986f4d7016c8dd2d489751ec46a0d9a5c5ee3aa
SSDEEP

3072:SpRFOXcNXzMWAKl8HCZ5eqq1d0mG1yGTtS8U2wtSByxybzWRVOO5/WgjE00kaA20:SpRK2jR8ij9gd07XSZUvyJjE0CA2j

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4244	svchost.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 4800 set thread context of 4244	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4436	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe
4436	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 4436	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	82
PID 4800 wrote to memory of 4436	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	82
PID 4800 wrote to memory of 4436	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	82
PID 4800 wrote to memory of 4244	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	83
PID 4800 wrote to memory of 4244	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	83
PID 4800 wrote to memory of 4244	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	83
PID 4800 wrote to memory of 4244	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	83
PID 4800 wrote to memory of 4244	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	83
PID 4800 wrote to memory of 4244	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	83
PID 4800 wrote to memory of 4244	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	83
PID 4800 wrote to memory of 4244	4800	6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe	83
PID 4436 wrote to memory of 3488	4436	AcroRd32.exe	86
PID 4436 wrote to memory of 3488	4436	AcroRd32.exe	86
PID 4436 wrote to memory of 3488	4436	AcroRd32.exe	86
PID 4436 wrote to memory of 4732	4436	AcroRd32.exe	87
PID 4436 wrote to memory of 4732	4436	AcroRd32.exe	87
PID 4436 wrote to memory of 4732	4436	AcroRd32.exe	87
PID 4436 wrote to memory of 5024	4436	AcroRd32.exe	89
PID 4436 wrote to memory of 5024	4436	AcroRd32.exe	89
PID 4436 wrote to memory of 5024	4436	AcroRd32.exe	89
PID 4436 wrote to memory of 2584	4436	AcroRd32.exe	91
PID 4436 wrote to memory of 2584	4436	AcroRd32.exe	91
PID 4436 wrote to memory of 2584	4436	AcroRd32.exe	91
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92
PID 5024 wrote to memory of 1680	5024	RdrCEF.exe	92

C:\Users\Admin\AppData\Local\Temp\6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe
"C:\Users\Admin\AppData\Local\Temp\6125bd4c2b73c5f367de3ed7748dbbe5b178316c0106d9ee2431c65de053960d.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Asset_Declaration_Form.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:3488
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:4732
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E5D9621D72024D449DA82B6DECDA3B17 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E5D9621D72024D449DA82B6DECDA3B17 --renderer-client-id=2 --mojo-platform-channel-handle=1760 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1680
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9E7F890208079AAF32CCAC18411A58C1 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1608
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=63B00B509E193BC95A531AF06C0809F6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=63B00B509E193BC95A531AF06C0809F6 --renderer-client-id=4 --mojo-platform-channel-handle=2172 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:5100
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=EE16497B50308D777BA2B96E8513F397 --mojo-platform-channel-handle=2556 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4000
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D8052E32C03B0059F9E5620AF15B7636 --mojo-platform-channel-handle=2104 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:720
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ACA62CCDEFDBD66A71F913608BC103A5 --mojo-platform-channel-handle=2584 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2380
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:2584
- C:\Users\Admin\AppData\Local\Temp\svchost.exe
  C:\Users\Admin\AppData\Local\Temp\svchost.exe
  2⤵
  - Executes dropped EXE
  PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Asset_Declaration_Form.pdf

Filesize
42KB

MD5
2843d1e5892f3a21677141d4b6ba7e6e

SHA1
6552e4e7e70f198b5f5e1d08100bfb44c41f0ebb

SHA256
bd7bc9292943d483317410913bb0acca1d1e2476161458abbfacae0950823529

SHA512
65b9b516a5399aa3141c2b11cb5217db9d0b7570b15c2ed93760bd6bb994d77899f36a8322040b16072c72f82e9d2fe1e437406f692dc57be07588aad1aa0e09

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
C:\Users\Admin\AppData\Local\Temp\svchost.exe

Filesize
1.1MB

MD5
d881de17aa8f2e2c08cbb7b265f928f9

SHA1
08936aebc87decf0af6e8eada191062b5e65ac2a

SHA256
b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0

SHA512
5f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34

Download Submit
memory/4244-140-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4244-136-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/4800-132-0x0000000074940000-0x0000000074EF1000-memory.dmp

Filesize
5.7MB

Download
memory/4800-134-0x0000000074940000-0x0000000074EF1000-memory.dmp

Filesize
5.7MB

Download
memory/4800-141-0x0000000074940000-0x0000000074EF1000-memory.dmp

Filesize
5.7MB

Download