hxxps://admin[.]unifiedpost[.]com/umadmin/viewDoc?doc=W60D49F633F43E0C759182C2D2FFC28DD76872CEA18CFE9575889B85B187259D2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2022, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://admin.unifiedpost.com/umadmin/viewDoc?doc=W60D49F633F43E0C759182C2D2FFC28DD76872CEA18CFE9575889B85B187259D2
Sample221229-regzcsdb85

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	IEXPLORE.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	IEXPLORE.EXE

Modifies Internet Explorer settings 1 TTPs 43 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055e705317208724f818ff84de6ddc69d0000000002000000000010660000000100002000000080cd8bab166c2fa8a919b7710d53aba2627b13b2019ce8362ae09b556f7cfc9b000000000e80000000020000200000004fc28fd1ff699aff2b4e633e39eed96071678d57f66fa255d4b84e5e4cd573c9200000006c64d56b05e09fd43ac4bacc448dd47766a85eedec17a4836a7f77702f73d7194000000091e6f6d241a60615033fee8b6e707a21d76e66da0cc1fd737092bc71fad989f43a757afb0fd100db7e272afb6d0cf1496b0ae635bdf3e6ee8c3ef81ca2d737e0	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000055e705317208724f818ff84de6ddc69d00000000020000000000106600000001000020000000be15728492f775c6bd0030eedf8131f8fddac28aa2cfc4dc578347a6654048c8000000000e80000000020000200000003f761116316a9baf40e9b89187169f9f6106d0915305770b241128c6afe5adaa20000000d3c5c7070674267b422a481172d8c80947d502baa83ccd92898b6e555dfdf84d400000005ce43d24ed76a0e0e4d06b70288ad4e7cd4532f6f1aa71cb0eb146e55e0b798731a4b44d023d2a8f13e90da8a555d2b321e885b0e5428623a6e627e19254a255	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Toolbar	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "745476127"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31005591"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "750006532"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31005591"	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = c0d0212e971bd901	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 9072322e971bd901	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "745476127"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "379091351"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{57C90EC6-878A-11ED-B5DD-6EDF9685419A} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\WebBrowser\ITBar7Height = "21"	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31005591"	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2971393436-602173351-1645505021-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
3796	iexplore.exe
3212	IEXPLORE.EXE

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
3796	iexplore.exe
3796	iexplore.exe
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE
3212	IEXPLORE.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3796 wrote to memory of 3212	3796	iexplore.exe	82
PID 3796 wrote to memory of 3212	3796	iexplore.exe	82
PID 3796 wrote to memory of 3212	3796	iexplore.exe	82
PID 3212 wrote to memory of 1188	3212	IEXPLORE.EXE	85
PID 3212 wrote to memory of 1188	3212	IEXPLORE.EXE	85
PID 3212 wrote to memory of 1188	3212	IEXPLORE.EXE	85
PID 1188 wrote to memory of 3968	1188	AdobeCollabSync.exe	87
PID 1188 wrote to memory of 3968	1188	AdobeCollabSync.exe	87
PID 1188 wrote to memory of 3968	1188	AdobeCollabSync.exe	87
PID 3968 wrote to memory of 3308	3968	AdobeCollabSync.exe	89
PID 3968 wrote to memory of 3308	3968	AdobeCollabSync.exe	89
PID 3968 wrote to memory of 3308	3968	AdobeCollabSync.exe	89
PID 3212 wrote to memory of 3068	3212	IEXPLORE.EXE	94
PID 3212 wrote to memory of 3068	3212	IEXPLORE.EXE	94
PID 3212 wrote to memory of 3068	3212	IEXPLORE.EXE	94
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 4704	3068	RdrCEF.exe	97
PID 3068 wrote to memory of 1236	3068	RdrCEF.exe	98
PID 3068 wrote to memory of 1236	3068	RdrCEF.exe	98
PID 3068 wrote to memory of 1236	3068	RdrCEF.exe	98
PID 3068 wrote to memory of 1236	3068	RdrCEF.exe	98
PID 3068 wrote to memory of 1236	3068	RdrCEF.exe	98
PID 3068 wrote to memory of 1236	3068	RdrCEF.exe	98
PID 3068 wrote to memory of 1236	3068	RdrCEF.exe	98
PID 3068 wrote to memory of 1236	3068	RdrCEF.exe	98

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://admin.unifiedpost.com/umadmin/viewDoc?doc=W60D49F633F43E0C759182C2D2FFC28DD76872CEA18CFE9575889B85B187259D2
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3796
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3796 CREDAT:17410 /prefetch:2
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1188
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=1188
      4⤵
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:3968
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
        5⤵
        
        PID:3308
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3068
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C783139E035A849F2BE0B45B02798911 --mojo-platform-channel-handle=1716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4704
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=0CC912127C0F4D1EB0155B1D88280F50 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=0CC912127C0F4D1EB0155B1D88280F50 --renderer-client-id=2 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1236
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A72DDFF48FC8834635F8DE1435E9A267 --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3764
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=87E0A1362E35E5CD6F40E2CD86DFA4BC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=87E0A1362E35E5CD6F40E2CD86DFA4BC --renderer-client-id=5 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:1876
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=380B847D9DA7A49F2084EA2027F45FB8 --mojo-platform-channel-handle=2440 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:3728
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=352AD9C7C1221D2AB0F826541FA85F63 --mojo-platform-channel-handle=2752 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1372

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe" -Embedding
1⤵
PID:4760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 05e37d291bc73ba9dda08ad62ead84dfc2f1d00a1fd0a12d3037122526e82ff8
MD5 d6d75688d3330037229d3fe2f702acc8
SHA1 60daae05f0325951c669a38b7ee4aa686d885465
SHA512 a30f0568c3648322327752e49824dad3dd5762e292bb2ce10effb2736d6bb20118b09e453823132525ac159c7a6b45cf7e841b1f4a16c8b433ed81e9d4ad9de6
SSDEEP 192:K+oGsTzoU27NTaUxmyX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN1X44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 b56d8ba1819581848af7c35b08cdcd4cfa10ad50b3382259e65f7294533f6586
MD5 56032cbb49cf1aab2a56f9735eaa67dd
SHA1 46be51f2cdea70674a1ab6f537a84f4f0d9fe321
SHA512 29d193c77d351cfd5f7a5a4e4625072a2c659ffd864cb59576f03d99033ab0734287b33a562bf425d6fb2d8b343ba016465d4c433ff00500b16a983eecd517bc
SSDEEP 192:a+oGsTzoU27NTaUxmGoHgwX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGW:aklNPoAwX44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 3.2MB
SHA256 c4aa9e8978971f5d3d395a9ac5facdf001459a3d5ada1a685a1a32bede44b4c4
MD5 432dd7797f26ac1db9d06a2076d5c86d
SHA1 b003dacd9100ea2e6e7ca016f855fb944a8edceb
SHA512 b50eb7c9d78937799369c4e7dcd9917add276e5ea0e71c453651d4c374fc65060ca1c9c2f91576eeb18f164b3fd74535dce8086dbda89d2a7ba1889ec6893bcf
SSDEEP 98304:KSYN/WNXst4AiW/K5I+kVsvyrUH0nGujxn:Kj1uWCSX9AH0Gudn
MD5 SHA1 SHA512 SSDEEP

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 471B
SHA256 215e23557271102ee3148e9237e60e59b001d9c386b0c3673d25b65777096513
MD5 7d11e5a60e89225e9ea4bf14000a6fcb
SHA1 5203b8fa8b2257d0aca8d1f5fc2e74302e90827c
SHA512 514b460e2efe3d4f299858d6e082f1f86fd3cb47a62fb6b778da9073d2a9a1ea0b8f98e37381ad43f9e2e11f7e1a8968e914b83602b6c1eaac805b39ee885228
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 5db5a20cad4dbfd74872da0f94b49f9c1adcde1e516222bc65ae1cfc10974b2b
MD5 25e86fc66b65f1cc30d8242135702a7b
SHA1 b47f0473118b14bd4b8e00147458ccdcafd19003
SHA512 7ef0da1e0db6271e8cf6631ab5cf8128d55f27a785b3eaa2e1c4a7bae143af133621690694543a2e3326e55e9b6d4bb99af62b63e9f916864848b83ce0e87935
MD5 SHA1 SHA512

Submit Download

7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Size 434B
SHA256 725389467937347b258470602b3d419f4e02ef7f2616d41914152678fab80bf9
MD5 904a2b0e645749eab2ade8b680626b4d
SHA1 f6dfc65417443523c8e6d55d981c01bc81685455
SHA512 3305f438b8ec5b08e266bb99a7741ef083d5092f5a8dc4dc296395998632754e8c4313c042f763def420ab26b5d96333b91bf13368d9a3e0d899f88c1d1fd959
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 430B
SHA256 fff144b8331ca62bbb792932bd7fc38e9b85a49a315b93d95afc04a00a5ac050
MD5 7d446137962971e02fcfcf58fea69231
SHA1 9bb7d6c1b6bb276f1e0d3218907eac7169152ee0
SHA512 3f700bbfa2786266b39f7c799b704254226bf731212cbf1e1f335f0df0555743a56b56de209b23c31aa2346abe348ba4776ecb216fd28cdc5429ae0b8f730868
MD5 SHA1 SHA512

Submit Download