Overview
overview
8Static
static
4ClickShare...er.msi
windows7-x64
8ClickShare...er.msi
windows10-2004-x64
8Quick start guide.pdf
windows7-x64
1Quick start guide.pdf
windows10-2004-x64
1[KB11496] ...CM.pdf
windows7-x64
1[KB11496] ...CM.pdf
windows10-2004-x64
1[KB11526] ...ly.pdf
windows7-x64
1[KB11526] ...ly.pdf
windows10-2004-x64
1[KB12000] ...I).pdf
windows7-x64
1[KB12000] ...I).pdf
windows10-2004-x64
1[KB8544] B...ny.pdf
windows7-x64
1[KB8544] B...ny.pdf
windows10-2004-x64
5Analysis
-
max time kernel
112s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2023, 08:06
Behavioral task
behavioral1
Sample
ClickShare_Installer.msi
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ClickShare_Installer.msi
Resource
win10v2004-20220812-en
Behavioral task
behavioral3
Sample
Quick start guide.pdf
Resource
win7-20220812-en
Behavioral task
behavioral4
Sample
Quick start guide.pdf
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
[KB11496] Deploying the ClickShare App with Microsoft SCCM.pdf
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
[KB11496] Deploying the ClickShare App with Microsoft SCCM.pdf
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
[KB11526] How to uninstall ClickShare Desktop app v4.3 massively.pdf
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
[KB11526] How to uninstall ClickShare Desktop app v4.3 massively.pdf
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
[KB12000] What are the available parameters for the ClickShare Desktop App installer (MSI).pdf
Resource
win7-20220812-en
Behavioral task
behavioral10
Sample
[KB12000] What are the available parameters for the ClickShare Desktop App installer (MSI).pdf
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
[KB8544] Bulk Distribution cross your company.pdf
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
[KB8544] Bulk Distribution cross your company.pdf
Resource
win10v2004-20220812-en
General
-
Target
[KB11526] How to uninstall ClickShare Desktop app v4.3 massively.pdf
-
Size
80KB
-
MD5
fa4c7a4043d096f7ad2e8d3e08a0bc8e
-
SHA1
a844436a8d05339a7ba1a46a24101f7d8903b5dd
-
SHA256
d6bfc0d6829540780d63d1dc579c9872ecd56338b6bd28116d4cce0f712c32e6
-
SHA512
ffa0b5807efa8fbd18c5a5dfe5d56cec8109f3cf04ffba06900251652efd65dccb9ebc3632b193685e654adf964f9f53329fdfd31cc4a82711818a14358283f7
-
SSDEEP
1536:mzrV4J7Jo6YxhkLDx8SodCR6Li4NZIOakdubrJ0eaiePeJGsYF153KFxFB:6U7Jo6EkLd8So8If3O8PekhFaZB
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4788 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe 4788 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4788 wrote to memory of 1756 4788 AcroRd32.exe 84 PID 4788 wrote to memory of 1756 4788 AcroRd32.exe 84 PID 4788 wrote to memory of 1756 4788 AcroRd32.exe 84 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 772 1756 RdrCEF.exe 87 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88 PID 1756 wrote to memory of 4252 1756 RdrCEF.exe 88
Processes
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\[KB11526] How to uninstall ClickShare Desktop app v4.3 massively.pdf"1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:1756 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=186459559F4FA35C4E4919A76A547E8B --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:772
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=DE5584E68D8C7D6B411A5268185E43D7 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=DE5584E68D8C7D6B411A5268185E43D7 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:13⤵PID:4252
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C1CEEABCE1126DBFFCA26DFE7F4C2A54 --mojo-platform-channel-handle=2328 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1504
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E9EF851EF60F4E4DEAADA551F979DD6B --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:4992
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B6FFDB615F4492406A6C9C2CEAB449F4 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=1 --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B6FFDB615F4492406A6C9C2CEAB449F4 --renderer-client-id=6 --mojo-platform-channel-handle=1816 --allow-no-sandbox-job /prefetch:13⤵PID:1616
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F17B61DD899A3D6379BC03BD52DD4621 --mojo-platform-channel-handle=2472 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2456
-
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3096