hxxps://www[.]dropbox[.]com/s/zj7cz5633tszjk3/Zafiro%20EA%20MFF%20v1[.]13%20%2B%20Zafiro%20EA%20FTMO%20v1[.]13[.]zip?dl=0

max time kernel
180s
max time network
182s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
08-06-2023 10:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.dropbox.com/s/zj7cz5633tszjk3/Zafiro%20EA%20MFF%20v1.13%20%2B%20Zafiro%20EA%20FTMO%20v1.13.zip?dl=0

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	explorer.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	explorer.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 6 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1529757233-3489015626-3409890339-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1529757233-3489015626-3409890339-1000\{7F54869B-228A-425C-8596-C45E4DB051BE}	chrome.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2368	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4768	explorer.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1752	chrome.exe
1752	chrome.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
2784	chrome.exe
2784	chrome.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe
Token: SeShutdownPrivilege	1752	chrome.exe
Token: SeCreatePagefilePrivilege	1752	chrome.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4768	explorer.exe

Suspicious use of SendNotifyMessage 57 IoCs

pid	Process
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
1752	chrome.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe
4252	taskmgr.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2356	AcroRd32.exe
2356	AcroRd32.exe
2356	AcroRd32.exe
2356	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1752 wrote to memory of 4488	1752	chrome.exe	84
PID 1752 wrote to memory of 4488	1752	chrome.exe	84
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 3408	1752	chrome.exe	85
PID 1752 wrote to memory of 4712	1752	chrome.exe	86
PID 1752 wrote to memory of 4712	1752	chrome.exe	86
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87
PID 1752 wrote to memory of 1900	1752	chrome.exe	87

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.dropbox.com/s/zj7cz5633tszjk3/Zafiro%20EA%20MFF%20v1.13%20%2B%20Zafiro%20EA%20FTMO%20v1.13.zip?dl=0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1752
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa29a69758,0x7ffa29a69768,0x7ffa29a69778
  2⤵
  PID:4488
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1828,i,5261533205577561646,1718094226967568018,131072 /prefetch:2
  2⤵
  PID:3408
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1828,i,5261533205577561646,1718094226967568018,131072 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1828,i,5261533205577561646,1718094226967568018,131072 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3216 --field-trial-handle=1828,i,5261533205577561646,1718094226967568018,131072 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3236 --field-trial-handle=1828,i,5261533205577561646,1718094226967568018,131072 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1828,i,5261533205577561646,1718094226967568018,131072 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3084
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4936 --field-trial-handle=1828,i,5261533205577561646,1718094226967568018,131072 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5392 --field-trial-handle=1828,i,5261533205577561646,1718094226967568018,131072 /prefetch:1
  2⤵
  PID:772
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 --field-trial-handle=1828,i,5261533205577561646,1718094226967568018,131072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2784

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:3808

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Desktop\UnlockEnter.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2356
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:3152
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FCF4334C5DEF37AAF545EE8C6B495A4C --mojo-platform-channel-handle=1720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4604
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B839DEF719A2D8DDCE53B75E60BBF080 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B839DEF719A2D8DDCE53B75E60BBF080 --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:4128
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=102A2313BE3CB97C96D4B8F027E391FA --mojo-platform-channel-handle=2300 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1440
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BB559CC8151E941EF70DACE57FD9B84F --mojo-platform-channel-handle=1816 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1560
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=38E84A2FBDCD37A965938B90D1F88542 --mojo-platform-channel-handle=1980 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\EnableImport.css
1⤵
- Opens file in notepad (likely ransom note)
PID:2368

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4252

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{06622D85-6856-4460-8DE1-A81921B41C4B}
1⤵
PID:1256

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{5BD95610-9434-43C2-886C-57852CC8A120} -Embedding
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
PID:4768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
acb2dfbc317be4dc34f2e95ca99471bb

SHA1
7baaabd82139407bf4b83f0ff29e59dc4bad606c

SHA256
6857decf4c2523d9388cf600cfd37fa843bb521f9b08b1e5aa403def36ae0aa3

SHA512
d0525a476a7e38bfe055d7f11e28597c81f2464fb5112bda5e91bd683f14ad51f9518c9868155482f8003c025374dbeef5d11e354d6745b39d391db4ee72318d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
e32f88c1303c81fad7fcc1507e4cb589

SHA1
f3146c39ef45bc4df22b4ecc2527250ad346780d

SHA256
d4d1f6d82b63b8e7f5b563a608c47095f578e40eb103995bd0905fa149d72983

SHA512
3e8e6ae5155be88a63882e5ad5c317a8a514458572294a46d989b4baf02209ec97b81836ca174d8c558ca5e97c6296c822305a2e14ea34ef8808e0480a277fdf

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
77abda888cbe16317952226c713f98dd

SHA1
f2bb3dda651f4e7831b4f05f80f8924c9d7bb20b

SHA256
c581b79e8c032047e49510f827897e29923063eec4e42b5cf7ed763f4b4d1eaa

SHA512
29126fe18416787a69adde486546eb0d7f49226f50b19605eab54e0866334bfc8584e7b9c04a1fc5a822b83296445ff2b8fe3e4676c5437bba645e69a6a9fb74

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
a9c807321e39848efa44b817d136d2e6

SHA1
cf0dfdd836a3d5436cead24893f647c8e5805291

SHA256
2774016740d72ed38cf021e0a2947b2b7d2c10057bb93a269df8e2c5682e1ec1

SHA512
e9b0f058f16d8964e35083b39c527deebc4b29d9775f7a7719a12775ecd5511825e9516e0e889926fca7424a7f7ca4b7ea09991c6b3375e41c917ff2ff19a9a0

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
5ddeba6f84b6f5313479b8ddde1a380e

SHA1
9a36582f6ebd238b319a4443087d68e6c417b35d

SHA256
82892c23d0d534fe30f1c5f02de07bf4f69277061a92cc2b7b7190628288b14c

SHA512
4e1615a7052e167a4bb5870308d4344a905c4e2e4d6b627557dffd3abe4d84bf1badc7217fd8613d01c119e4ba5ab91f8d30f8174990a39cd118606b1f8f21fd

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
f0453725c8e6a27cc56930e83fd21134

SHA1
23e6c23a7621fdaabbaad0d0198545b97c83826b

SHA256
b3657951e423918adfb23211f609635e1a758ae542fe649bb73c601a78b32c7b

SHA512
fd2484f72d6744dc6303a1bfbd8b5f709385690def4d0c1763ef2350d4fdcf6288176e8f02962bfd2d6cf632dca2f895a03f9e765993eba3226c87f1e709fcf2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
c7d93d91671c99c57f1f906908d84b45

SHA1
cb816152eaccfdec0be8005fdb98542f8e40cf03

SHA256
fe6b9702c597b70f68726b3bed01b3fe3df5e358b6830e471c3b31a2c527a85a

SHA512
02d4713785e5764c9c8146b95a61c44d9df6b4f94971ec9dc14118147f509a9826b87d7b84a9a83f7e1d726dc21c7a8f2ae5b3ee34b8192af3fd22814d0f25a8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
1KB

MD5
4232975fc426ccbb17acd4b0b69830fd

SHA1
9f2bbe6e1d67c72fd79886112ed351f615e27f29

SHA256
9af5d9f0b73868c2d066d379fcfec27b63de1040fde6268356d1feb10370bd17

SHA512
451695c8b0b0a4cf395d57d94c6fd712406be31a6fb5e38d82e73b5856295487dd2838b56d1cae750023af2257ed8a781859a89db7cc8002dabdde32fffb799b

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
6KB

MD5
73a3ec08a25a9c5bae488a9abcd8194a

SHA1
7202b9dad974083f6b8aa39b0c5cae8943a30c4e

SHA256
94069c9fc4a40cac146c9734592b338c4f24ea68efe995b466eedd06b4604f82

SHA512
8b27109519cd326600575a1d73e1583e1132724b4140f2fba97c1fda3330ae49aa78cfcd75034d66b07f6f05200c4c5e9a7e7c58fa53b59171026dfaa5ed5823

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
15KB

MD5
6543b569789399685728af805c18c941

SHA1
2d5eeb2057ec5736d1e856aad50c649cb291b082

SHA256
333f065295d916f0cc3c8f31d8c7a8c4c06f3f263c987c44f334b9862c238f71

SHA512
d014e967eb54127682984499b5dbeb119bbebbbe8fa63287c7079f8aff6fa02fce36dee26f652b2a2f7c89b56de5809d590abeffe1b64b694906b6d59f2c12a4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
158KB

MD5
62891211ea3e81ad2d4ac73e390c629b

SHA1
bac7df914fd81cd603503cadf677a382876b4d22

SHA256
cb5c9ee08b1f564193505cb22b1778a7523d559c43b1a126a2790d47aa028437

SHA512
1227b4bf1cd3aa9cbc7683de9183215ed51230e2438b84ce4338a55217f20eeba2d0b0de9ef0860d06e9475d945ab97e546c43186c13ac4e10a0328a2b1508b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\Explorer\iconcache_idx.db

Filesize
28KB

MD5
00c117f45e6ca507dbe61ceb72245821

SHA1
53344903e1a9d30caaeb700ac783601b03bb0ce0

SHA256
f48c2aebc188bb022d98eaeb0f6208c4a71074cf49773dfce3d3d0addc33c0d2

SHA512
9792f575d4f0ce60c1ffd46f7eb5436e85f1b2f1da519463a2a822c51e898332eec82e9aca5fd2a3b526b6563a14cf02341388c1a0af42da07de641bd15458ed

Download Submit
memory/4252-443-0x000001FEF63A0000-0x000001FEF63A1000-memory.dmp

Filesize
4KB

Download
memory/4252-449-0x000001FEF63A0000-0x000001FEF63A1000-memory.dmp

Filesize
4KB

Download
memory/4252-448-0x000001FEF63A0000-0x000001FEF63A1000-memory.dmp

Filesize
4KB

Download
memory/4252-450-0x000001FEF63A0000-0x000001FEF63A1000-memory.dmp

Filesize
4KB

Download
memory/4252-451-0x000001FEF63A0000-0x000001FEF63A1000-memory.dmp

Filesize
4KB

Download
memory/4252-452-0x000001FEF63A0000-0x000001FEF63A1000-memory.dmp

Filesize
4KB

Download
memory/4252-453-0x000001FEF63A0000-0x000001FEF63A1000-memory.dmp

Filesize
4KB

Download
memory/4252-454-0x000001FEF63A0000-0x000001FEF63A1000-memory.dmp

Filesize
4KB

Download
memory/4252-444-0x000001FEF63A0000-0x000001FEF63A1000-memory.dmp

Filesize
4KB

Download
memory/4252-442-0x000001FEF63A0000-0x000001FEF63A1000-memory.dmp

Filesize
4KB

Download