hxxps://www[.]yashenviro[.]com/rh/rb[.]txt

Analysis

max time kernel
108s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2023, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.yashenviro.com/rh/rb.txt

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 2 IoCs

flow	pid	Process
61	4236	powershell.exe
63	4236	powershell.exe

Downloads MZ/PE file

Executes dropped EXE 1 IoCs

pid	Process
2240	fx2z.bat

Loads dropped DLL 1 IoCs

pid	Process
2240	fx2z.bat

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\Elevatorstolens\Baroclinicity.Pol	fx2z.bat

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 40 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3133481093"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000075756043ecab13439991a31807e963060000000002000000000010660000000100002000000024d24405498649845406a9c77a09d6b326156f03e66a4a15204a464a56e020e3000000000e80000000020000200000005382de9925f1cedff36e56e8f398db3b36b476461074660849227ffee8b88859200000000f5fdda3eb0b32bad209182bc7679dfcaf97da1642cf02459d49a4dfdc25bf75400000003d9541e82ca44c130ab2aa6f3f644d35549fd56969cdb2f1bcf5d79b4ce973c20877c6218bb2485e8563636c3b68033a4639e8a3bfe41886540d64bc0e6d5eb3	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = e0cfdfbcd49ed901	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "393521393"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31039188"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31039188"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000075756043ecab13439991a31807e9630600000000020000000000106600000001000020000000f1be2739db483a9fe473f230d3141609b78b2ef0139668d0b78244dbe9288845000000000e8000000002000020000000aa44c90e5a9ba59c3fb84ddc1d825e064a0e3d23b3bf6445e28ae75773379c7320000000b9658ae4dea319f689a97ce6610225fe91790757c1a26865f1d5068fe8913477400000002f8ad9f2acfe00b8a4a24ce387113ccf4a70a997a131ff6fbf3276d19a136a886050aa9d48e29af38d5c16db38affe964f7326f2cb3c34ca1590d1335a9a6809	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3152225556"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3133481093"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31039188"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{E5E225F8-0AC7-11EE-8FFF-DAE3AE61CC88} = "0"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 10bdccbcd49ed901	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Software\Microsoft\Internet Explorer\DomainSuggestion	iexplore.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
4236	powershell.exe
4236	powershell.exe
4236	powershell.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4236	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
4464	iexplore.exe
972	AcroRd32.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
4464	iexplore.exe
4464	iexplore.exe
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
1344	IEXPLORE.EXE
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe
972	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1344	4464	iexplore.exe	83
PID 4464 wrote to memory of 1344	4464	iexplore.exe	83
PID 4464 wrote to memory of 1344	4464	iexplore.exe	83
PID 4236 wrote to memory of 2240	4236	powershell.exe	99
PID 4236 wrote to memory of 2240	4236	powershell.exe	99
PID 4236 wrote to memory of 2240	4236	powershell.exe	99
PID 4236 wrote to memory of 972	4236	powershell.exe	100
PID 4236 wrote to memory of 972	4236	powershell.exe	100
PID 4236 wrote to memory of 972	4236	powershell.exe	100
PID 972 wrote to memory of 3304	972	AcroRd32.exe	101
PID 972 wrote to memory of 3304	972	AcroRd32.exe	101
PID 972 wrote to memory of 3304	972	AcroRd32.exe	101
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 4712	3304	RdrCEF.exe	102
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103
PID 3304 wrote to memory of 3408	3304	RdrCEF.exe	103

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" https://www.yashenviro.com/rh/rb.txt
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4464 CREDAT:17410 /prefetch:2
  2⤵
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:1344

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
1⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Users\Public\fx2z.bat
  "C:\Users\Public\fx2z.bat"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:2240
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\List of required items and services.pdf"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:972
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3304
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F874D50216BB132EAF05A54D669E17A1 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4712
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=125C601C622FA13E0DDF133A0F976C54 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=125C601C622FA13E0DDF133A0F976C54 --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:3408
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=91CC02145C4FD2C5B8428F546D82D814 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=91CC02145C4FD2C5B8428F546D82D814 --renderer-client-id=4 --mojo-platform-channel-handle=2140 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:560
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E46BA1EB08532B966C2813691ABD7F0D --mojo-platform-channel-handle=2572 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4992
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D79338FF27C7B4CD4B7615C3D9A2F154 --mojo-platform-channel-handle=1944 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4304
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=56467C165DCC0AE1129D252AF81CD2CD --mojo-platform-channel-handle=1744 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
3b535652c7260aed7cd0562d27f801a9

SHA1
c9558f52dd3e2e6dfc13e4937ad125e6cb369d4e

SHA256
7ec5e57c1f78e578c18b1115d80cb031558b7af6a6eb758f95ab134e78c92f22

SHA512
a3db38bec68147d9ef76b840ed8d9d9e43ca35a6d152a01cea2b26c9a9047f35a0cd67950c8d1f21cd1e1adbe031a1285456fb07e0793f90a955d4ada18c4d8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
471B

MD5
6ed1b9e0ada67cd4e13ffe2ebff3202d

SHA1
26e57e0292d9b0fdf705748d723c197e50225bb5

SHA256
e4256833d3e11cd58e3725ea44482597742a652041a44b3339d371739a6e5735

SHA512
749783679cbd1f6f06ea031c22cc262152d57da36acf3778ac54717f5d9400aa0ad388b9898f5b0ff9bdf666f7f4c4ec590f770d48d1bf4301d05ad944746a33

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776

Filesize
404B

MD5
9d690acf44eb087f778caa11e49904a9

SHA1
20ed2b769159564966e436fb759f292a037c6bb3

SHA256
9afa4c013dd62180e2dd9a33aaba94bb1c2b900164ff047219e9a0374c077ede

SHA512
80786d7b93aea7db1fb6d9dc81ce0759b4dc26e63822a857ebb74b4688158eeb373fe1f39d55ac0f87e51b1f825bb2f39300c351a5c60eab180698711a1d0a21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\EY3KXMB3\suggestions[1].en-US

Filesize
17KB

MD5
5a34cb996293fde2cb7a4ac89587393a

SHA1
3c96c993500690d1a77873cd62bc639b3a10653f

SHA256
c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad

SHA512
e1b7d0107733f81937415104e70f68b1be6fd0ca65dccf4ff72637943d44278d3a77f704aedff59d2dbc0d56a609b2590c8ec0dd6bc48ab30f1dad0c07a0a3ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vcnrkv1x.fu0.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\nssE5CE.tmp\System.dll

Filesize
12KB

MD5
d968cb2b98b83c03a9f02dd9b8df97dc

SHA1
d784c9b7a92dce58a5038beb62a48ff509e166a0

SHA256
a4ec98011ef99e595912718c1a1bf1aa67bfc2192575729d42f559d01f67b95c

SHA512
2ee41dc68f329a1519a8073ece7d746c9f3bf45d8ef3b915deb376af37e26074134af5f83c8af0fe0ab227f0d1acca9f37e5ca7ae37c46c3bcc0331fe5e2b97e

Download Submit
C:\Users\Admin\List of required items and services.pdf

Filesize
637KB

MD5
9b05142184f080ae36983d0a25597143

SHA1
6421cd63995163132e89709ff70d695825a3cbdc

SHA256
f16b7347bcaada09e4a85e92a704ccc67f413ddba62bbdf4bbe14a7b687ac455

SHA512
ebdb6d9682a0dac526214d9e5173e0cf627d1e538f2a728768e913fd2ce94b926da6a248dfb5ae6d1dfaf0ce33807d3007d05785be200687c55b926dce6908dc

Download Submit
C:\Users\Public\fx2z.bat

Filesize
418KB

MD5
1969e2b1778cda1ace839882dfc4d157

SHA1
cdecdd75dd1b33b9fdc77b590aba350ae147ff21

SHA256
37b7842359c2316bdf099b624fff8662590d5ef5783b917f86af6526f17bd936

SHA512
9a4124ab4ba9ec71256aaed858c0d3aab10fe276f8d885413c1e7d1520fd29cc5d530a4b1e0f88e1250d1227c05f9b55f1021ead02b36d22cec92b855c6ede8f

Download Submit
C:\Users\Public\fx2z.bat

Filesize
418KB

MD5
1969e2b1778cda1ace839882dfc4d157

SHA1
cdecdd75dd1b33b9fdc77b590aba350ae147ff21

SHA256
37b7842359c2316bdf099b624fff8662590d5ef5783b917f86af6526f17bd936

SHA512
9a4124ab4ba9ec71256aaed858c0d3aab10fe276f8d885413c1e7d1520fd29cc5d530a4b1e0f88e1250d1227c05f9b55f1021ead02b36d22cec92b855c6ede8f

Download Submit
memory/972-340-0x0000000003CA0000-0x0000000003F4B000-memory.dmp

Filesize
2.7MB

Download
memory/4236-167-0x000002017A820000-0x000002017A864000-memory.dmp

Filesize
272KB

Download
memory/4236-171-0x000002017A8F0000-0x000002017A966000-memory.dmp

Filesize
472KB

Download
memory/4236-170-0x000002017A380000-0x000002017A390000-memory.dmp

Filesize
64KB

Download
memory/4236-169-0x000002017A380000-0x000002017A390000-memory.dmp

Filesize
64KB

Download
memory/4236-168-0x000002017A380000-0x000002017A390000-memory.dmp

Filesize
64KB

Download
memory/4236-162-0x000002017A330000-0x000002017A352000-memory.dmp

Filesize
136KB

Download