4079f68850be84bafb8731549a9c90d9fce1927e2b43fd4c1d2534d406c81a4a

Analysis

max time kernel
91s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
31/08/2023, 11:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4079f68850be84bafb8731549a9c90d9fce1927e2b43fd4c1d2534d406c81a4a.pdf
Size

107KB
MD5

c433ef0cbe6e0fb2d3ff46008c583e8d
SHA1

c170be0f7aaec318b9d58e255e4df01a995b74b5
SHA256

4079f68850be84bafb8731549a9c90d9fce1927e2b43fd4c1d2534d406c81a4a
SHA512

b096dd4fc9989650d1e8b32915f9adfe27a8ef64bb318da4a7ff765affad50ac741e149425cf82d467f25ee0310a9e7351d6b0cf43c84aca21b1ba7d5dec53a5
SSDEEP

1536:9yZDd6SH7RbBcq/hBOitOOdG538OZU+KaSxtLRU+9S/BqK365UBmOcT4t:4ZD3bBd/zLdy38AU+1SBU+wT3KUBmON

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3011986978-2180659500-3669311805-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
1980	msedge.exe
1980	msedge.exe
1608	msedge.exe
1608	msedge.exe
5072	identity_helper.exe
5072	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3396	AcroRd32.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe
1608	msedge.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe
3396	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3396 wrote to memory of 1272	3396	AcroRd32.exe	85
PID 3396 wrote to memory of 1272	3396	AcroRd32.exe	85
PID 3396 wrote to memory of 1272	3396	AcroRd32.exe	85
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 4776	1272	RdrCEF.exe	87
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88
PID 1272 wrote to memory of 1740	1272	RdrCEF.exe	88

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\4079f68850be84bafb8731549a9c90d9fce1927e2b43fd4c1d2534d406c81a4a.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3396
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=267D4406B894E78E35E22F30377DF8F2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4776
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=F8E33BB94365D386685E8D9670BE2C30 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=F8E33BB94365D386685E8D9670BE2C30 --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:1740
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=6FFF3B4F3ECCD871F19DFFD095B15814 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=6FFF3B4F3ECCD871F19DFFD095B15814 --renderer-client-id=4 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3320
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8D99BCA453F61251A26EE15E97DC0670 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4664
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F2014FBEC6CE838A6654543492DF7AC1 --mojo-platform-channel-handle=2452 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1660
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2F4282A2DDA6F223371BB12F1EADE0FA --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://add-to.password.land/XYVdKQ2JsZFRkMUV2UmtaNE16aFBhelZyTkVGbGVHcEtOMU53ZFU4emQySmhVSEpOVXpOUGRrbFZUaTkxWlU5QlpGazNNbXBUUzBkMFZuZEdUemRwY3pWcGJGbFpWUzlrVlc4MGFGVkhXR2xCYTBGR2JuUTJNWGRoVW00d1NTOWpZazAzUjNwb1RrNWFRa0oxTURJMFFpdExkVGxrY1dwUmF6SmlSQzlpU205V1lpdDJlR05KUVM5RFNpdGhRV2RMYWxsMWNteFBObE0xZG5KbldVc3phVU4zTTI1aFIzTTFaMkZKTHpaaVN6ZE9NV3RxUVVzM01pOVBialZqY1VvMkxTMUlTR1ZWTm5kSlIwVjRlSE0xWVdKWVUwbHplblIzUFQwPS0tOWVhYzE3NjdhZTIwMzIxOGFkMTdlMDBiMzM5MmQ1ZTUwZGNiZGI1Yg==?cid=189574402
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1608
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb39cf46f8,0x7ffb39cf4708,0x7ffb39cf4718
    3⤵
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2512 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
    3⤵
    PID:3564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3420 /prefetch:1
    3⤵
    PID:2644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:1784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3720 /prefetch:8
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:1444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
    3⤵
    PID:4208
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3548 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:3404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,2582629468963780466,10523423814784762068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:5316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
95bbb8d11f185774ffccd25f68fece74

SHA1
bc3abe4f0cd09a8229f078739bacea564bb984e5

SHA256
4e27380d87c3262d95ae7ecd871444119bac558eaa83f239a31902d2aaca1d90

SHA512
f9cca83c1ce16c8a11d964a0fe7bda341aff3cee7650b04e2a181ca827d3571c8efd48e201974e65c5866d1753a17a512e4647d5fb834f28736f9903efe083d5

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

Filesize
1KB

MD5
d1db389ff9f5f7ee5f767bff6712aeba

SHA1
3b973d8ef3029c22c0df97d127a36b70df4146cd

SHA256
7fe9388e9db763484fad221aa7ac8c4d5426f1f27ae8dc1c22c2fdf9f90922e3

SHA512
b38e9f7454084568b993767cbd8280bbb1f0032fe0064867298331bd2305f465441ba9483d4737527722b5706359130a1a3457a35b71890f223a89d6705bb61d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
2KB

MD5
2ee1ae3a443e109fcb094efad951df38

SHA1
4cb9ecd71410e83581d28012b301fadd33555f02

SHA256
f24bf40e688da4993fd3e1a46acb81ad29374144fffb7f40c044e9b298c5eb8b

SHA512
0b84bcb2c1bd4002790713dbb228aded45f03e244c3a935474203ada8a3cb9c0cd7c2184b9e3bbb8e77e8a1993ea3475c24dcc2da2141568784eeccdb0b8073a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
1KB

MD5
46eb558f7b995c8ee83ed524dd871196

SHA1
45393e73c85de532a895ce0e7df0015c80470f12

SHA256
6a5da20aabd35f9141b5e6b8ee3a5b7233c3fc4dd1975381e4b6d39387692f8e

SHA512
d44acdb6f993a2522d26da76964366b12916ad522ba4aa9ab3bf3bec72e153428606ea374f9e4d5f5359d7707ec71b47a75fe5fd7c19aacb014b2f7885209e3c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F53EB4E574DE32C870452087D92DBEBB_466E4C25A7B73E6FFAFF564B4E9BAAB1

Filesize
471B

MD5
82872bde674437f8dccf49e50e8c31d7

SHA1
553b68cd881e024e4c4c726ad49b1973dce53d1f

SHA256
80740b96e56c9b5b5e2552de959f32b8e23625025e045a4aac6966de6c98ab86

SHA512
2c7c5c2b95d527e168e7d00ee4f7e83aa56bdec0a20a37974f97cf586f2b2100bdbbb4a1a6b05c19145f1e218bccd03cae75e096688b2cb8c9cae8772e958cb1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_056B48C93C4964C2E64C0A8958238656

Filesize
434B

MD5
2261fb9221347c184042c6f8ab871637

SHA1
f8c13e381076c803bdce3ed2a942e4ac4e623dad

SHA256
8e8ff0babbf728eefc311847cc625455af19fd4c4d0c9f0247a0606712f400bc

SHA512
6c8247c7d9680cf49add82d9694dab29aeeb79c705574a779363f0a3b4b8b946024959c08eb3fc89c16792450c8fdfa11b59b42a90a1d40c32c35864b6463b7d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B66240B0F6C84BD4857ABA60CF5CE4A0_5043E0F5DF723415C9EECC201C838A62

Filesize
458B

MD5
691d824f997ca83c4ab513e9b6680a42

SHA1
780047c9af648b222232f5114c36d6eed0eeddca

SHA256
3f8a261616702c79b10d37cea4217ed9828f3fd1cbc6f8b3207ddde3ec6f9cc8

SHA512
5868c3af02a77d13cef2bd164296cc58fc56cc1d5e7a5f63f43df607b6657356debf338375f91820f2a9ab0724b2649c74b67de721f37c14b2e99cc6e59cd301

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894

Filesize
432B

MD5
fde6ea48e1bb09924623e83d21d662c5

SHA1
c7bb06b60eb42e64d4873f319a2ab15394f2a5f3

SHA256
8cf5ba725af882028e1e79d787244f0df07fbe1c508a401b4ebfe19412c56d0f

SHA512
4fc38a50d4a84c714a576af18ee5721c86bcdf5b6f26566b09d6767a71e420b5176e89962351e93238698cea8efd3dfa47ea730a70001865609d30537a9819cf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F53EB4E574DE32C870452087D92DBEBB_466E4C25A7B73E6FFAFF564B4E9BAAB1

Filesize
430B

MD5
f04c046bed37a1df0a39c014e123ba67

SHA1
ff3e0d18d068ab2ed4d333c5aeddd2dde1870dba

SHA256
99df87f7296930b66823c7506bedafe6f8247f0bd3fa5016dc688f6c252ba5d1

SHA512
b6b970b1557a7bd16f5afe411c09b1b1a44150d8cf73701191eec51f0443ad3eccecfeecd881efc095df5aefae75f88baeb5e6e8d7b751ebc36280152fd488fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
78986c63eb2f535db0d6d7c6fcbae86b

SHA1
e9986603c822389f68fb55a40206c203038ee01a

SHA256
6496b98dbf383502e6a3bf4ac8930bb309f06f4b5c0f008ec6a028935a94483c

SHA512
eb58d5822b82d5e972ff0f0e617ede8ad8c6516a6e38fed39a41042c17cbcc03edaa077b3bcd75c139387e6136995a702f5ab2255f96d7a0280f58c665a52e8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6522f6d1d6f279465ae413f0825c46e9

SHA1
0afe51c73a749dd9dedb07bf5fffd49aa67940a1

SHA256
e890828f4a5cb7d2af55510c31bb5302cd6ff1e255bfdb7ce50ed243ad1b199a

SHA512
0f0d438630a12bf1454c3d87ff25e79b4f3b238c7f29414611ff60a1f2c9e1046f9f3426678986dc896ed652cb38f0ce2eb4031274e8a5856561d6688beca40d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e24504fdb10aa61c2c24a15234d6d991

SHA1
1a80d8744a1f09a5b44cc5266b93bbe6934c5f9f

SHA256
dc4480fc3405491a5671983c2d5e5237cebede08739e52a282c49aff194b2541

SHA512
e137ef147c38b7e655389c697cc190429328475ed42bbe34216caf22620c67f0879813839bba9174cc3bece23f476fe00789c12774ed060f33884483ded4b251

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
94d5baa09939e598800af66a9f5226e0

SHA1
a4fd084d4abb6284edca9d37e78ce6b6fe9505e3

SHA256
71185597a9ced043a7297ddf7d761e0dcfee048975106c1b287a555196c3d3a5

SHA512
d9d29b115a95798a357bb4e08aed17b34af305dcf77335b50e55f62b590fe0c34729e095369671a2269687967d44ba05b352b4ba1ae8cbed47852609fb5e89cd

Download Submit