Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
01/01/2024, 15:26
Static task
static1
Behavioral task
behavioral1
Sample
3d3551639b232de882d1396c1780e520.exe
Resource
win7-20231215-en
General
-
Target
3d3551639b232de882d1396c1780e520.exe
-
Size
1.5MB
-
MD5
3d3551639b232de882d1396c1780e520
-
SHA1
335c6cc43c820943dc62db9d2245bef54a15d78e
-
SHA256
e789a6e6e52c30deacb7d20805ec300038c4c9f2f92d73a27a1d9c9dd7802289
-
SHA512
9330a61bb236c75e7cfe0fb8ab7093250428fa22b257e9396b6f62acd4dbba84e8a523d2ff28f47d3af9a82df778e8a14e6682a6abfa6aff536fa0a483a9bece
-
SSDEEP
24576:TphwrIhv1qQjtY2jBe4NNl51X32mmYJL1g6gTcTK0gJnSpillA:TpHx1zd7/xpg6vTLgVmillA
Malware Config
Signatures
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3d3551639b232de882d1396c1780e520.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 3d3551639b232de882d1396c1780e520.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz 3d3551639b232de882d1396c1780e520.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1232405761-1209240240-3206092754-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION 3d3551639b232de882d1396c1780e520.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4744 3d3551639b232de882d1396c1780e520.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe 4744 3d3551639b232de882d1396c1780e520.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4744 wrote to memory of 3424 4744 3d3551639b232de882d1396c1780e520.exe 95 PID 4744 wrote to memory of 3424 4744 3d3551639b232de882d1396c1780e520.exe 95 PID 4744 wrote to memory of 3424 4744 3d3551639b232de882d1396c1780e520.exe 95 PID 3424 wrote to memory of 5076 3424 cmd.exe 93 PID 3424 wrote to memory of 5076 3424 cmd.exe 93 PID 3424 wrote to memory of 5076 3424 cmd.exe 93 PID 5076 wrote to memory of 2208 5076 net.exe 94 PID 5076 wrote to memory of 2208 5076 net.exe 94 PID 5076 wrote to memory of 2208 5076 net.exe 94 PID 4744 wrote to memory of 4100 4744 3d3551639b232de882d1396c1780e520.exe 98 PID 4744 wrote to memory of 4100 4744 3d3551639b232de882d1396c1780e520.exe 98 PID 4744 wrote to memory of 4100 4744 3d3551639b232de882d1396c1780e520.exe 98 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3148 4100 RdrCEF.exe 100 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99 PID 4100 wrote to memory of 3240 4100 RdrCEF.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d3551639b232de882d1396c1780e520.exe"C:\Users\Admin\AppData\Local\Temp\3d3551639b232de882d1396c1780e520.exe"1⤵
- Checks whether UAC is enabled
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\SysWOW64\cmd.execmd.exe /c net stop Spooler2⤵
- Suspicious use of WriteProcessMemory
PID:3424
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140432⤵
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3463654D8EB299A288C56D5E1460F86D --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3463654D8EB299A288C56D5E1460F86D --renderer-client-id=2 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:13⤵PID:3240
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=FADB084F75AC12F09BAFDD4D25728739 --mojo-platform-channel-handle=1736 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:3148
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7EE0447C83AE5550AECAE5079B831AAD --mojo-platform-channel-handle=2292 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:1036
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C7013970630A12715AA74516319F7A04 --mojo-platform-channel-handle=2400 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:2276
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=94C2C5A1CA87A571C537D71915033683 --mojo-platform-channel-handle=1728 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:23⤵PID:5104
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A3497CDD6CCEBB9899E2D1857B2986C0 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A3497CDD6CCEBB9899E2D1857B2986C0 --renderer-client-id=7 --mojo-platform-channel-handle=1888 --allow-no-sandbox-job /prefetch:13⤵PID:752
-
-
-
C:\Windows\SysWOW64\net.exenet stop Spooler1⤵
- Suspicious use of WriteProcessMemory
PID:5076 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop Spooler2⤵PID:2208
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe" -Embedding1⤵PID:1324
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4940
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD5c26ed30e7d5ab440480838636efc41db
SHA1c66e0d00b56abebfb60d2fcc5cf85ad31a0d6591
SHA2566a3c5c4a8e57f77ecc22078fbf603ecc31fb82d429bd87b7b4b9261447092aef
SHA51296cdb78bca3e01d4513c31661987e5646e6a8ff24708918aa0d66dfa3ca5d98af4862c9f38c4f41f933c345d2d3adfb1d34d1430b33f45f916f41a9872a030df