Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
158s -
max time network
168s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
05/03/2024, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe
Resource
win10v2004-20240226-en
General
-
Target
76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe
-
Size
2.5MB
-
MD5
acf8cee2cf1b99505237c4324ff36a85
-
SHA1
cfef453c783d64fd31aa5a3b9cdab2e5ae18c16e
-
SHA256
76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96
-
SHA512
9500235e3ebe520869888f208e9f45fd083b243b225c6d89d5f040295d2144c7144cff57098fdd7a0233cb643013f683a1ef738f3b88c6257d96b5f9219b3496
-
SSDEEP
24576:Rfg6hsz+NPVHq18u1gdQvHspJrsIVba/mwY1RYKMA0Vc8WME4BhYzFzd/za5ZueU:Lh++NPtqzsg5Zul
Malware Config
Extracted
cobaltstrike
100000000
http://172.30.91.182:8888/jquery-3.3.1.min.js
-
access_type
512
-
host
172.30.91.182,/jquery-3.3.1.min.js
-
http_header1
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADQAAAAIAAAAJX19jZmR1aWQ9AAAABgAAAAZDb29raWUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_header2
AAAACgAAAEdBY2NlcHQ6IHRleHQvaHRtbCxhcHBsaWNhdGlvbi94aHRtbCt4bWwsYXBwbGljYXRpb24veG1sO3E9MC45LCovKjtxPTAuOAAAAAoAAAAgUmVmZXJlcjogaHR0cDovL2NvZGUuanF1ZXJ5LmNvbS8AAAAKAAAAHkFjY2VwdC1FbmNvZGluZzogZ3ppcCwgZGVmbGF0ZQAAAAcAAAAAAAAADwAAAA0AAAAFAAAACF9fY2ZkdWlkAAAABwAAAAEAAAAPAAAADQAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
-
http_method1
GET
-
http_method2
POST
-
jitter
9472
-
polling_time
45000
-
port_number
8888
-
sc_process32
%windir%\syswow64\dllhost.exe
-
sc_process64
%windir%\sysnative\dllhost.exe
-
state_machine
MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC1yVurDGQdVK28qgvmFUYIRxtu2+x80FPRued9AntWyvUWiIW0TYMmk5UWYVorhNTy4dvTzAxy8VXNsJVNe5J/Q4YKKPMFdMfFltsNOr0wbGGFwIfkHZF3v71LbPpn8OJLCmqmSTenQ579zUjJoJ1vuWeUyPxBWH0RXd6sLD8ZbQIDAQABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
unknown1
4.234810624e+09
-
unknown2
AAAABAAAAAEAAAXyAAAAAgAAAFQAAAACAAAPWwAAAA0AAAAPAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==
-
uri
/jquery-3.3.2.min.js
-
user_agent
Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko
-
watermark
100000000
Signatures
-
Cobaltstrike
Detected malicious payload which is part of Cobaltstrike.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2340 yjdy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AcroRd32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AcroRd32.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION AcroRd32.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000_Classes\Local Settings cmd.exe -
Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2256 AcroRd32.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe 2256 AcroRd32.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1576 wrote to memory of 1748 1576 76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe 94 PID 1576 wrote to memory of 1748 1576 76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe 94 PID 1576 wrote to memory of 3556 1576 76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe 96 PID 1576 wrote to memory of 3556 1576 76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe 96 PID 1576 wrote to memory of 1016 1576 76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe 98 PID 1576 wrote to memory of 1016 1576 76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe 98 PID 1576 wrote to memory of 2888 1576 76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe 99 PID 1576 wrote to memory of 2888 1576 76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe 99 PID 1016 wrote to memory of 2340 1016 forfiles.exe 104 PID 1016 wrote to memory of 2340 1016 forfiles.exe 104 PID 1748 wrote to memory of 2256 1748 cmd.exe 103 PID 1748 wrote to memory of 2256 1748 cmd.exe 103 PID 1748 wrote to memory of 2256 1748 cmd.exe 103 PID 2256 wrote to memory of 1124 2256 AcroRd32.exe 121 PID 2256 wrote to memory of 1124 2256 AcroRd32.exe 121 PID 2256 wrote to memory of 1124 2256 AcroRd32.exe 121 PID 2256 wrote to memory of 4972 2256 AcroRd32.exe 122 PID 2256 wrote to memory of 4972 2256 AcroRd32.exe 122 PID 2256 wrote to memory of 4972 2256 AcroRd32.exe 122 PID 2256 wrote to memory of 3028 2256 AcroRd32.exe 123 PID 2256 wrote to memory of 3028 2256 AcroRd32.exe 123 PID 2256 wrote to memory of 3028 2256 AcroRd32.exe 123 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2212 3028 RdrCEF.exe 126 PID 3028 wrote to memory of 2556 3028 RdrCEF.exe 127
Processes
-
C:\Users\Admin\AppData\Local\Temp\76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe"C:\Users\Admin\AppData\Local\Temp\76f12c85d802ea5496ccd2f7e0f2e99d3cf752bd06ed7243cab13007ad805e96.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\system32\cmd.execmd.exe /c start zxkf.pdf2⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\zxkf.pdf"3⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140434⤵PID:1124
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140434⤵PID:4972
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140434⤵
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=76E1B1C82650DD482C2FFDCBD5ED670E --mojo-platform-channel-handle=1772 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:2212
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=5A07AB6900342D60EB1B257E4695E1D1 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=5A07AB6900342D60EB1B257E4695E1D1 --renderer-client-id=2 --mojo-platform-channel-handle=1948 --allow-no-sandbox-job /prefetch:15⤵PID:2556
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2E1E832CF0467BBE261DDFBACA9CB384 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:1796
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D9CDA612037BB5C80C2FE443F1D654EF --mojo-platform-channel-handle=1884 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:4464
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1EF8D8B3D9201346564E6DFC26C8DA7C --mojo-platform-channel-handle=2364 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:25⤵PID:3248
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=CF1BB7BCD92DC4DE229C5C820061FE89 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=CF1BB7BCD92DC4DE229C5C820061FE89 --renderer-client-id=7 --mojo-platform-channel-handle=1872 --allow-no-sandbox-job /prefetch:15⤵PID:2244
-
-
-
C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=165140434⤵PID:5076
-
-
-
-
C:\Windows\system32\expand.exeexpand C:\Users\Public\Music\yjdy.spl C:\Users\Public\Music\yjdy.exe2⤵PID:3556
-
-
C:\Windows\system32\forfiles.exeforfiles /p c:\windows\system32 /m notepad.exe /c C:\Users\Public\Music\yjdy.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Public\Music\yjdy.exe"C:\Users\Public\Music\yjdy.exe"3⤵
- Executes dropped EXE
PID:2340
-
-
-
C:\Windows\system32\cmd.execmd.exe /c del zxkf.exe2⤵PID:2888
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3608 --field-trial-handle=2284,i,9807419199535700662,2319175108930815708,262144 --variations-seed-version /prefetch:81⤵PID:3440
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2196
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5e32b980e61e42e8ca944ced14fad326b
SHA1497553bf398500612efd83d4d60793d5192e2367
SHA256da988cecffce03ec9de6c88ccb47ba68e8e416c44409e16e267df1cdbfcbb374
SHA51289408f32f46aa25f9a0752bfe19df39d9099db5a2a69076874cfe49128e5e3aff6d962fcff7f292f0e7041fca4a372a14f8cef92967189c50f2c563d210612df
-
Filesize
36KB
MD5b30d3becc8731792523d599d949e63f5
SHA119350257e42d7aee17fb3bf139a9d3adb330fad4
SHA256b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
SHA512523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
-
Filesize
56KB
MD5752a1f26b18748311b691c7d8fc20633
SHA1c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA256111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
SHA512a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
-
Filesize
72KB
MD56a6f0aa82182f1e284c502f8e8208d26
SHA1dc1fb3d743e5029b2d2b022dcafb90e655392fda
SHA256d95ac6ea9cb31c4b35856811e799db467fadbbeb812dc2b53ac40cf88ccf1b39
SHA512a7c51626f820ba56d3288c151b11e4bfce6811b827b600bff2a0e822a9206de5e61d9466dac168a95e7a66fe1a96678a4333a3b4c22923b4dc4103be749b05ed
-
Filesize
281KB
MD5109af0cf3a10caa18240a4cd90e58f0c
SHA1bad1be75f2f061b6866ac38db37f58ad484a32a9
SHA2565e2d9ae426b43eb1490670fda329ac88a6e1c6eff254df7609440d301050e374
SHA51244cac88f4359521740d22a30f1dc6d3dbf62dc2027c820fa4ef97d71c7704b106c1e657836d3c97442151d6e0287a89d8c3a02801d3f7eea93a37d040e4f3d10