a5896108e5554ba87999f3a7b73d74aebc62de7c3fa6d157aa6aba5e1d695256

Analysis

max time kernel
143s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
12/03/2024, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
A. STUCKI COMPANY, Chase Bank Authorization Letter.pdf
Size 88KB
Sample240312-tsfdssfd97
SHA256 8ab7575e7baaffe69f63197e45e044885aed3029ab51274c682ae549f6341cbc
MD5 006996b13f151432a29b435b8866462b
SHA1 68592e33c603c7e8e4696fd2c52d03893f689f8a
SHA512 671bccccfa0ce9f0c0a6f40c7b1da190300fee74457b967cfc8226bb7bad4a495a822582bd39333b1f2207afcda490d386ccd3dbddf12690f20aecc5763e7312
SSDEEP 1536:tm7FRnUgGH4iOm5dp//bPJXjzIPAQW2xtfYRLIcFgfAV2PjLualyunhSVku4EC5d:qe4iOQ1/bhXIAQVxF8LlFgfr3uTkuBCn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings\MuiCache	AdobeCollabSync.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2840	AdobeCollabSync.exe
904	AdobeCollabSync.exe
2712	AcroRd32.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2840	AdobeCollabSync.exe
904	AdobeCollabSync.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe
2712	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 1960	2712	AcroRd32.exe	82
PID 2712 wrote to memory of 1960	2712	AcroRd32.exe	82
PID 2712 wrote to memory of 1960	2712	AcroRd32.exe	82
PID 1960 wrote to memory of 2240	1960	AdobeCollabSync.exe	83
PID 1960 wrote to memory of 2240	1960	AdobeCollabSync.exe	83
PID 1960 wrote to memory of 2240	1960	AdobeCollabSync.exe	83
PID 2712 wrote to memory of 2840	2712	AcroRd32.exe	84
PID 2712 wrote to memory of 2840	2712	AcroRd32.exe	84
PID 2712 wrote to memory of 2840	2712	AcroRd32.exe	84
PID 2840 wrote to memory of 5116	2840	AdobeCollabSync.exe	85
PID 2840 wrote to memory of 5116	2840	AdobeCollabSync.exe	85
PID 2840 wrote to memory of 5116	2840	AdobeCollabSync.exe	85
PID 2712 wrote to memory of 904	2712	AcroRd32.exe	86
PID 2712 wrote to memory of 904	2712	AcroRd32.exe	86
PID 2712 wrote to memory of 904	2712	AcroRd32.exe	86
PID 904 wrote to memory of 3308	904	AdobeCollabSync.exe	87
PID 904 wrote to memory of 3308	904	AdobeCollabSync.exe	87
PID 904 wrote to memory of 3308	904	AdobeCollabSync.exe	87
PID 2240 wrote to memory of 1932	2240	AdobeCollabSync.exe	88
PID 2240 wrote to memory of 1932	2240	AdobeCollabSync.exe	88
PID 2240 wrote to memory of 1932	2240	AdobeCollabSync.exe	88
PID 2712 wrote to memory of 2284	2712	AcroRd32.exe	96
PID 2712 wrote to memory of 2284	2712	AcroRd32.exe	96
PID 2712 wrote to memory of 2284	2712	AcroRd32.exe	96
PID 2712 wrote to memory of 2892	2712	AcroRd32.exe	97
PID 2712 wrote to memory of 2892	2712	AcroRd32.exe	97
PID 2712 wrote to memory of 2892	2712	AcroRd32.exe	97
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98
PID 2284 wrote to memory of 1980	2284	RdrCEF.exe	98

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\A. STUCKI COMPANY, Chase Bank Authorization Letter.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1960
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=1960
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:2240
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\FullTrustNotifier.exe" GetChannelUri
      4⤵
      PID:1932
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=2840
    3⤵
    PID:5116
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c
  2⤵
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:904
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe" -c --type=collab-renderer --proc=904
    3⤵
    PID:3308
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5A60877397959B32F862F42418C16041 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:1980
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=E954CA50F0123F00FB795719B60CF4BA --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=E954CA50F0123F00FB795719B60CF4BA --renderer-client-id=2 --mojo-platform-channel-handle=1784 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3196
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=09626BEA1E5FADDE334E9BCAA7FE4305 --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2976
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C4AD9A13845079621E7F04A40202CE6E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C4AD9A13845079621E7F04A40202CE6E --renderer-client-id=5 --mojo-platform-channel-handle=1744 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:2188
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B9FFBBFC71460082A7C132952750989C --mojo-platform-channel-handle=2484 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:5056
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=338D3DDE3D9F5AB8AA2129432A1B02B2 --mojo-platform-channel-handle=2720 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:2112
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 36KB
SHA256 b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3
MD5 b30d3becc8731792523d599d949e63f5
SHA1 19350257e42d7aee17fb3bf139a9d3adb330fad4
SHA512 523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e
SSDEEP 24:TLiXlzkrFsgIFsxX3pALXmnHpkDGjmcxBSkomXk+2m9RFTsyg+wmf9Mzm+Zs3tGl:TqlmFTIF3XmHjBoGGR+jMz+LhT
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 56KB
SHA256 111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131
MD5 752a1f26b18748311b691c7d8fc20633
SHA1 c1f8e83eebc1cc1e9b88c773338eb09ff82ab862
SHA512 a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5
SSDEEP 192:wedRBvVrThe4p4/KhTB4p4CitZtkZsLRGVDbw6H3ph+v3YQa9:weZdThkKhBvkZsLRGlzh+vS9
MD5 SHA1 SHA512 SSDEEP

Submit Download

ReaderMessages

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Size 64KB
SHA256 3733554d664e3449ecbbfc74af652e741ab8035fa2426ebfa05e2e1778f547bc
MD5 d8266331619877e61017257731c6ec5a
SHA1 1b661190d9debd3cb556d54eb6c3005bdc22fa0b
SHA512 52ec858bf86ff8ccfa4546238ed07125dfcf9ba20c879eac926c5919016123d7fbc031980ec1b53e7675c4d83831296baf672178a883940283b79835ae539cbf
SSDEEP 384:yepdThatELJ8SWvDTGJCesZsLglKhubvGZsLRZh+vS4:Q+elZsLQCZsL3hUS4
MD5 SHA1 SHA512 SSDEEP

Submit Download

eac4cf9da8b4acca06ece00ca75105a1.db-wal

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\Adobe\CoreSync\EntitySync\eac4cf9da8b4acca06ece00ca75105a1.db-wal
Size 32B
SHA256 22fdb100e44ee5509507ecc94e101e34af3765226bf70ed84a9bd7d0b8456625
MD5 b0d48dec6858a7672e86b3da0b8f89d7
SHA1 4f30d627e85c1a6d4bb606bc78f7f755d780b58e
SHA512 a421be0932789a76dfff72c7e87a26791e92fb4b8c4d5fb474e8b967694d922b9d2b13c96aa1b3b68014312b064944cd77c0e04d95925797c2d6675d88914b4d
MD5 SHA1 SHA512

Submit Download

EntitySync-2024-03-12.log

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\CreativeCloud\CoreSync\EntitySync-2024-03-12.log
Size 2KB
SHA256 e930a2f7154384869bfdffff153567ab9146d5d1b75cacf6208b43de7be4dccb
MD5 a6072591a3e947dbff8e27330c7fc64c
SHA1 fbd723e6c1224a74298ca83c800491f9496a4535
SHA512 7e386d4e8101972cb675a368dfc6be3dc3627289921d976e7bef639abcef69d3db9fe60c27acfa8d92c9db39f6838f94528ef5cfa7e55b0cb1c67ce865f87538
MD5 SHA1 SHA512

Submit Download

EntitySync-2024-03-12.log

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Eureka\AcroCoreSync\CreativeCloud\CoreSync\EntitySync-2024-03-12.log
Size 296B
SHA256 78abcdab9498531b35ebf955d8e1a5790072706ecdb2d21d19c95f4d45a66109
MD5 71ad3c8d73f0d06bb020721800253d4a
SHA1 d3f7f37380d0163bd1f948702c6e6c4941d25680
SHA512 338614fea5e56317a03f8a51b66847c6a0ed318eef5eb4f8fbd32a17cf718d5d3f2d70b4caa1728db60be1b0cc8de8a9fc73944a1e59d828ab504259cef3bbcb
MD5 SHA1 SHA512

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 87aa4c64348b534771f03919b5bdca09596e89f6e0cca0a992bb3d290ec4155a
MD5 aebe0d2eb7a2077a55e57a955e62406a
SHA1 3f811b8148f12220f4b45699135e6d21c9847d8a
SHA512 efa1b082925a4e478fcea74764bbacb91d43da8c01c4b360a34e6f7402af23f91c93b5e91c6266120e144b5300e8dae73a62a7b6d7c4328410128f6a72a7baed
SSDEEP 192:t+oGsTzoU27NTaUxmYeMb1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:tklNveMbUNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 85023a770585cb54545268271d291cf635a2e03878285922784b3fbf19474fd2
MD5 efd8676a6a807b03f8a3a54fc13ef91e
SHA1 6c39f7f42df38f4fd0986df5c28e4f732cb7d4fe
SHA512 f9aab481a4d3a66c668ca20c894e3d5c0d11c7f3de81db8eeccf0dfd1d1e44d802d1374bdbe7d6e22ee35c64b7ca41dccd3624dfacbf61a62aa361163de8bfa3
SSDEEP 192:K+oGsTzoU27NTaUxmmX441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklNxX44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 58adae562c37eb8af8492b4fcec405b504026d477f192c82c5a1dbaebf892b77
MD5 baeb29ed424e24908e28fec8ad651246
SHA1 6c475cea9444fe3614c558a62692c76362c75681
SHA512 49dbd33e2fba6a144a22cdd5d7f24a8ccebecd881805f60f60cd71d4564a31e6256dfc903ea53cbf61a0ab5edd2a8fc8217acd3944a944aaab4bbee0cef5350d
SSDEEP 192:a+oGsTzoU27NTaUxmGiQaG441AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:aklNPXaG44UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Synchronizer

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\metadata\Synchronizer
Size 92KB
SHA256 a027cf12f2055635a3020f08e0448b2f0314791260ccd25570426088c5b0e307
MD5 245950c48f668cf2fcb3c64778e64089
SHA1 3a5a14c820f58e35a3fc6f5de29669f0840587d8
SHA512 4fc8448536663b551cc716d78715f06d4ed217fbdf755924f0b30aebbb6212798a61c6638f919d5c14bdb6998d6a12f0ca37281f3c7f484c1821fbfc98d4a24d
SSDEEP 192:K+oGsTzoU27NTaUxma1AxNoGsTzoU27NTaUxoALZWLGjZ5Pj5vHAxNoGsT:KklN7UNlNaN
MD5 SHA1 SHA512 SSDEEP

Submit Download

resource-18

Path C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\Reader\Synchronizer\resources\resource-18
Size 3.6MB
SHA256 152951ea34b49de148c3d4f11fa81875193576c8aa4a49abc5fa756cd3e12f42
MD5 a8c8361b7f2302396e258a3409e8371c
SHA1 cd84724e89830994e8b958a0c0a9db2b5fd3db08
SHA512 29d08b72d345cc95e0ce998bde0967f63cb72bf3a8316ff49f009aadeab3872f99f0a3bb5230f5f3f2655cf6e1dc04ffcc716dcc7f6050814339b25a0824e60b
SSDEEP 49152:ELWuHSQeNu5GB3mAs8f7b9ugh1F9fj6dixJns6E5p0QfE7+xbKZh4Djdi6W7wjV:hOsmAzXkgHF3J9E5y9+2h43dAwJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 471B
SHA256 be4be9b9934fd13e8dab8010a103603ff6554cc0150c022abc90f941636c1eae
MD5 17e5b20cb72453469315dd7ffe8ce5b3
SHA1 bc8dc064dd1a2ecd26c960adab926dfe3eaae520
SHA512 d4d06188e8c5e240c151d57e0c5bcfd0bb992fb30e9fb873a31e99aee319e8ea6803800e0dfa8ead381f5436b26e6d2d44184f26eb70a0ebb771e0f91ba00233
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04
Size 400B
SHA256 40f8ad7a666ff2aea798e62df05639492fdb40294b4ac1afc5dddb1fb0147c5d
MD5 3a28f42296fcc9220b3dc5230cb66f24
SHA1 47f52253ed6387f740f491dcc2d3e95a840b817d
SHA512 8809af4b303a45812bc45dd456d815c9eae64434556a8a24af076c859239786a12d644b7888a6e029e72218a22e0256530cf1521a2ef45cc52e988736a76002f
MD5 SHA1 SHA512

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 7cdb5b3c74b28cdf0081e256b4bb25cb0c4d076fed0bfc9d7e5b2d7da599aecb
MD5 96e33054dbac9a849acc40e3bbb91e85
SHA1 f3701dfd299b5f973a5bf2d7057698d9bf676003
SHA512 9ba5462cd68a91c7ae4b98083a261b86855c0f31d168761652a2d7d9ce8a35ed4381b59440b0e4e2957382311d0878828330910727d8472c0c33fdcd3c53f308
SSDEEP 24:TLyx/XYKQvGJF7ursblAmJx2JyLJaJIPehsJBOJN6JNCJYEJ7JIPnzJ/EJC:Tel2GL7msblAmWSYOP+sHOyqfNOPzSY
MD5 SHA1 SHA512 SSDEEP

Submit Download

SharedDataEvents

Path C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents
Size 12KB
SHA256 aed52235cf036ed1cc0d8508043c1c0728b205c635d51e2a8ecd297d36b66156
MD5 2d261b286530604b0111293049a715d9
SHA1 2c07cd7f02e18826a7fb099877d8dd957cd27331
SHA512 2b92b0335b70c99a6e582d22256926681a517dc88c9f353baae6b79271b940682175dd906ba6746042b8c57fce0361cd60c4d77cc3fb3322158453a8a0217160
SSDEEP 96:MVmsACoNEo7oloNEGMWSYo+sHOyqfNozSY:5no5
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 5.3MB
SHA256 793125c5420b86d763c7c3fd5191d0448480732551b1e5dc10f09eefb05b3380
MD5 97f2aebb4c3cb058995441277db99da3
SHA1 eaef8a3e37740115632646e64eb2810dc2eec1e6
SHA512 fa325d799ff464718a4073946c7b7b2d43c1ebd34904726bb0f030c9cecef1a5f1988fc4eae5b1388110cd1b93b1e427501e95d96ddd21a3ffdbf7c49c2e466a
SSDEEP 24576:oWPZCFFJWXDceo49xsDpBLsIMvH0OLs34nQPIV0MQxnRWJ6Uw0e2qDGvN73TUtvH:o
MD5 SHA1 SHA512 SSDEEP

Submit Download

addressbook.acrodata

Path C:\Users\Admin\AppData\Roaming\Adobe\Acrobat\DC\Security\addressbook.acrodata
Size 14KB
SHA256 06a576fc14e995c437b26c0d150b4e84cd745e7cedfd972a84b42b51c842fc9b
MD5 947f93fe0eed44767626846f28cfde05
SHA1 f6276d2a2b4a9d8a8e23c84019cd3961e9d60e88
SHA512 f97739eb0d22a99b06ef340aefb0d5a5b45b679d28accff3de2565166392c7d2fabaa33f945696f7d456ba2ef323f48e43eb26578f71c8b2e8ed32fb4dc69bc9
SSDEEP 192:gcPqYV/saFlwwR+kMqe8TlZMX1sgUVa3ddMVsuNeMcGdSD9obOUAVlcMudM/Y14W:g7Q/X4kMb0lZ6mgtdHOelGdWaolvsTh
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2712-276-0x0000000010960000-0x0000000010AAD000-memory.dmp

Download