Resubmissions

05/07/2024, 04:35

240705-e7rytasfpq

25/03/2024, 14:17

240325-rlxy6aae2810

Analysis

  • max time kernel
    146s
  • max time network
    158s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/03/2024, 14:17

General

  • Target
    [email protected]
  • Size 211KB
  • Sample240325-rlxy6aae28
  • SHA256 f5d002bfe80b48386a6c99c41528931b7f5df736cd34094463c3f85dde0180bf
  • MD5 SHA1 SHA512 SSDEEP
Score
4/10

Malware Config

Signatures

  • Drops file in Program Files directory 64 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Drops file in Program Files directory
    • Checks processor information in registry
    PID:232
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4432 --field-trial-handle=2280,i,4114443225282860369,4764091921472631035,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:4684

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          icudtl.dat.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\icudtl.dat.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 16B
          • SHA256 f6031d99e50892151dbf6fa95c72163108068cd90f3e67f1dc4abee42e880eda
          • MD5 SHA1 SHA512

          s_remove_18.svg.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_remove_18.svg.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 720B
          • SHA256 5ba953551828f169912450726a80dceaa9d8efad6d96120f3b358ed5072b24f6
          • MD5 SHA1 SHA512

          example_icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 688B
          • SHA256 b51a671184078af322614b756ba0a0a28d9174a408c83306afd15456a3411701
          • MD5 SHA1 SHA512

          example_icons2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\images\example_icons2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 1KB
          • SHA256 e5992e12507dee29783dd75792ae8704b53e7b99f499563eebd83a1c7c86fac8
          • MD5 SHA1 SHA512

          rhp_world_icon.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 448B
          • SHA256 23302cc4f4a152251a216f588b76beee6dd9127ebbdf6e3bad12c47e47fb0d13
          • MD5 SHA1 SHA512

          rhp_world_icon_2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 624B
          • SHA256 498ab2d5156dce80df90904d9c83ca1370878d85830a12c699571cf9376d6ff3
          • MD5 SHA1 SHA512

          rhp_world_icon_hover.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 400B
          • SHA256 4cfe9eb3b70d81fd4ea46e04b4df29d09ceb977ac073619e32c23532eff080b5
          • MD5 SHA1 SHA512

          rhp_world_icon_hover_2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\rhp_world_icon_hover_2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 560B
          • SHA256 e15813011042fea971a83e5cbd1087ded6ab171e0910ecc8c09d43dc5ffce3ca
          • MD5 SHA1 SHA512

          rhp_world_icon.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 400B
          • SHA256 61b09d71d826d611d5ce93c011deeb2e19074ceb7a7b2b2bfbb184de8ed45e70
          • MD5 SHA1 SHA512

          rhp_world_icon_2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 560B
          • SHA256 9f87da42ac8010ee8a3c9e61ded88d1e030d45a0783f1e4bd83f4556fecb3448
          • MD5 SHA1 SHA512

          rhp_world_icon_hover.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 400B
          • SHA256 b8bcf3569a2793d1d0c2a6ecc7ea89d4dabafcbe9bf2ca670d6295a13c33c11d
          • MD5 SHA1 SHA512

          rhp_world_icon_hover_2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\images\themes\dark\rhp_world_icon_hover_2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 560B
          • SHA256 7c93e98aff6c8e239a9127e1a93e1b74d0ec447761afde6d63c4bddaa792add5
          • MD5 SHA1 SHA512

          icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 7KB
          • SHA256 27d4c4f30cebea7de8096c6d3699122cc9628854f2aa2d79296a9c2a62383e07
          • MD5 SHA1 SHA512 SSDEEP

          icons_ie8.gif.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_ie8.gif.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 7KB
          • SHA256 04090f4f0b2c9cd011d5b2360c81ddd40a5e2c092d0f5e5babf2cab80648ee08
          • MD5 SHA1 SHA512 SSDEEP

          icons_retina.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\icons_retina.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 15KB
          • SHA256 6f8b0c7b424d376cf6d6e0c58e75897e51c7b1adc8a5e5b95dc6359e7a7a832f
          • MD5 SHA1 SHA512 SSDEEP

          new_icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 8KB
          • SHA256 a6670f71cd8f45df904a28e0b8d77abf60163a547ceeecbf06e41c9740943005
          • MD5 SHA1 SHA512 SSDEEP

          new_icons_retina.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\new_icons_retina.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 17KB
          • SHA256 02d27e2f44b57687e0cba4ecda8211adf858710045ae92d5c0ba3663413dc8d0
          • MD5 SHA1 SHA512 SSDEEP

          bg_pattern_RHP.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_pattern_RHP.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 192B
          • SHA256 1a83af764e781ab1f08774c553c3ed200d9886c8b21f7e09dd032f78f6060cca
          • MD5 SHA1 SHA512

          bg_patterns_header.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\bg_patterns_header.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 704B
          • SHA256 bebbd4a6b6370298ab0877cb8760c7d7f1452271353c105700f074fefa8ac24a
          • MD5 SHA1 SHA512

          illustrations.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 8KB
          • SHA256 e1829882c0bb6d042345e178dab2148b7fcf52c7accc0f7a28013e8b4603ae5b
          • MD5 SHA1 SHA512 SSDEEP

          illustrations_retina.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 19KB
          • SHA256 4459ba297de4b2a72aa268aedcff1680ae1448950bc9463624fef07280da2567
          • MD5 SHA1 SHA512 SSDEEP

          ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-gb\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 832B
          • SHA256 b167827afedbbadd4e3d1f9d7b0fe155f62cc6b1bda6dc19c701cd00dc487b94
          • MD5 SHA1 SHA512

          ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 1KB
          • SHA256 0b28482b36b83fc9a60b34b11950b2be123b6196340071d18f474dcfa51f289c
          • MD5 SHA1 SHA512

          ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 1KB
          • SHA256 689350254578dfd706adfdcef37742d11cb44bd359dc04cde52784c697c8f97c
          • MD5 SHA1 SHA512

          main.css.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\css\main.css.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 816B
          • SHA256 20782543ae855aad7e0f1e8d65d7ecd8b8ddcebb2d34a759ed36e1b7b4d1bd71
          • MD5 SHA1 SHA512

          bun.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\bun.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 2KB
          • SHA256 b7d30e62923449562c3d69fa1ccc2aa0eebb4304532c7f3965a8355a4bda224b
          • MD5 SHA1 SHA512

          cstm_brand_preview.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 2KB
          • SHA256 29c246e202b4d06a1d64781f7b0ad51e965c7b1fbe48e68e8364faaebb539866
          • MD5 SHA1 SHA512

          cstm_brand_preview2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\cstm_brand_preview2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 4KB
          • SHA256 5c1253e77fcaea66e5aa83ef7131dbeac2c340efa0aa550b5bc40e02cc4caf54
          • MD5 SHA1 SHA512 SSDEEP

          dd_arrow_small.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 304B
          • SHA256 bf26a3644f5f166e9fffa9318f0300b6b4cf9b32da0a8ee3fc906ec9d0d6efb6
          • MD5 SHA1 SHA512

          dd_arrow_small2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\dd_arrow_small2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 400B
          • SHA256 53cc2ab64943010779bccf798eccf6eebfd43017db18cac40de85a0c13e96c7a
          • MD5 SHA1 SHA512

          nub.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\nub.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 1008B
          • SHA256 ecfe7c919ba0d126d3baeea2be0b959053f7e4b447a9c5f594f732c5b21135d9
          • MD5 SHA1 SHA512

          share_icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 1KB
          • SHA256 2da01e9ad6c2af1dfbf3a7f48500bcfc89f3e94d444f882f48f517a626901d9a
          • MD5 SHA1 SHA512

          share_icons2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\images\share_icons2x.png.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 2KB
          • SHA256 2635f79d24bb6d68ac3de5fafe5ce7873374a48d4109ea350cf7850c9a650bb1
          • MD5 SHA1 SHA512

          ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\viewer\nls\nl-nl\ui-strings.js.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 848B
          • SHA256 6ce76afa30c56305b5b4eae79dcff2fca58e2dc66d2970f61dbf6703d05d0087
          • MD5 SHA1 SHA512

          DisplayLanguageNames.en_US_POSIX.txt.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0

          • Path C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.6D59E49D1FDC0FBCEB02AF0C807C193D4182D292E86605A94DC1FF580106ECD0
          • Size 32KB
          • SHA256 32850860a35bd44b2c9d1dbb5091883705361a7097dadc1fda7cdcce8eaffffa
          • MD5 SHA1 SHA512 SSDEEP

          memory/232-5-0x00000000056A0000-0x00000000056B0000-memory.dmp

          memory/232-0-0x0000000074AB0000-0x0000000075260000-memory.dmp

          memory/232-1-0x0000000000A30000-0x0000000000A6C000-memory.dmp

          memory/232-2-0x0000000005480000-0x000000000551C000-memory.dmp

          memory/232-3-0x0000000005B90000-0x0000000006134000-memory.dmp

          memory/232-4-0x0000000005520000-0x00000000055B2000-memory.dmp

          memory/232-204-0x00000000056A0000-0x00000000056B0000-memory.dmp

          memory/232-6-0x0000000005450000-0x000000000545A000-memory.dmp

          memory/232-7-0x0000000005640000-0x0000000005696000-memory.dmp

          memory/232-113-0x0000000074AB0000-0x0000000075260000-memory.dmp