a6dbaab6da4004321c979abf0b0270f44f56f793ac47751ccbc2989e258aea24

Analysis

max time kernel
380s
max time network
389s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
03-04-2024 10:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

sample3.pdf
Size

603KB
MD5

2b203ff7805a789f64ec614dee2a7e7b
SHA1

dfa47a1bacea6afc7e334a31ad53045338d29ec5
SHA256

a6dbaab6da4004321c979abf0b0270f44f56f793ac47751ccbc2989e258aea24
SHA512

263b79355f8541dabfd26b5e85bdf7e3423bab5081eb3c99131f5dad42cdde6eeed0d00b520bf7400a5ae86883a0270759cfa846ce71832d717ea2ccd2491257
SSDEEP

12288:dGROjjzZ2fNv33w32iaMLavQVXsEAop5tNIBUwlDq7p:GOjjzyNw2qLO6XstECFpq7p

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
2520	msedge.exe
2520	msedge.exe
1404	msedge.exe
1404	msedge.exe
4780	identity_helper.exe
4780	identity_helper.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe
3152	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3200	AcroRd32.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3200	AcroRd32.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious use of SetWindowsHookEx 14 IoCs

pid	Process
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe
3200	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 3672	3200	AcroRd32.exe	94
PID 3200 wrote to memory of 3672	3200	AcroRd32.exe	94
PID 3200 wrote to memory of 3672	3200	AcroRd32.exe	94
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 4960	3672	RdrCEF.exe	95
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96
PID 3672 wrote to memory of 912	3672	RdrCEF.exe	96

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\sample3.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3672
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4139FC8C660700E2132D113E595B3A20 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4960
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=C83463D2137E867330EDDE0A03F79099 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=C83463D2137E867330EDDE0A03F79099 --renderer-client-id=2 --mojo-platform-channel-handle=1752 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:912
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=C20AF32D29EC35A89E3B22210CEE28E6 --mojo-platform-channel-handle=2028 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:3576
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=2D16702ED13DBB415828946A567F720C --mojo-platform-channel-handle=1960 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4600
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=B85F1800BA6A3CE55E30A56179AB56B6 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=B85F1800BA6A3CE55E30A56179AB56B6 --renderer-client-id=6 --mojo-platform-channel-handle=1740 --allow-no-sandbox-job /prefetch:1
    3⤵
    PID:3448
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=A239DB33120DBDFEB9DF62FACB3DCB94 --mojo-platform-channel-handle=2672 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
    3⤵
    PID:4848
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ARH.exe
  -isAppInstalled chc 4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "http://community.adobe.com/chcservices/services/redirect?u=http://help.adobe.com&p=Reader_DC&l=en_US&id=EnhancedSecurity_WhatIsIt"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:1404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb8ea446f8,0x7ffb8ea44708,0x7ffb8ea44718
    3⤵
    PID:2844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:1844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8550900626218471939,10441223038293065972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
61dc8669193c79ec4381c21fe0fb397d

SHA1
a3546e4f618f7183beb3970f66ffc52af9dcb517

SHA256
d5a06c75558f11f58008d0e07567a4e2dae8bfdd24adeae490fba90d30890171

SHA512
3bcf38a1cd2ba7dfd00733565b89b46d9728b65b8b3c48f088c5b80ac312c4ca875a7699a9e293e39ec34ae5648ca9bceab88f2a1987f808416f2ffd51e880cb

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
36KB

MD5
b30d3becc8731792523d599d949e63f5

SHA1
19350257e42d7aee17fb3bf139a9d3adb330fad4

SHA256
b1b77e96279ead2b460de3de70e2ea4f5ad1b853598a4e27a5caf3f1a32cc4f3

SHA512
523f54895fb07f62b9a5f72c8b62e83d4d9506bda57b183818615f6eb7286e3b9c5a50409bc5c5164867c3ccdeae88aa395ecca6bc7e36d991552f857510792e

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
56KB

MD5
752a1f26b18748311b691c7d8fc20633

SHA1
c1f8e83eebc1cc1e9b88c773338eb09ff82ab862

SHA256
111dac2948e4cecb10b0d2e10d8afaa663d78d643826b592d6414a1fd77cc131

SHA512
a2f5f262faf2c3e9756da94b2c47787ce3a9391b5bd53581578aa9a764449e114836704d6dec4aadc097fed4c818831baa11affa1eb25be2bfad9349bb090fe5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
471B

MD5
e9f5542809bf0fbc11c12540aabfd222

SHA1
d4a675236c082eafae5f84830dfc4967cf36018c

SHA256
0b3bcb7e189a401bb54ca233fe36157da6a68559ad99011a63c480bb794ed5a0

SHA512
293ac537ec52c28c42476646c54919259257c36a49f914cfa32de63ad6fd981ccd3f757f942df7cbff35e34b7f7c945678d072ef9a3fbc0c35cd2a9e2180d7d0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04

Filesize
400B

MD5
9d9a9a0ad6ce99c55370b1dcb007b09d

SHA1
7585d42dedc65c07beb3eefe7aff8a3b17580606

SHA256
793ebe2f41ad86579c35b4f19bd4c43e61f5d1cef9b2761a7492a5cdff0f7588

SHA512
13f9f72d7ea8a55d76357f6b8a9b9186641e4e7abc4f92f3b6e488951c8fa290fd738c603c14d2ac8bd8b927953cc2c7ac54ed6acc19515eb07317928109f86d

Download Submit
C:\Users\Admin\AppData\Local\Adobe\Acrobat\DC\SharedDataEvents

Filesize
12KB

MD5
a6963aa7ed989b85f62636bbcd47bae4

SHA1
d54efe91d94d064773cd245ae4da02c07cdd8e0e

SHA256
d3e62f2df17cb4169b176cf75dac256d26bdcad55c31e76aed2637058182981b

SHA512
8698b1424f4a97fae7f4658fd31612c5c3cf9d44ac86287e26f026b77a7e63fbb58bc2cb0f8c0413d92a414800e0489d847429b92121eee58ffa8596461a99fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
279e783b0129b64a8529800a88fbf1ee

SHA1
204c62ec8cef8467e5729cad52adae293178744f

SHA256
3619c3b82a8cbdce37bfd88b66d4fdfcd728a1112b05eb26998bea527d187932

SHA512
32730d9124dd28c196bd4abcfd6a283a04553f3f6b050c057264bc883783d30d6602781137762e66e1f90847724d0e994bddf6e729de11a809f263f139023d3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cbec32729772aa6c576e97df4fef48f5

SHA1
6ec173d5313f27ba1e46ad66c7bbe7c0a9767dba

SHA256
d34331aa91a21e127bbe68f55c4c1898c429d9d43545c3253d317ffb105aa24e

SHA512
425b3638fed70da3bc16bba8b9878de528aca98669203f39473b931f487a614d3f66073b8c3d9bc2211e152b4bbdeceb2777001467954eec491f862912f3c7a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
4126bc44cf1d747f2ce8cd537ed42645

SHA1
d2978631d5550415fbc6a324982a3d5e89588971

SHA256
f54864f70ecfa2366fe4471a290a5256e61327dafafdd35ae6d99355686822b0

SHA512
e8ea9a38c1908d82d0be2594c51a1f4487170d2cb802bca83c5043b4fc4054a5fe7226a9e4a55157d211cfc15638fdcc0f4485093d90b82aac5c899314ab7791

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
990bc07d21c79d533b5296283c6819bc

SHA1
42ab169750aa4e00ec32a842f8c5d82bc4ab7c69

SHA256
6dfb46c8fee0bd193512e575c68c03d95c5d8d53a2650abad4926b54aea26a5c

SHA512
12f12f4b5a821a9074009fb2fd1d52b12b27d6e1d6f5453a07127a5cde2c828426c0364cc2eb0ff0d4c0ca14db69cd3cafba13052dadfcc9cf026260d8873d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
840e837017ef00940862de93112e96c8

SHA1
1543650c8bc721b2f0aed1b4ee234bc8ecfc123a

SHA256
d9dceac7796538b3993c22597ca362b32aeeecbe5768ae314b55f36b45ec8d6b

SHA512
80a0fd0df99874d74e47b61c7b82642ff057e5dda067361d1d7edd3f6cc7e14e76d9ed7b1bacbdb34c17c1807de09ff649b906d57c0adf02761ccf89004033af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
829bad747c115ee6f4fd2b852cadef9c

SHA1
a0452fa83edd0f18c469b86641254f308c4d5ab3

SHA256
9f9b9f0a92c979300fd47c63fcffd5ca1372c49c9503c909ceb0706686f34de9

SHA512
6c8be5871ecc1d2f7983d2f2f10c41beca0e062e260f58484d72ba1490046345d87b3e57b6e21d4bb7c3dc1e7b2050a42f0f783e7a6e96fb050504a8fbc4403c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5511c4699655c65ee2bd2bf8f329c1fd

SHA1
4a22c4d7086a20fffe5b5a4250624b6bf267d924

SHA256
0e556904ef3540f8a29bbc1550517092ad1f909d60735206290ea0891ecf4995

SHA512
55cee62fde21da3444ab422857ef87ef3582d768139e40dd16d855e3e13b1d184b00f5ed7408dbbddba6825953820a3af480170a4bbaa7bbe9ab8b544a04acb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1bb8eea921765c4ce5b14c9740b0a6c3

SHA1
d6ad9d4d31b1e3b1135f39bee2e99863fb1fbd3f

SHA256
bcffac01b7ae534dc6a633372e7dcc9581c083b31748d0a076b11b9e0788a246

SHA512
1980693453ac9669773ddd97b2a83c901c3c177bd5d35873223d97585ee21aff8c15f41402ea297abfe3063a82fe5b2873d4ee5f71777487b7eae9309759bec7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e5299c0c113fdb9318f3b188175693b6

SHA1
4d1bb8093273547cb096210c63c6a7fda117f41f

SHA256
72a97e37908eee310cb181580bf99e8722a35f07c18411ce439e9d91db9ba7e5

SHA512
ef4e19de23aad29a0b4b16489c356151fee8361bbd18c6fcf0c13d43f7e5e2fbdf2fbb12ec4006036c32f736edf706685a261a4f9e97c64ef6591cbd70e9485d

Download Submit
memory/3200-210-0x000000000B840000-0x000000000B8AF000-memory.dmp

Filesize
444KB

Download
memory/3200-211-0x000000000B980000-0x000000000BB99000-memory.dmp

Filesize
2.1MB

Download
memory/3200-213-0x000000000B840000-0x000000000B9C2000-memory.dmp

Filesize
1.5MB

Download
memory/3200-212-0x000000000B840000-0x000000000B8C8000-memory.dmp

Filesize
544KB

Download
memory/3200-216-0x000000000B840000-0x000000000B891000-memory.dmp

Filesize
324KB

Download
memory/3200-215-0x000000000B840000-0x000000000B86A000-memory.dmp

Filesize
168KB

Download