20b7bb89d1e758aa6bb45e033419e81253e82056bf9be35f656edf9bb0b6af2b

General

Target

Account Amazon #7728388.pdf
Size

18KB
MD5

f014da04b73b22f8e415389c9153e0e6
SHA1

7d4520e1f7fff0f36fa2a659c5f00463ecc46027
SHA256

20b7bb89d1e758aa6bb45e033419e81253e82056bf9be35f656edf9bb0b6af2b
SHA512

ec04a3f415d26aa422d3087adff44035593b4aec81d5fe9575258dc69d16964a9383cd4297257b8d8792ae891171579ca7fc811346106e17a1bdb928bf1e35aa
SSDEEP

384:CcaXtVxhyY4QSmLWdXync3Gm5ljhMun2GCv2sJ9D:Y9Vxhyp/mLGCcHjjhMQ2GCv2sJx

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exe

pid process

1732 msedge.exe
1732 msedge.exe
3032 msedge.exe
3032 msedge.exe
5832 identity_helper.exe
5832 identity_helper.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

msedge.exe

pid process

3032 msedge.exe
3032 msedge.exe
3032 msedge.exe
3032 msedge.exe
3032 msedge.exe

pid	process
1732	msedge.exe
1732	msedge.exe
3032	msedge.exe
3032	msedge.exe
5832	identity_helper.exe
5832	identity_helper.exe

Suspicious use of FindShellTrayWindow 26 IoCs

Processes:

AcroRd32.exemsedge.exe

pid	process
2076	AcroRd32.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

Processes:

AcroRd32.exe

pid process

2076 AcroRd32.exe
2076 AcroRd32.exe
2076 AcroRd32.exe
2076 AcroRd32.exe
2076 AcroRd32.exe
2076 AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 2076 wrote to memory of 1392	2076	AcroRd32.exe	RdrCEF.exe
PID 2076 wrote to memory of 1392	2076	AcroRd32.exe	RdrCEF.exe
PID 2076 wrote to memory of 1392	2076	AcroRd32.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 4292	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe
PID 1392 wrote to memory of 1932	1392	RdrCEF.exe	RdrCEF.exe

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\Account Amazon #7728388.pdf"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2076

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:1392

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=3073754D9EA1864D34E4E4830BA9CB5A --mojo-platform-channel-handle=1740 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4292

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=3F8C7F3BC7FCA6B7F597D193D48BF19E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=3F8C7F3BC7FCA6B7F597D193D48BF19E --renderer-client-id=2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job /prefetch:1
3⤵
PID:1932

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=059CE733E464F33A08AF93EC76900480 --mojo-platform-channel-handle=2156 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4128

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=42BE9B3315EAC47C75A0D40C96EB4BD9 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=42BE9B3315EAC47C75A0D40C96EB4BD9 --renderer-client-id=5 --mojo-platform-channel-handle=2416 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2136

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=5AE6072410CBA501BE97D604FE12CA19 --mojo-platform-channel-handle=2692 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3252

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=34F50B139B5A8261B63B5A75F7C0F453 --mojo-platform-channel-handle=2804 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mobile.mail.yahoo.com/apps/affiliateRouter?brandUrl=https%3A%2F%2Fscript.google.com%2Fmacros%2Fs%2FAKfycbzXPHpadJC4q_3RFRiBGaoP_tD85KyKS2WjSEoTrb1mHGL19KY6B1mPMuGYwyspFhj4%2Fexec&appName=YMailNorrin&partner=2&locale=1&pageId=&clickRef=contact_card&region=na&annotation=&buckets=
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff898c846f8,0x7ff898c84708,0x7ff898c84718
3⤵
PID:548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,13752799708794008299,622511630595742095,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
3⤵
PID:2380

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,13752799708794008299,622511630595742095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,13752799708794008299,622511630595742095,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
3⤵
PID:1284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13752799708794008299,622511630595742095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
3⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13752799708794008299,622511630595742095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
3⤵
PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13752799708794008299,622511630595742095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
3⤵
PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13752799708794008299,622511630595742095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
3⤵
PID:5740

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,13752799708794008299,622511630595742095,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13752799708794008299,622511630595742095,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
3⤵
PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,13752799708794008299,622511630595742095,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3904 /prefetch:1
3⤵
PID:6016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4204

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
9ddd2ee896a5c1fbf6288f9f2fc46eec

SHA1
2f612b4fcd898a79d9d62d973344e3c6eed1f9da

SHA256
3dba1e910052e669ad0185147d5387d86ca0ef14a5f7f87d30ab9c6a29ebc969

SHA512
32e4147a93d6408c73ab2fda2de91736979a18e43cf4f54f66fa4c7197369954cddea04749458db1813927f51bd9743664b9fe3445141e801c659c40bb3527da

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages
Filesize
64KB

MD5
66b892f3ad0f1acec3d9412bc1c1e93b

SHA1
3a39490dba63d1921d982441831c7dc09c47fda8

SHA256
89efae973cf3a78a27bf1f86e438a5ff723bfc087c792e06f2f69c6fa416b454

SHA512
df839c8d20bb9099ccbfd96c73ac55e3ce2ddefbbb40fa5fc487cf60331b5f4da9981595cf1ccf50b78ff407a4cc5fb221eda852b7f9855b91079742ba341749

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
067f5c4676c6469453589f30b8c85be3

SHA1
5e9369436e58d46f01869a18a2b34d1bb791f9ba

SHA256
488cd58b13b2e77aa6d25c16b6f185e9353cfe1b18478f92e18a44c1f56ebd0b

SHA512
5d8db779278a9431d4e702497b3d9a7289b3aede2ad250fc62bd95bb8ae646f8e35cc194937efb722a62b014f4d63291576507565c152bebbab8c49b9412b769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
eae4dde991ac69be4fd35ee50afa14c2

SHA1
d75b7ba27ed3067b179ef2b06d9305a7c34b6778

SHA256
959be8b37b378ee08d88c1d48e6797f747b51ca0bb4977c7c8ca50d824cd15a7

SHA512
6bcd53ab5b123bf9fde43b47608183a5ef52b54aa47e8556969ac8a3b3fa3c88353dc1770aaee0939af83323c168698dea4597adbc9404bcf0d124d88291c6a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
4b2827b6217619425bec03094c2d4514

SHA1
9da9ea108d15f45dd547da7bdcada2bfd57ed4b2

SHA256
3d80e1a73d5f7d219be596500f3cfda6fb417b8fe4f1512d1affeb3b3363e717

SHA512
929e60be9f2df54b404db30477e43eb5a9049dbff186bcb62545d735d0dd35cb27a5332e136a4fd5eaa88d89db68a284546dbe5f5c588b6d9a1c0a7eaa1795ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
\??\pipe\LOCAL\crashpad_3032_UFRDGSGVXUSXCERM
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
memory/2076-36-0x000000000A330000-0x000000000A351000-memory.dmp

Filesize
132KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads