6d67a6b7b72220845abe6f3b798f509528e43de3afa798dcf36047996cc4a27e

Analysis

max time kernel
49s
max time network
85s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1/Yuka - Scattered Shards of the Yokai/locales/ar.pak
Size 286KB
Sample240511-phgfwsae99
SHA256 72395a0fa37238d4063c5698035cf8811d8c5fc69e323ff92fc281fbb35f22f6
MD5 fd2e8674f0043124f60e96ab3b822c94
SHA1 0df8094551959742432986527484bf6e53afeddf
SHA512 28bf8f98822791efd8bea8459f778b2c48b537d00a2708c9149bd51f5640a8bf63639eebf2c70ef74d896201cb6b03ebce24cd81c9e96eeb52f0903f997f4e0e
SSDEEP 6144:e9XHSvHru4HU3pL6kxilzGmOAGbA5ANlObzDQ:Dvy4HGpL6+ilzGmOAGbA5ANlObzDQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2684	OpenWith.exe
3972	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3668	firefox.exe
Token: SeDebugPrivilege	3668	firefox.exe
Token: SeDebugPrivilege	3668	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
3668	firefox.exe
3668	firefox.exe
3668	firefox.exe
3668	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3668	firefox.exe
3668	firefox.exe
3668	firefox.exe

Suspicious use of SetWindowsHookEx 48 IoCs

pid	Process
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
2684	OpenWith.exe
3668	firefox.exe
3668	firefox.exe
3668	firefox.exe
3668	firefox.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
3972	OpenWith.exe
2596	AcroRd32.exe
2596	AcroRd32.exe
2596	AcroRd32.exe
2596	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 1316	2684	OpenWith.exe	88
PID 2684 wrote to memory of 1316	2684	OpenWith.exe	88
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 1316 wrote to memory of 3668	1316	firefox.exe	90
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 3020	3668	firefox.exe	91
PID 3668 wrote to memory of 644	3668	firefox.exe	92
PID 3668 wrote to memory of 644	3668	firefox.exe	92
PID 3668 wrote to memory of 644	3668	firefox.exe	92
PID 3668 wrote to memory of 644	3668	firefox.exe	92
PID 3668 wrote to memory of 644	3668	firefox.exe	92
PID 3668 wrote to memory of 644	3668	firefox.exe	92
PID 3668 wrote to memory of 644	3668	firefox.exe	92
PID 3668 wrote to memory of 644	3668	firefox.exe	92

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\locales\ar.pak"
1⤵
- Modifies registry class
PID:4220

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\locales\ar.pak"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Local\Temp\Yuka_-_Scattered_Shards_of_the_Yokai_ENG R1\Yuka - Scattered Shards of the Yokai\locales\ar.pak"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3668
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.0.693731934\2079240773" -parentBuildID 20230214051806 -prefsHandle 1816 -prefMapHandle 1808 -prefsLen 22076 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9ccf5389-43a5-47f4-b6f0-ab0b6978a5e1} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 1896 1f03c60d458 gpu
      4⤵
      PID:3020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.1.709452579\1945383987" -parentBuildID 20230214051806 -prefsHandle 2460 -prefMapHandle 2448 -prefsLen 22927 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {42e647c5-c304-43af-ae89-fa61d51095e7} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 2488 1f02f78cf58 socket
      4⤵
      PID:644
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.2.792278861\797928509" -childID 1 -isForBrowser -prefsHandle 3012 -prefMapHandle 3008 -prefsLen 22965 -prefMapSize 235121 -jsInitHandle 912 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e749950-d9be-48ad-8c13-c3eebb69b1c1} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 3020 1f03f565958 tab
      4⤵
      PID:968
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.3.1158280566\1695068283" -childID 2 -isForBrowser -prefsHandle 3900 -prefMapHandle 3896 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 912 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c8dca639-2fa7-4aeb-a407-b7bd89faa261} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 3904 1f040d3e258 tab
      4⤵
      PID:4384
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.4.718612959\1607628753" -childID 3 -isForBrowser -prefsHandle 5064 -prefMapHandle 5060 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 912 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {db8410bb-755e-4426-ac0d-23ef9820ad4a} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 5076 1f042a59f58 tab
      4⤵
      PID:4312
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.5.576648426\228844354" -childID 4 -isForBrowser -prefsHandle 5236 -prefMapHandle 5240 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 912 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f529568e-ee94-4c67-baba-b6aeab8d7efd} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 5312 1f042a5a258 tab
      4⤵
      PID:2616
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3668.6.1605938729\1337858885" -childID 5 -isForBrowser -prefsHandle 5196 -prefMapHandle 5096 -prefsLen 27616 -prefMapSize 235121 -jsInitHandle 912 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eb5e1ab8-eef2-4262-8e24-5f62d5872668} 3668 "\\.\pipe\gecko-crash-server-pipe.3668" 5492 1f04254d358 tab
      4⤵
      PID:4296

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:3972
- C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
  "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\Downloads\ar.pak"
  2⤵
  - Checks processor information in registry
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2596
- - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
    "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
    3⤵
    PID:4456
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=87BFCE15E3D7C2D0647C7AB77645E92B --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=87BFCE15E3D7C2D0647C7AB77645E92B --renderer-client-id=2 --mojo-platform-channel-handle=1756 --allow-no-sandbox-job /prefetch:1
      4⤵
      PID:2284
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=D1E2EDD6371E01DF9329E7481044EBC2 --mojo-platform-channel-handle=1764 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1C8E288889EC0DBE0F63CB57EDE73366 --mojo-platform-channel-handle=2312 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1160
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=27372B0070BDB4FBCCA4A2F5F86055F6 --mojo-platform-channel-handle=2088 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:2044
  - - C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
      "C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=780FD7CD07F3D9579286A27C4D81E9FF --mojo-platform-channel-handle=2108 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
      4⤵
      PID:1140

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\activity-stream.discovery_stream.json.tmp
Size 26KB
SHA256 85ea283741c0c5bfcbd0a265f14d723768cdf6641c74096107c95747182234a6
MD5 3ff230978a3c0e02763302760f7b1654
SHA1 436e82804bca9f2bb3319851c115492a832602d6
SHA512 5255bbe0562f8aa8fb263e093a8b344e0b58b224190d3925b962bda8bdd68f4775f182e286e9d4bb12a6565a57212a3192ac41bef491ee5164901ad9be1adf28
SSDEEP 384:rhzI7QgJ9oJPqGN/5YNEz8RbhkqNMCAOMo7pBcj1SbS1FGuFe1EoyauR0iWn0iWK:rhhWcYbhlxAOPpM14gFMEoydmR0RWb
MD5 SHA1 SHA512 SSDEEP

Submit Download

activity-stream.discovery_stream.json.tmp

Path C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\activity-stream.discovery_stream.json.tmp
Size 26KB
SHA256 fd69faecdddebd450f146555c1a70729b18094a304f5e3661718e5ca54da8742
MD5 321140f9331e9086cb32c5731c8d0ba2
SHA1 69721af685f569b5e1dd8c1998bb9f7080fce49f
SHA512 c7f176c01981f3bc0b6d0e418d9f1c9e307772dc86365b389801fdad64e04a15949ab64dd1bdbcd36b3f06553d9e27d7146f574fd0270718146b8dc8641298ae
SSDEEP 384:rWWKc1lTS4vcTIV3ysf0Lnq77G5XRk2i0jHCz/yauR0iWn0iWWb:rWWn+IEA0Lq7OSydmR0RWb
MD5 SHA1 SHA512 SSDEEP

Submit Download

recovery.jsonlz4

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xs8l7p8u.default-release\sessionstore-backups\recovery.jsonlz4
Size 1KB
SHA256 27296351d465924543c03c5b2af91fa6dae97f26a2e6a9a1387a65960b537e98
MD5 12ac5f6beb4c170412897348299d6604
SHA1 ce7fa052854f5a92e58e15fae6b2ad57c62c3cb6
SHA512 3e8231424e94a1d4c3eec723c3d1e90252109dcf16e1ba5e0928076229b1a932b61e0b37ce70d20d74d59b90ae1fec36a04a7d32ee62058992d8789bf6f36d41
MD5 SHA1 SHA512

Submit Download

_kYl4lgp.pak.part

Path C:\Users\Admin\Downloads\_kYl4lgp.pak.part
Size 286KB
SHA256 72395a0fa37238d4063c5698035cf8811d8c5fc69e323ff92fc281fbb35f22f6
MD5 fd2e8674f0043124f60e96ab3b822c94
SHA1 0df8094551959742432986527484bf6e53afeddf
SHA512 28bf8f98822791efd8bea8459f778b2c48b537d00a2708c9149bd51f5640a8bf63639eebf2c70ef74d896201cb6b03ebce24cd81c9e96eeb52f0903f997f4e0e
SSDEEP 6144:e9XHSvHru4HU3pL6kxilzGmOAGbA5ANlObzDQ:Dvy4HGpL6+ilzGmOAGbA5ANlObzDQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads